Tag Archives: Windows

Malware Archaeology Updates Windows Logging Cheat-Sheets

The ‘Windows Logging Cheat Sheet’, ‘Windows File Auditing Cheat Sheet’ and ‘Registry Auditing Cheat Sheet’ have been updated for 2016.  The cheat sheets have been updated in part due to auditing improvments[sic] added by the ‘Windows 10 Anniversary Update’ released earlier this year.  We also took the opportunity to do some cleanup and add more autorun keys to the registry auditing cheat sheet.  Updates are easy to spot, just look for ‘new‘.

Go get ’em and watch for the updated Log-MD!

http://hackerhurricane.blogspot.com/2016/10/the-windows-logging-file-and-registry.html

Domain User Spraying and Brute Forcing Domain Default Passwords, Avoiding Lockout

Looks interesting:

A while ago, Dave Hoelzer did a nice video on how to use Windows PowerShell to hack domain user accounts. Basically, Dave leveraged PowerShell commands which any domain user can execute on a domain and receive either a positive and negative response based on the legitimacy of the username and password combination. This got me thinking. Since I’m not typically handed, or able to spawn, a PowerShell right from the get go, what else could I use to accomplish the same goal? The answer is attempting to connect to the IPC$ share of a domain controller. Using the following command, you can spray a huge list of domain users with a small number of passwords (to avoid lockout) and try to catch someone using something simple.

@FOR /F %n in (names.txt) DO @FOR /F %p in (passwords.txt) DO @net use \\DC01 /user:mydomain\%n %p 1>NUL 2>&1 && @echo [*] %n:%p && @net use /delete \\DC01\IPC$ > NUL

WARNING: Make sure the number of passwords in your file is less then that of the account lockout policy.

And the other obligatory warning – make sure you have approval from Corporate before trying this.

via PaulDotCom: Archives.

IE7 on Linux

I recently built an XP virtual machine with IE 6 for a client, perhaps I’ll suggest this as an alternative.  We’ll just need to validate that IE6 on Linux renders web pages identically to a Windows installation.

Ever fancied running Internet Explorer 7 (or even earlier versions) on your Linux machine but didn’t find an easy way of doing it – admit it, wine doesn’t work that smoothly – IEs4Linux is the solution for you, check it out, or the complete guide.

via SecuriTeam Blogs » IE7 on Linux.

Gartner: Windows 7 security features have strings attached

Some gotchas in Win 7’s “built-in” security:

For instance, top-end security features like AppLocker, BitLocker, BitLocker to Go and DirectAccess require the more expensive Windows 7 Enterprise version, and also call for Enterprise Assurance or Software Assurance maintenance plans; the features don’t come with the pre-configured PCs sold by HP or Dell.

Some organizations, MacDonald said, have tried to work around this limitation by purchasing Windows 7 Ultimate, a similar edition that also contains all the same security features as Enterprise. Despite being initially more expensive that Enterprise, Ultimate is $100 cheaper per user when factoring in the savings of not purchasing a maintenance plan. However, there are drawbacks to this approach as well.

“Ultimate is officially a consumer version, and comes with a consumer SKU, which means it has consumer-level support. So instead of getting 10 years of support and security patches, you only get five years,” MacDonald said, “and you don’t get volume license activation, so you’d have to manually activate each version.”

via Gartner: Windows 7 security features have strings attached.

Can’t activate Windows XP after a repair install or in-place upgrade

I ran into an interesting problem yesterday, and by “interesting” I mean really annoying and made me curse Microsoft repeatedly, again and again.

An old home PC has been having video problems off and on for several years:  It’d show an argyle-style print superimposed over whatever was on the screen.  Rebooting would sometimes fix it, but in recent months it was fairly permanent.

So I replaced the motherboard, CPU, and memory, booted up XP, and ran a repair to re-install XP with all required drivers while keeping all local data, profiles, and programs.

But upon reboot, XP demanded that I activate before I could use the computer (expected), but after I agreed to activate, it would log me in and show me my desktop, but no Activation wizard would open, nor any other program (unexpected).  It was not possible to use any Window-key shortcuts to open any windows or programs, I could only push the reset button to reboot.

Booting into Safe Mode or Safe Mode with Network would result in a prompt saying something to the effect, “This Windows activation must be activated, but it cannot be activated in Safe Mode. Please reboot and try again.”

However, rebooting to Safe Mode with Command Prompt would allow me to log in, and I could run Explorer and msc.exe from the command prompt, and get around in the system.

After some Googling, I found this article, downloaded IE8 to a USB drive, installed it via Safe Mode Command Prompt, rebooted, and happily activated away.

After running a repair install using a Windows XP SP3 disc, after booting up and logging in, you’re given the message along the lines of: “You must activate Windows before you can log on. Would you like to activate Windows now?” If you select “Yes,” which is supposed to bring up the activation prompt, nothing happens. You get to stare at your desktop wallpaper until you decide to restart your computer manually. If you select “No,” you are immediately logged out. What to do?

Anyway, I discovered an easy solution to this problem today: Just boot the machine in safe mode and install Internet Explorer 8. (You’ll need to download it from Microsoft’s web site and put it on a flash drive or something to move to the troubled machine.)

via Can’t activate Windows XP after a repair install or in-place upgrade – aaron-kelley.net.

Stop beep in Windows XP volume control

I’ve been a fan of O’Reilly’s Windows Annoyances books since Win95, and the annoyances.org website is chock-full of excellent tips for tuning the annoyances out of Windows.  (Short of wiping and loading UNIX, of course.)

In this particular instance, I got sick of how Windows Volume Control beeps so very loudly in my earbuds when the Master Volume slider is adjusted.  Happily, it is easy to completely disable that feature!  Note: I skipped right from Step 5 to Step 10, and now I can adjust the volume on my Dell Mini without going deaf.

By following the following steps, you can turn off the beep without having to reboot. The steps are:

1. Right-click on My Computer
2. On the Hardware tab, click on [Device Manager]
3. On the “View” menu, select “Show hidden devices”
4. Under “Non-Plug and Play Drivers”, right-click “Beep”
5. Click “Disable”
6. Answer [Yes] when asked if you really want to disable it 7. Answer [No] when asked if you want to reboot
8. Right-click “Beep” again.
9. Click “Properties”
10. On the “Driver” tab, set the Startup type to Disabled
11. Click [Stop] 12. Click [OK]
13. Answer [No] when asked if you want to reboot

via Annoyances.org – Stop beep in volume control Windows XP Discussion Forum.