4 ms·
Things NOT killed by Microsoft: Clear text passwords collected and stored in LSASS.EXE long term. SMBv1 Machines spraying their local user's password hashes
by px43 5y ago
Things NOT killed by Microsoft:
Clear text passwords collected and stored in LSASS.EXE long term.
SMBv1
Machines spraying their local user's password hashes all around the network constantly.
LLMNR
Symmetric (password based) authentication.
SPNs with Domain Admin privileges whose password hashes can be queried by any user at any time.
Full mappings of every user, machine, privileged level, authentication metadata, and active sessions available to any user on the network who feels like asking.
Office macros that read/write to the file system and execute shell commands.
Javascript files that can execute malicious shell commands when you try to read them.
DLL hijacking
Very weakly hashed passwords (NTLM) in the domain controller.
- BizarroLand 5y agoThings that need to be killed by Microsoft: Their online manuals that when you try to find something like how to script a very specific powershell event you instead get to read about what powershell is, what commands you could conceivably write, every word that powershell knows, who made powershell, why powershell is so important, how you can get certifications in using powershell, and other functions powershell can do but you cannot find in microsoft's online manual how to specifically write the command you need to write to achieve the specific goal you want to achieve. For that you have to go somewhere else or figure it out on your own. Their online manuals are the lexical equivalent to having to memorize the entire World Book Encyclopedia to be capable of ordering a hotdog with mustard.