Tagged: Windows
30 posts · browse all tags
-
Metasploit Deep Dive Part 6: CVE-2014-3120, a Real Module, and Three Things Windows Defender Got Right
Running script_mvel_rce against the Elasticsearch 1.1.1 target this series has had waiting since Part 1, why the module never produced a session despite genuine SYSTEM-level RCE, and what checking Wazuh afterward turned up.
-
Metasploit Deep Dive Part 7: A Different Door, the Same Wall
Part 6 hit Windows Defender three times from an Elasticsearch MVEL exploit. Part 7 tries a completely different door — an unauthenticated SYSTEM-level Jenkins Groovy console — and finds exactly the same wall waiting on the other side.
-
Old Kit, New Kit Part 10: Remote Access, evil-winrm vs psexec and Manual RDP
Running psexec, manual RDP, and evil-winrm against the same weak local admin credential on target-win2022, and checking what each one actually leaves in Wazuh.
-
Old Kit, New Kit Part 7: SMB Enumeration — NetExec vs Enum4linux and Smbclient
NetExec against enum4linux and smbclient for real SMB enumeration on a legacy Samba box and a hardened Windows Server 2022 host — the first Windows-agent Wazuh detection results in the series, and a genuine split decision between the two tools.
-
Same Job, Different Shell Part 1: Reachability and Continuous Monitoring
ping and Test-Connection do the same job, but which PowerShell version you're on changes both the syntax and, in one tested case, what the tool actually reports. Part 1 of a series pairing Windows and Linux networking commands, with a real PS 5.1 vs 7.6 discrepancy found along the way.
-
Same Job, Different Shell Part 10: Packet Capture
tcpdump against pktmon: when rule tables and connection state stop answering the question, packet capture does. A real captured TCP handshake and a real captured DNS query/response pair, on both platforms.
-
Same Job, Different Shell Part 11: The Complete Cheat Sheet
Every command pair from this series, reachability through packet capture, in one table, plus which PowerShell cmdlets actually change behavior between versions and which don't. The closing part of the Windows/Linux networking command comparison series.
-
Same Job, Different Shell Part 2: Path Tracing
traceroute and tracert answer "which hops did this take", but the protocol each one probes with matters more than people realize. A real sandbox test where the same destination gave two different route pictures depending on whether the probe was UDP or TCP.
-
Same Job, Different Shell Part 3: Interface and IP Configuration
ip addr, ifconfig, ipconfig, Get-NetIPAddress, Get-NetAdapter: five commands that all answer "what's my address", none of which return quite the same shape of answer. Part 3 of the Windows/Linux command comparison series.
-
Same Job, Different Shell Part 4: Routing Tables
ip route, route -n, route print, Get-NetRoute: reading a routing table is the same question on both platforms, why is this packet going that way, but Windows answers it with a metric that Linux's route table doesn't expose the same way at all.
-
Same Job, Different Shell Part 5: DNS Lookups and Resolution
dig, nslookup, and resolvectl against Resolve-DnsName and ipconfig /displaydns, with real query output captured live against both authoritative-adjacent and recursive resolvers, plus the caching layer most people forget to check first.
-
Same Job, Different Shell Part 6: Active Connections and Sockets
ss, netstat, and Get-NetTCPConnection all answer "what's connected to what right now", but only one platform ties a connection straight back to a process name without a second lookup. Part 6 of the Windows/Linux command comparison series.
-
Same Job, Different Shell Part 7: ARP and Neighbor Tables
ip neigh, arp -a, and Get-NetNeighbor read the same table: which MAC address answers for which IP on your local subnet. Windows names the entry states more precisely than Linux does, and Part 7 maps them directly against each other.
-
Same Job, Different Shell Part 8: Port and Service Testing
nc, curl, and bash's /dev/tcp trick against Test-NetConnection -Port: the real command-line way to answer "is the service actually listening on that port", plus real captured output showing the difference between open, closed, and filtered.
-
Same Job, Different Shell Part 9: Firewall Status, Read-Only
iptables -L, nft list ruleset, and ufw status against Get-NetFirewallRule and netsh advfirewall show: reading what a firewall currently allows without touching a single rule. Part 9 of the Windows/Linux command comparison series, and the natural next step after a port test comes back filtered.
-
The One DNS Patch That's Actually Wormable: Inside CVE-2026-62878 on Windows DNS Server
August 2026 Patch Tuesday shipped four separate Windows DNS Server RCE fixes. Only one is unauthenticated, needs no user interaction, and is a wormable stack-based buffer overflow: CVE-2026-62878, CVSS 9.8, on a service that's usually running directly on your domain controllers.
-
CVE-2026-45504 Part 1: Why On-Prem Exchange Is an Active Directory Attack Surface
On-prem Exchange has always been a heavily-trusted AD citizen, not a bolt-on app server. This series scopes a real, patched CVE against that history, and against a credential this blog already spent two other series getting a working password for.
-
CVE-2026-45504 Part 2: Inside the WOPI SSRF and Arbitrary File Read
A technical walkthrough of what CVE-2026-45504 actually does: a missing scheme check on an EWS ReferenceAttachment's provider URL, cited to Microsoft's advisory and HawkTrace's published research rather than reproduced as working exploit code.
-
CVE-2026-45504 Part 3: Why One Mailbox Credential Is Enough
svc-legacy-scan's cracked password has already powered two other series on this blog. CVE-2026-45504 shows what the same credential is worth against Exchange, with no ACL abuse and no privilege check required.
-
CVE-2026-45504 Part 4: Detection, Hardening, and Patching Priority
Patch first. After that, EWS activity logging and outbound-traffic baselining are the two layers that catch this kind of abuse, closing the loop this series opened with a six-year-old cracked password.
-
SSH Deep Dive Part 1: Keys, Clients, and Getting Connected on Windows, macOS, and Linux
Why key-based auth beats a password, generating and installing a key, and the real differences between the OpenSSH client on Windows, macOS, and Linux. Part 1 of 3, followed by the config file/agent/multiplexing and -L/-R/-D/-J.
-
SSH Deep Dive Part 2: The Config File, Agent Forwarding, and Multiplexing
Turning `ssh -i ~/.ssh/id_ed25519 [email protected]` into `ssh myhost`: the ~/.ssh/config file, per-host settings, ssh-agent so a passphrase isn't typed on every connection, and connection multiplexing to skip the handshake entirely.
-
SSH Deep Dive Part 3: Tunnels and Jump Hosts, -L, -R, -D, and -J
Everyday sysadmin uses for SSH's forwarding flags: reaching an internal service through a bastion with -L, exposing something outbound with -R, a SOCKS proxy with -D, and chaining through jump hosts with -J and ProxyJump.
-
Sn1per Deep Dive Part 8: The Windows Target and What Nuke Mode Never Touched
Building a genuine Windows target for the Sn1per lab and running the tool against it for real, including the one finding it never even scanned for.
-
Sn1per Deep Dive Part 9: What a Pen Tester Without Sn1per Would Have Found
The same Windows target, worked by hand with nmap, curl, and two modern credential tools, set against what Sn1per's own automated run actually delivered. Closing post for the Sn1per Deep Dive series.
-
Living Off the Land: certutil, mshta, rundll32, and Bitsadmin as Attacker Primitives
The LOLBAS project's own documented syntax for certutil, mshta, rundll32, and bitsadmin — signed Microsoft binaries repurposed as download-and-execute primitives against WKS01 in the CONTOSO.LOCAL lab, plus the Sysmon event IDs that actually flag it.
-
Impacket Deep Dive Part 1: Why Real Red Teams Skip the Metasploit Tutorials
Every beginner tutorial teaches Nmap, Hydra, and a Metasploit one-liner. Nobody assessing a real Windows domain works that way — they live in Impacket. Part 1: what it actually is, the lab this series runs against, and a verified tour of the toolkit.
-
Impacket Deep Dive Part 10: Defense in Depth and Detection
Nine posts of offense, consolidated into one defensive reference: every hardening control and detection signature from this series, an event ID cheat sheet, and where network-layer segmentation fits when the domain itself is already compromised.
-
Impacket Deep Dive Part 6: The Ghost Shells — wmiexec, smbexec, and atexec
Four Impacket scripts get you a remote shell on a Windows host, and they all abuse a different legitimate management protocol to do it. Part 6: wmiexec, smbexec, atexec, and dcomexec compared against classic PsExec, and why one of them is dramatically quieter than the rest.
-
Impacket Deep Dive Part 7: secretsdump.py, SAM, LSA, and DCSync
One shell on one member server is a foothold. secretsdump.py is what turns it into the entire domain's password material — local SAM hashes, cached domain logons, LSA secrets, and, if the account is right, every credential in Active Directory via DCSync.