The place to learn the most about Windows Defender Application Control (WDAC) the fastest is youtube. Matt Graeber put together an amazing set of tutorials, and if you’re trying to...
WDAC Notes
Wireguard on Ubuntu
Very quick post to remind me how to set up the Wireguard client for Ubuntu quickly: (Most of this is taken from the Algo project documentation) First, visit the downloads...
Windows 20H2 changes
Comparison of Windows 10 2004 and Windows 10 20H2 installations that might assist others who need to check off some of these things in their pre-deployment security review. The details...
edgegdi.dll for persistence
Overview There’s a .dll which just about every process on my Windows machine is interested in called edgegdi.dll. Unfortunately, the dll: edgegdi.dll isn’t there (or anywhere on the system). You’ll...
Quick and Simple WiFi Testing with besside-ng
I’ve been using Bettercap for a while now, and i love it but i saw a post on the weekend that reminded me the value in going back to look...
DLL Hijack for Cisco Anyconnect
Note 1: the best place to learn a lot about dll hijacking is https://institute.sektor7.net; the main purpose of this post is to capture my notes while applying some of the...
Exploit Guard Mistakes
This post details the mistakes I’ve made using and tuning Exploit Guard. They’re not meant to be interpreted as criticisms of the product; just thing’s I wish I’d realized earlier...
Exploit Guard vs Process (DLL) Injection
In the previous post we evaluated Exploit Guard controls against a simple buffer overflow vulnerability in a test application. We used Matt Graeber’s Exploit Guard documentation as a guide. As...
Vulnserver Exploit vs Windows Defender Exploit Guard
I’ve taken notes for exploiting Stephen Bradshaws ‘vulnserver’ in a previous post. I saved those here. This post evaluates the protection Windows Defender Exploit Guard can offer a vulnerable application....
Deploying Azure Functions
We’re going to try to move the main random password code from the previous blog post to Azure ‘Functions’ - the Azure serverless offering. Fundamentals: We define a trigger for...
Older Posts
Deploying Azure Web Services Manually
20 Jun 2020
Looking into how we’d deploy, scale and secure a web service on Azure. Starting right at the very basics - a hand jammed basic web service deployed from inside VS...
Signing .jar files with an existing certificate on Windows
11 Jun 2020
Install JDK Jump into the JDK binary folder cd C:\Program Files\Java\jdk-14.0.1\bin Create a Java Signing Keystore with your existing .p12: keytool -importkeystore -srckeystore c:\jarfiles\duff.p12 -srcstoretype pkcs12 -destkeystore c:\jarfiles\duff.jks -deststoretype JKS...
VMWare Workstation Automation (on Windows)
31 May 2020
First up, enable the GUI so that you can get familiar with the (REST) API. PS C:\Program Files (x86)\VMware\VMware Workstation> .\vmrest.exe -C VMware Workstation REST API Copyright (C) 2018-2019 VMware...
Cross Compile Windows binaries on Linux
29 Apr 2020
Very quick note for something that usually takes me too long to find :) sudo apt-get install mingw-w64 # C i686-w64-mingw32-gcc hello.c -o hello32.exe # 32-bit x86_64-w64-mingw32-gcc hello.c -o hello64.exe...
Infrastructure Notes - Azure site-to-site VPN
26 Apr 2020
Extending the on site lab network to an Azure VNET. VMWare Lab Network: 10.0.0.0/24 New Azure VNET: IP Range: 192.168.2.0/24 New Server Subnet: IP Range: 192.168.2.0/26 After creating the new...
Infrastructure Notes - Linux Host Security
28 Mar 2020
Using Andrew Malett’s ‘Linux Host Security’ course on Pluralsight procfs Virtual file system that is mounted through to proc. Mostly read only, but some can be tuned, written to. We...
Infrastructure Notes - Azure Key Vault
22 Mar 2020
Using Gary Grudzinskas ‘Securing Virtual Machines with Azure Key Vault’ training course on Pluralsight Azure Key Vault helps solve the following problems: Secrets Management - Azure Key Vault can be...
HTB - Forest (Hacking Active Directory walk-through)
21 Mar 2020
A HTB lab based entirely on Active Directory attacks. Starting out with a usual scan: nmap 10.10.10.161 -sV -sC -oA forestscan Among other things, we will find that there are...
Active Directory - Physical Disk Access to Domain Administrator in just a few minutes.
08 Mar 2020
If you get access to the unencrypted disk of a domain controller you can take NTDS.dit away and do horrible things with it offline. The most common approach seems to...
WinDBG for User-Mode Debugging
05 Mar 2020
WinDBG is the right way to go to analyze windows crash dumps if you have builds that are throwing a blue screen. For a really large percentage of those cases...
Active Directory - Recover deleted objects quickly
04 Mar 2020
You’re going to panic when something important is accidentally deleted. It’s scary. In the old days it was a little painful as well. Deleted objects had their links stripped (memberships)...
Active Directory - How Smart Card Logon Works
23 Feb 2020
The Smart card logon process goes like this: Smart card is shoved into a card reader. Smart card signals an event that prompts the user for their personal identification number...
Active Directory - Modify a system owned attribute
23 Feb 2020
First of all, you shouldn’t do this. But in case you are hell bent on making a mess the following steps will allow you to modify objects that Active Directory...
Windows Security - No disk encryption equals root level access in five minutes or less...
22 Feb 2020
After showing this to friend today i thought i should also write it down for quick reference. There’s nothing new here, this trick has been around forever - but it’s...
Infrastructure Notes - Azure Virtual Machine Scaling
12 Feb 2020
Infrastructure Notes - Azure Virtual Machine Scaling Availability Sets If we place two or more instances into the same ‘availability set’ Microsoft provide a 99.95 availability SLA. (The single instance...
Infrastructure Notes - Azure Storage Overview
09 Feb 2020
Infrastructure Notes: Azure Storage Overview Basics Microsoft’s cloud storage solution. ‘Massively’ scalable object store: data objects file system service for the cloud messaging store for reliable messaging NoSQL store All...
Infrastructure Notes - Azure Network Design Overview
02 Feb 2020
Infrastructure Notes: Azure Network Design Overview Start here: Azure Networking VNet Primary networking technology, like the VPC in AWS. Internet access is on by default. Cloud services can go in...
Infrastructure Notes - AWS Route 53
19 Jan 2020
Infrastructure Notes: AWS Route 53 I’ve been working through Ben Piper’s excellent course on Pluralsight: AWS Networking Deep Dive: Route 53 DNS. This post captures the notes i took along...
Try not to get too fancy with Active Directory Backup
14 Jan 2020
Active Directory does a few important things whenever it is backed up or restored to keep it working the way it was intended. For that reason (in most situations) it...
Cleaning House - SANS Pen test
07 Jan 2020
We’re moving house, so the old SANS Pentesing posters and notes are headed for the recycle bin :( I wouldn’t bother reading this post if i was you. Visit SANS.org...
When NTLM is used for Windows Login (Kerberos unavailable)
13 Dec 2019
I’m working on a larger post about the various types of login (network, local, rdp etc) and what each of them presents to an attacker; but i wanted to first...
IPSec for Windows Firewall Exceptions
21 Sep 2019
Generally speaking, a DENY rule in Windows firewall will override any ALLOW. s an example, if i want to do the right thing and DENY most PowerShell Remote (5985) in...
Getting Crafty with LAPS permissions
21 Jul 2019
Some notes about a recent requirement to modify the access to LAPS attributes in one of our directories. We had a specific class of computer objects that we did not...
Change Windows File or Folder ACL from shell
17 Jun 2019
You find a file called file.txt that wont allow you to do what you want despite having what you believe to be enough permissions:
cacls file.txt /E /G "Everyone":F
Crank up nmap on unknown port
09 Jun 2019
For example, an unknown port 9000 on host 10.0.0.1
nmap -vvv -A --reason --script="+(safe or deafult) and not broadcast" -p 9000 10.0.0.1
Old posts from my Microsoft gigs
09 Jun 2015
Old posts from Microsoft A collection of the things i wrote while i was at Microsoft Windows Kernel Team: Connected Standby & You Cheat Sheet: Break into a running Windows...