Jaacostan

I recently encountered an interesting issue involving a two-node Windows Failover Cluster consisting of SVR1 and SVR2. The environment occasionally experienced service startup failures following a failover operation, resulting in unexpected downtime. During troubleshooting, I discovered recurring machine account password update errors on the cluster nodes. This led me down a path of understanding how machine account passwords work in Active Directory, why they are important, and how failures in this area can affect clustered workloads. One important lesson from this investigation is that machine account passwords are often overlooked because they are managed automatically by Windows. However, they play a critical role in maintaining trust between domain-joined systems and Active Directory. When that trust begins to break down, the symptoms may not appear immediately. Instead, problems often surface during authentication-intensive operations such as cluster failovers, service startups, ...

Imagine you’re planning a huge day at Universal Studios Singapore (USS). To make the park run smoothly and keep everyone safe, they use a super-smart "Secret Ticket" system so you don't have to carry your passport around to every single ride. The Master Guest List (Active Directory) Before you even leave your house, your parents go online and register you for the park. They create a profile with your name and a Secret Password. The park’s main computer (the Master Ledger) saves your name and a "scrambled" version of your password. Because USS has many different gates and offices, they "sync" this list to every single computer in the park. This ensures that no matter which entrance you walk toward, the staff there already knows your name and has a copy of your secret handshake. The Front Gate (The Authentication Service) When you arrive at the USS entrance, you don't actually tell the staff your password—because if a "bad guy" is standing ...

When you run gpupdate on a server, it looks like a simple command. But in the background, the server is actually following a strict seven-step process to get its new settings from the Domain Controller (DC). Here is exactly what happens. 1. Starting the Service When you type the command, it wakes up a specific background task called the Group Policy Client. If you just run gpupdate, the server only asks for settings that have changed. If you run gpupdate /force, the server ignores its history and re-downloads every single setting. 2. Finding a Domain Controller The server needs to find a "source" for its settings. It checks your network’s DNS to find a Domain Controller. Once it finds one, it proves who it is (authenticates) using its computer account. 3. Figuring Out Which Policies Apply The server asks the Domain Controller for a list of all Group Policy Objects (GPOs). It checks several things to see which ones it should actually use: Location: Is the GPO linked to the se...

When you do malware analysis of documents or office files, it is important to have Microsoft Office installed in your Lab machine. I am using flare VM and it doesn't comes with MS Office. Since Microsoft is promoting Microsoft 365 over the offline version, finding the offline installer is not that easy. Here is the list of genuine Microsoft links to download the office .img files.  Download Microsoft Office 2019 Professional Plus : https://officecdn.microsoft.com/db/492350F6-3A01-4F97-B9C0-C7C6DDF67D60/media/en-US/ProPlus2019Retail.img Download Microsoft Office 2019 Professional : https://officecdn.microsoft.com/db/492350F6-3A01-4F97-B9C0-C7C6DDF67D60/media/en-US/Professional2019Retail.img Download Microsoft Office 2019 Home and Business : https://officecdn.microsoft.com/db/492350F6-3A01-4F97-B9C0-C7C6DDF67D60/media/en-US/HomeBusiness2019Retail.img Download Microsoft Office 2019 Home and Student : https://officecdn.microsoft.com/db/492350F6-3A01-4F97-B9C0-C7C6DDF67D60/media/en-U...

Windows comes preinstalled with a lot of bloatware, telemetry and unnecessary services enabled. This results in higher resource utilization and less privacy. This post introduces some free open tools that helps to enhance privacy on windows by disabling unnecessary services and bloatware. 1) Privatezilla Privatezilla integrates the most critical Windows 10 privacy settings and allows you to quickly perform a privacy check against these settings. Active settings are marked with the status "Configured" and indicates that your privacy is protected. The inactive ones are declared as "Not configured". All available settings (currently 60) can be enabled as well as disabled. Link : https://github.com/builtbybel/privatezilla 2) Windows10Privacy Windows 10 Privacy Utility streamlines many of Windows 10's built in privacy settings into something that is easy for people to access on a single page while also providing an easy way to access hidden functions and additional t...

Recently i encountered a very annoying problem. One of my Windows VM running on Virtualbox. This windows host keep shutting down on regular intervals. Initially i couldn't able to identify whether it is random or happening on fixed time intervals. I went through the settings, change active hours, change advanced startup options and went through the scheduled tasks suspecting something is triggering the reboot. Well, that didn't fix the issue. Then i went through the event viewer, and under Windows Application logs, i can see some informational events with event ID 100 . It mentions that, the license period for this installation of Windows has expired. The Operating system will shutdown every-hour. So that's it. My Windows trial period was over and without having a valid license, the OS disables many windows features, won't receive any updates, and this regular shutdown thing.

While creating a malware, in-order to run they payload in the memory of the process, we need to create a memory buffer for the payload. For this purpose, we need to make use of the VirtualAlloc function. As per the windows documentation, a VirtualAlloc function reserves, commits or changes the state of a region of pages in the virtual address space of the calling process. Lets dig deep on this function and its parameters, The syntax for the function usage is, LPVOID VirtualAlloc(   [in, optional] LPVOID lpAddress,   [in]           SIZE_T dwSize,   [in]           DWORD  flAllocationType,   [in]           DWORD  flProtect ); lpAddres s : This field is optional. It is the starting address of the region to allocate. dwSize : The size of the region in bytes. This si usually the size of the payload we have, not les...

Often times, we might need to save some of the images in a word document or from a power point presentation. Most of us copy and save the images one by one. There is an easier way to extract all the images from the office file at once. Watch the video or follow the steps mentioned below. 1) Rename the file extension to .zip 2) Open or extract the Zip file. 3) Access the word/ppt directory 4) Open media folder and there you can see all the images embedded in the document.

Metadata is the data about the data. Every files has some metadata and it describe what the file is (minus the content). For example,  an image file, its metadata might contain information such as when the image is created, by whom, when is it modified, who can access etc, but it wont be able to tell what is in that image.  There are different types of metadata. Lets go through the main types. 1) System Metadata This metadata is created and used by the Operating system. Though OS uses it for various purposes, it is essentially used to track and maintain the files stored in the file system. It contains information such as creation dates, modified date, access information etc, and we can see these info from the general properties of the file (Right click > properties > details). To view all the metadata information, use wmic. wmic datafile where name="c:\\example.txt" get /value No matter a file is deleted from the system, the metadata will remain and can be used for ...

While performing a digital forensics investigation, you might need to collect various artifacts, information and images from the target machine. Most of the times, we make use of the automated tools to retrieve the information that we require. Read DFIR KAPE : Evidence Collection Tool However, it is important to know to collect the data manually as well. This process of collecting the required information and image , also known as Evidence acquisition is one of the most important tasks to be performed correctly in order to start your investigation. The data that needs to be collected includes both volatile and non-volatile data. The minimal information that needs to collected ,includes, Date and Time Currently running tasks Current network connections ARP Cache Network Configurations and Shares DNS and Routing Table System Variables User/s Information System Information We can collect these manually and the following commands comes handy.  Lets collect all these information in a si...

I am not an exploit developer but was interested to see how this vulnerability can be exploited. So i tried to replicate the infamous PrintNightmare vulnerability using the following PoCs ( https://github.com/cube0x0/CVE-2021-1675 ) and ( https://github.com/rapid7/metasploit-framework/pull/15385 ) However i had trouble with the new metasploit module (auxiliary/admin/dcerpc/cve_2021_1675_printnightmare) and i couldn't able to exploit the machine successfully. So i tried the second PoC from cube0x0. This one has done the magic. I just followed the guidelines with couple of tweaks. First of all, i installed the impacket (cube0x0 version) which will install the required modules and files. After that i set up a samba share with an anonymous login. This is required for hosting the dll file. I edited the smb.conf with the following settings. [global]     map to guest = Bad User     server role = standalone server     usershare allow guests = yes ...

The Internet Explorer 11 desktop application will be retired and go out of support on June 15, 2022. Organizations with websites optimized for Internet Explorer may consider configuring IE mode in Microsoft Edge.  If you are configuring IE mode for an enterprise, you may refer the step by step guide from Microsoft. To configure IE mode on your windows machine, follow the below steps. 1) Open Microsoft Edge browser 2) Go to Settings 3) Click on Default Browser option 4) On the right pane, you can see " Allow sites to be reloaded in Internet Explorer mode ". Toggle the button to ON  5) Restart Edge. 6) Now access any website. 7) To view the website in Internet Explorer Mode, click on Settings > More Tools > Reload in Internet Explorer Mode 8) Now the Website will be reloaded in IE mode. You can also see the settings from IE icon next to the address bar. 9) To exit IE mode, click on Settings > More Tools > Exit Internet Explorer Mode  

The fingerprint reader on my laptop was not working properly since last couple of month. Suspecting after some update from Microsoft. It was not completely working, sometimes it work perfectly and often sometimes not. Especially after my laptop goes sleep. So i uninstalled and reinstalled the driver with the latest update, did some googling and couldn't get a solution. However, i though of checking the power management settings. And unchecked the "Allow the computer to turn off this device to save power" under the device's power management (From Device Manager). The issue is fixed and the fingerprint reader is working fine. Thought of sharing this as some of my friends had the same issue. Also i can see a lot of queries in the internet regarding this fingerprint reader malfunction. Always keep your OS and the drivers up to date and don't download any third party tools to fix issues with your machine.

Adobe stopped supporting Flash Player beginning December 31, 2020. After this data, Adobe will not release new Flash Player updates or security patches and strongly recommends the users to uninstall Flash Player immediately from their machines. To help secure your system, major browser vendors have already disabled Flash Player from running. As part of the end of support for Adobe Flash, KB4577586 is now available as an optional update from Windows Update (WU) and Windows Server Update Services (WSUS). Installing KB4577586 will remove Adobe Flash Player permanently from your Windows device. Once installed, you cannot uninstall KB4577586 . This update only removes Adobe Flash Player that was installed by your version of Windows. If you installed Adobe Flash Player manually from another source, it will not be removed.  Ref : https://support.microsoft.com/en-us/topic/kb4577586-update-for-the-removal-of-adobe-flash-player-october-27-2020-931521b9-075a-ce54-b9af-ff3d5da047d5

CVE-2020-1472 | Netlogon Elevation of Privilege Vulnerability | Severity : Critical As per Microsoft, An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol. An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. We use Impacket primarily to exploit this vulnerability. And for that set up a virtual environment. Though it is not mandatory to have a virtual environment to run Impacket, however for stability purpose we are using the virtual env. python3 -m pip install virtualenv python3 -m virtualenv impacketEnv source impacketEnv/bin/activate pip install git+https://github.com/SecureAuthCorp/impacket Once the environment is setup...

Lets talk about PrintSpoofer tool. This tiny tool is used for Windows Privilege Escalation. If the target server having the SeImpersonatePrivilege enabled and by using this tool, you can perform the Privilege escalation. 1) Look for the ways to elevate the privileges in the target machine. Run whoami /priv  Check for the weakness in Windows Server where certain service accounts are required to run with elevated privileges utilizing the SeImpersonatePrivilege . Mostly people use Hot Potato to take advantage of this privilege function. But Hot Potato is successful only if the DCOM enabled in the target server. [ Read more on this]. Here comes the usage of PrintSpoofer tool. You can abuse and exploit this with PrintSpoofer tool, even if the DCOM is disabled in the target server. 1) Get the code from Github. https://github.com/itm4n/PrintSpoofer Clone the directory. Note that, if you are trying to compile the code in a Linux machine, you may encounter compile error as it requires wi...

Virtualization Based Security is a major Microsoft windows feature released with Windows Server 2016 and Windows 10 Operating System.Credential Guard Feature is available with Windows Server 2016 and Windows 10 Operating Systems to prevent the memory read attempt or in other words protect the Domain Credentials (Kerberos and NTLM) thus Preventing Pass the Hash Attacks (Credential Theft Attack) Credential Guard leverages Virtual Secure Mode (VSM) feature of Virtualization Based Security (VBS) to create Isolate User Modes to process the Codes preventing it from being stolen.The device guard feature also rely on the Virtualization based Security (VBS) Pass the Hash is a fundamental function of Windows for remote administration which will be taken care by the LSASS process (User Mode Process responsible for Authentication and Isolation of users).LSASS is a User Mode Process manages the hash that needs to be passed for remote administration. Upon Enabling Credential Guard, the Local ...

NLB is a software-based load balancer (Windows Feature) that resides on each member in the cluster. Load Balancing is based on number of client connection requests and the NLB algorithm does not dynamically respond to changes in the load on each cluster host (such as the CPU load or memory usage or Network Usage). Thus, If client population is less and/or the connections produce varying loads on the server, the load balancing algorithm of Microsoft NLB is less effective. Udacity has special offers worldwide to help anyone learn important, higher-paying job skills during this challenging time. Click here to get your offer and start learning now! To understand how NLB preserve the session state, first let me take you through the difference between a stateful and stateless connections: Stateless The application connection is said to be stateless if the server does not store any state about the client session instead the session data is saved at th client side. The server does n...

Many times, we may require to open a file using a particular program directly from the right-click context menu. For a quick example if we want to add Notepad in the context menu,  Process to add Open in Notepad to the context menu is detailed below : Navigate to HKEY_CLASSES_ROOT\*\shell . Create a new key under the Shell key. Right-click Shell and select New > Key. Set the key name to Open In Notepad . This name is your desired text to be shown in the context menu. Create a new key under the Open In Notepad key . Right-click Open In Notepad and select New > Key. Set the key name to command . This setting of key is optional though. Select the (Default) value in the command key and select Modify . Enter notepad.exe %1 in the Value data field and click OK. Another example, if you want to see the command prompt in the context menu, instead of notepad.exe , you can set cmd.exe .   Now right click on any file and you should see and option.  ...