Cybersecurity Q&A
Browse concise answers derived from our published, source-linked cybersecurity coverage.
How does LSB steganography hide data in PNG images without being noticeable to the human eye?
LSB steganography modifies the least significant bit of each RGB color component in a PNG pixel. Since each color component ranges from 0 to 255 and the human eye can only distinguish about 10 million colors, changing the least significant bit (which alters the color by at most 1) is imperceptible. Each pixel can carry 3 bits of data (one per color channel). This technique is commonly used in tools like [cloacked-pixel](https://github.com/cyberinc/cloacked-pixel).
How do I crack the extracted NTLMv2 hash to recover the plaintext password?
Use Hashcat with a dictionary or brute-force attack on the assembled hash string (`username::domain:challenge:HMAC-MD5:blob`). For example, `hashcat -m 5600 hash.txt wordlist.txt` will attempt to crack NTLMv2 hashes. For a detailed walkthrough, refer to the article [Introduction to Windows Password Hashes - NTLM Hash and Net-NTLM Hash](/news/introduction-to-windows-password-hashes-ntlm-hash-and-net-ntlm-hash) or the related technique for brute-forcing PPTP passwords in [Penetration Techniques - Acquisition and Brute-Force of PPTP Passwords](/news/penetration-techniques-acquisition-and-brute-force-of-pptp-passwords).
Why is a file server a prime target for capturing NTLMv2 hashes from other users?
When users in the internal network access a file server, their Windows machine automatically sends the current user's NTLM password hash for authentication. By capturing packets on the server, an attacker can collect these Net-NTLM hashes from multiple users without needing any client-side compromise. This technique is related to other hash-capture methods, such as using icon files described in [Penetration Techniques - Using Icon Files to Obtain NTLMv2 Hash from File Server Connections](/news/penetration-techniques-using-icon-files-to-obtain-ntlmv2-hash-from-file-server-connections).
How can I automatically extract NTLMv2 hashes from captured packets using Python?
Write a Python script using the `scapy` library to parse the pcap file. Filter packets with destination port 445 (SMB) and containing the string 'NTLMSSP'. From the NTLMv2 Response packet, extract the username, domain, HMAC-MD5, and blob at fixed offsets; the server challenge is obtained from the preceding packet. Assemble the hash in the format `username::domain:challenge:HMAC-MD5:blob` for cracking. The full implementation code is provided in [Penetration Techniques - Using netsh to Capture NTLMv2 Hash from File Server Connections](/news/penetration-techniques-using-netsh-to-capture-ntlmv2-hash-from-file-server-connections).
How do I convert the .etl file from netsh trace into a format that Wireshark can read?
The .etl file cannot be opened directly by Wireshark. Use Microsoft's free Windows Message Analyzer to open the .etl file, then export it as a .cap file via File > Save as > Export. Once you have the .cap file, you can open it with Wireshark to inspect the SMB2 packets containing NTLMv2 authentication data. You may also need to convert .cap to .pcap for programmatic analysis, as shown in the full article.
How can I capture network packets on a Windows file server without installing any third-party tools?
You can use the built-in `netsh trace` command with administrator privileges to capture network packets. For example, `netsh trace start capture=yes traceFile="c:\test\capture.etl" protocol=tcp ipv4.address=<server_ip> keywords=ut:authentication` will capture SMB authentication traffic. This method is supported on Windows 7, Server 2008 R2, and later systems, as detailed in [Penetration Techniques - Using netsh to Capture NTLMv2 Hash from File Server Connections](/news/penetration-techniques-using-netsh-to-capture-ntlmv2-hash-from-file-server-connections).
How can the Waitfor.exe backdoor be made reusable and persistent?
To make the backdoor reusable, the command executed after receiving the signal must include a call to restart the waitfor waiting mode. For example, a PowerShell script can run the payload and then immediately execute `cmd /c waitfor persist & powershell -executionpolicy bypass -file script.ps1`, creating a continuous loop. Another approach uses a WMI class to store both the payload and the re‑arm logic, as shown in the [Use Waitfor.exe to maintain persistence](/news/use-waitfor-exe-to-maintain-persistence) article, ensuring the backdoor remains active after each activation.
What is the WMI-based persistence technique used in the Waitfor.exe POC?
The WMI-based technique stores the backdoor payload inside a custom WMI class (Win32_Backdoor) on the target system. After storing the payload as a property, the waitfor command reads and executes it via PowerShell using base64‑encoded commands. This avoids leaving files on disk, and the loop can be designed to automatically re‑arm the waitfor listener after each trigger. The full implementation is detailed in [Use Waitfor.exe to maintain persistence](/news/use-waitfor-exe-to-maintain-persistence).
How does the Waitfor.exe backdoor work and what is its limitation?
The Waitfor.exe backdoor works by first entering a waiting mode using a command like `waitfor signalname & command`, then a remote attacker sends the signal via `waitfor /s target /si signalname` to trigger the command. However, after the command executes, the waitfor.exe process exits, making the backdoor non-reusable. To maintain persistence, an attacker must either manually restart the waiting mode or use a script that automatically re-enables it after each trigger, as demonstrated in the [Use Waitfor.exe to maintain persistence](/news/use-waitfor-exe-to-maintain-persistence) article.
What is Waitfor.exe and how can it be used for persistence in penetration testing?
Waitfor.exe is a Windows command-line tool used to synchronize computers on a network by sending or waiting for signals. In penetration testing, it can be exploited as a backdoor: an attacker configures it to wait for a specific signal and then execute a command, such as launching a PowerShell script that downloads and runs payloads. For more details, refer to [Use Waitfor.exe to maintain persistence](/news/use-waitfor-exe-to-maintain-persistence). This technique enables a remote activation mechanism, though the backdoor is non-reusable after one trigger unless a persistent loop is implemented.
How can I replace a service executable without stopping the service, and what privileges are needed?
Even without stopping the service, you can rename the existing executable (e.g., `rename test.exe test2.exe`) and then rename your malicious file to the original name. This bypasses the 'access denied' error when trying to delete a running file. Note that starting or stopping the service typically requires administrator privileges, but the rename trick works while the service is running.
Why can't I see the GUI of a service-started executable, and how can I fix it with psexec?
Services run in session 0, which is isolated from the interactive user session (session 1). Therefore, GUI windows (like `calc.exe`) are not visible. You can use `psexec -i 1` to launch the process in the user's session, making the interface visible. This tip is covered in the article alongside the C# service template.
How do I write a C# program that the Windows Service Control Manager (SCM) can run?
You need to create a class that inherits from `ServiceBase` and override the `OnStart` method (e.g., to launch `calc.exe`). Then use `ServiceBase.Run()` in Main to register it with SCM. Compile the `.cs` file with `csc.exe` (C# compiler) to produce an executable. A template from Didier Stevens is included in the article.
How can I find writable Windows services using PowerShell?
You can use PowerShell with WMI to list all services and their executable paths: `Get-WmiObject win32_service | select Name,PathName`. Then extract each path, check folder permissions with `Get-Acl`, and filter out owners like `NT AUTHORITY\SYSTEM`, `NT SERVICE\TrustedInstaller`, or `BUILTIN\Administrators`. A full automated script is provided in the article [Use powershell to find a writable windows service](/news/use-powershell-to-find-a-writable-windows-service).
How does the C++ tool QueryADObject.exe improve upon Microsoft’s sample code for AD enumeration?
The C++ tool merges features from Microsoft’s sample and Recon-AD, providing an exe format with multiple functions for querying users, computers, and groups. It supports search conditions and offers a `ShortData` output mode for concise name listing, unlike Microsoft’s limited `QueryUser` method. This makes enumeration more efficient and is especially useful during penetration tests where speed matters, similar to the approaches in [obtaining installed programs](/news/penetration-basics-obtaining-the-list-of-installed-programs-on-the-current-system).
What is the significance of the LDAP filter `(&(objectCategory=computer)(objectClass=computer))` when querying Active Directory?
This filter retrieves all computer objects in the domain. It is used in ldapsearch, PowerView’s `Get-NetComputer`, or the custom C++ tool to list every domain-joined machine. The combination of `objectCategory` and `objectClass` ensures only computer accounts are returned, not users, groups, or other object types.
What tools can be used to gather Active Directory information from within a compromised domain host?
From inside the domain, you can use PowerShell with PowerView scripts, C# with SharpView, or C++ programs that call ADSI interfaces. The article provides a custom C++ tool (`QueryADObject.exe`) that supports querying users, computers, and groups with flexible search conditions and output modes, similar to the approaches used in [obtaining domain user login information](/news/penetration-basics-obtaining-domain-user-login-information).
How can you list all domain users from outside the domain using ldapsearch on Kali Linux?
Use the ldapsearch command with simple authentication, providing the domain user's DN and password, then add a search filter like `(&(objectClass=user)(objectCategory=person))` and pipe the output to `grep cn` to display only common names. This efficiently enumerates all domain users as shown in the article’s examples.
What are the prerequisites for querying Active Directory information from outside the domain using LDAP?
To query AD from outside the domain, you need network access to the Domain Controller’s port 389 (LDAP) and valid credentials for at least one regular domain user. As described in [this article](/news/penetration-basics-obtaining-active-directory-information), tools like ldapsearch on Kali can then be used with the DN and password to bind and query objects like users, computers, and groups. For environments where AV might interfere, see [Bypass AV techniques](/news/penetration-basics-active-directory-information-gathering-2-bypass-av).
What is CVE-2022-36537 about, and why is the encryption weak in Server Backup Manager?
CVE-2022-36537 is a hardcoded symmetric key vulnerability in Server Backup Manager's `SecureZipUtils.class`. The encryption uses a weak, hardcoded 16‑byte key (`DE7E147A6F487351`) and AES algorithm with only one encryption round per file, plus the KeyStore uses a known default password `r1soft`. This flaw allows an authenticated user to decrypt sensitive configuration files, such as the user database, which contains SHA‑1‑hashed passwords that can be easily cracked. The vulnerability details are discussed in the [Server Backup Manager Vulnerability Debugging Environment Setup](/news/server-backup-manager-vulnerability-debugging-environment-setup) article.