5 ms·
Are there publicly known exploits which allow RCE or data extraction on a default windows installation?
by echoangle 2y ago
Are there publicly known exploits which allow RCE or data extraction on a default windows installation?
- mr_mitm 2y agoNot on a fully patched system. 0-days are relatively rare and fixed pretty quickly by Microsoft.
- zokier 2y agoRemember WannaCry? The vuln it used was patched by MS two months prior the attack. Yet it took the world by storm.
- mr_mitm 2y agoNot sure what you want from me, I simply answered the question. Yes I remember WannaCry.
- deleted 2y ago[deleted]
- superidiot1932 2y agoHow is it caviar then?
- mr_mitm 2y agoNot the same poster, but one phase of a typical attack inside a corporate network is lateral movement. You find creds on one system and want to use them to log on to a second system. Often, these creds have administrative privileges on the second system. No vulnerabilities are necessary to perform lateral movement. Just as an example: you use a mechanism similar to psexec to execute commands on the remote system using the SMB service. If the remote system has a capable EDR, it will shut that down and report the system from which the connection came from to the SOC, perhaps automatically isolate it. If it doesn't, an attacker moves laterally through your entire network with ease in no time until they have domain admin privs.
- lucasRW 2y agoA key part of breach a network is having a beacon running on their networks, and communicating out, one way or another. Running beacons with good EDRs is difficult, and has become the most challenging aspect of most red team engagements because of that. No EDR, everything becomes suddenly super easy.
- _23sd 2y agoYou don't need exploits to remotely access and run commands on other systems, steal admin passwords, and destroy data. All the tools to do that are built into Windows. A large part of why security teams like EDR is that it gives them the data to detect abuse of built-in tools and automatically intervene.
- jabroni_salad 2y ago* SMB encryption or signing not enforced * NTLM/NTLMv1 enabled * mDNS/llmnr/nbt-ns enabled * dhcpv6 not controlled * Privileged account doing plain LDAP (not LDAPS) binds or unencrypted FTP connections * WPAD not controlled * lights out interfaces not segregated from business network. Bonus points if its a supermicro which discloses the password hash to unauthenticated users as a design features. * operational technology not segregated from information technology * Not a windows bug, but popular on windows: 3rd party services with unquoted exe and uninstall strings, or service executable in a user-writable directory. I remediate pentests as well as realworld intrusion events and we ALWAYS find one of these as the culprit. An oopsie happening on the public website leading to an intrusion is actually an extreme rarity. It's pretty much always email > standard user > administrator. I understand not liking EDR or AV but the alternative seems to be just not detecting when this happens. The difference between EDR clients and non-EDR clients is that the non-EDR clients got compromised 2 years ago and only found it today.
- cypress66 2y ago> It's pretty much always email > standard user > administrator What does this mean?
- jabroni_salad 2y agobelieve it or not, most users dont run around downloading random screensavers or whatever. Instead they are receiving phish emails, often from trusted contacts who have recently been compromised using the same style of message that they are used to receiving, that give the attacker a foothold on the computer. From there, you can use a commonly available insecure legacy protocol or other privilege escalation technique to gain administrative rights on the device.
- JackGreyhat 2y agoIt's the attack path.
- emmelaich 2y agostandard user: why can't I open this pdf? It says Permission Denied dumb admin: let me try .... boom game over man