Unanswered Questions

175 questions with no upvoted or accepted answers
5
votes
1answer
358 views

MS08-067.c fails at WNetAddConnection2()

I'm working with some exploit code for the MS08-067 vulnerability from ExploitDB. The section: WNetAddConnection2(&nr, "", "", 0)* fails with an error of 67 (ERROR_BAD_NET_NAME), but I don't ...
4
votes
0answers
135 views

Kerberos Attacks Questions

It's amazing how many "Attacks on Kerberos" articles exist out there and almost none really explains the small details. My guess is that usually they assume it's basic knowledge and sometimes, they ...
4
votes
0answers
731 views

Hyper-V Sockets in 2016 version and host/guest communication

In new version of Hyper-V released recently with MS Windows Server 2016 contains a new functionality Hyper-V Sockets which allows for host/guest communication. It uses WinSock API with new address ...
4
votes
0answers
165 views

Lookaside List Injection

I've been reading a lot about Use-after-free and came across this document. It talks about a "Lookaside" injection exploit. The document says to empty the dynamic memory cache, called the Lookaside ...
4
votes
0answers
289 views

Enable FIPS 140.2 in Windows 7 (cng.sys version does not match with versions from NIST Validated list

I am currently working on an application running in Windows 7 Ultimate, and it has to be FIPS 140-2 compliance. As far as I have researched in https://technet.microsoft.com/en-us/library/security/...
4
votes
0answers
99 views

how to create TPM_AUTHDATA as input in tpm commands ?

I'm writing my first program which use tpm (version 1.2) services in Windows 7 using TBS, in this program I'm trying to execute the TPM_CreateWrapKey command. I noticed that many commands like the ...
4
votes
0answers
900 views

copying roaming profile credential file of another computer

I am trying to recover login information of another computer. I have managed to copy the local/roaming profile credential files located in C:\users\%username%\APPDATA\local\Microsoft\Credentials\ and ...
3
votes
0answers
115 views

Exploit “Blind” buffer overflow in a lab

In a CTF/exploitation lab, I am aware of two separate machines. Developer machine: Windows 7 x64, as blank, as it can get (no KB patch) Service machine: UNKNOWN On Developer: I have a source code ...
3
votes
0answers
133 views

How does TPM and BitLocker work together?

When a computer has a TPM module, BitLocker doesn't seem to require a password, which makes me really uncomfortable. Where's the key coming from? What's preventing someone from grabbing the key by ...
3
votes
1answer
221 views

How can Nmap bypass Windows Server firewall rules?

I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules ...
3
votes
0answers
41 views

Is it possible for a remote machine to “escape” from a folder mapped through RDP?

Although most people seem to share entire drives with RDP, it is possible to share individual folders, by mapping them to a drive for example with subst <lettertomap>: <pathtofolder> (for ...
3
votes
0answers
338 views

Exploiting Environment Variables in Scheduled Tasks for UAC Bypass

I am trying to escalate privileges from an ISS user on Windows Server 2012 R2 by exploiting Environment Variables in Scheduled Tasks for UAC Bypass as the following link explains the exploit: https://...
3
votes
0answers
38 views

Is it possible to prevent rogue/unauthorised computers booting from your PXE server?

In the below scenario, is it possible to prevent a rogue/unauthorised laptop plugging into the network and installing our Windows image? What risks are we exposed to should a malicious 3rd party boot ...
3
votes
0answers
287 views

Entropy sources used by modern Windows

A comment on a Microsoft blog from 2005 mentions over 150 sources of entropy for the Windows CryptGenRandom function. The majority of sources come from low-level system information (precise stat ...
3
votes
0answers
85 views

How can I identify which SCHANNEL events are being generated by a Remote Desktop connection attempt?

I need to check which encryption level is being used for a Windows Remote Desktop session. I found this question, which shows how to enable logging that shows the client handshake and level of ...

15 30 50 per page