Cybersecurity Q&A
Browse concise answers derived from our published, source-linked cybersecurity coverage.
What are the two types of Windows tokens and how do they differ?
Windows has two types of tokens: delegation tokens for interactive sessions (like local or RDP login) and impersonation tokens for non-interactive logins (like net use). After a user logs off, their delegation token becomes an impersonation token, which remains valid until reboot. Understanding token types is key to [token theft and exploitation](/news/penetration-techniques-token-theft-and-exploitation).
What is the FuzzBunch framework and how does it relate to Smbtouch?
FuzzBunch is a framework similar to Metasploit that includes plugins for detection (Touch), exploitation (Exploit), payload delivery, and more. Smbtouch is a Touch-class plugin used to detect whether a host is vulnerable to SMB and NBT remote privilege escalation attacks. The framework requires Python 2.6 and pywin32, and the leaked version may need a `listeningposts` folder to function. Detailed setup is covered in the [original article](/news/intranet-security-using-nsa-smbtouch-for-batch-detection-of-intranet).
What are the key defense recommendations against NSA SMB and NBT exploits?
Defense against exploits like ETERNALBLUE includes upgrading system patches, enabling the firewall, and blocking port 445 using `netsh advfirewall firewall add rule name="445" protocol=TCP dir=in localport=445 action=block`. Additionally, proactively scan your intranet with SmbtouchScanner.py to identify vulnerable hosts. Note that Smbtouch-1.1.1.exe is now detected by antivirus software, so use it in controlled environments.
Why would you create a Python script like SmbtouchScanner.py for batch detection?
Scanning an entire subnet manually with Smbtouch requires repeatedly modifying the XML file and rerunning the executable. A Python script automates this by parsing range IP addresses, reading/writing XML configurations, executing Smbtouch-1.1.1.exe, capturing and filtering echo output, and generating detailed log files. This improves efficiency, though the open-source version in the [article](/news/intranet-security-using-nsa-smbtouch-for-batch-detection-of-intranet) does not yet support multithreading for security reasons.
How can you use Smbtouch independently without the full FuzzBunch framework?
Each FuzzBunch plugin corresponds to three files: an .exe, a .fb, and an .xml configuration file. For Smbtouch, you can run Smbtouch-1.1.1.exe directly after editing the Smbtouch-1.1.1.xml file to include required parameters such as TargetIp, TargetPort (445), Protocol (SMB), and Credentials. The executable reads configuration from the XML, allowing standalone operation without the full framework, as detailed in the [article](/news/intranet-security-using-nsa-smbtouch-for-batch-detection-of-intranet).
What is Smbtouch and what vulnerabilities does it detect?
Smbtouch is a tool within the NSA's leaked FuzzBunch framework that detects SMB and NBT remote privilege escalation vulnerabilities on target hosts. It specifically tests for [ETERNALBLUE](/news/intranet-security-using-nsa-smbtouch-for-batch-detection-of-intranet), ETERNALCHAMPION, ETERNALROMANCE, and ETERNALSYNERGY, which are among the most harmful exploits for intranet workgroup environments.
After stopping the Eventlog service, why must file handles be released, and how is that done?
Even after the Eventlog process is terminated, its file handles remain open until the process is fully cleaned up. To gain write access to the EVTX file, you must release those handles using `NtQuerySystemInformation` with `SystemHandleInformation` to enumerate all handles, then close the specific handles belonging to the terminated process. This step is essential to avoid sharing violations when opening the file for modification, as described in [Part 2](/news/windows-xml-event-log-evtx-single-log-deletion-part-2-program-implementation-for-deleting-single-log-records-in-evtx-files).
What privileges are needed to terminate the Eventlog service process, and how are they obtained in C++?
Terminating the svchost.exe process that hosts the Eventlog service requires the `SE_DEBUG_NAME` privilege. In C++, you enable this by opening the process token with `OpenProcessToken`, looking up the privilege value with `LookupPrivilegeValue`, and adjusting the token with `AdjustTokenPrivileges`. Once elevated, you call `OpenProcess` with `PROCESS_TERMINATE` and `TerminateProcess`. Note that the service automatically restarts after a short delay.
How do you programmatically find the PID of the svchost.exe process hosting the Eventlog service?
Since multiple svchost.exe processes exist, you must enumerate services using `EnumServicesStatusEx` with `SC_ENUM_PROCESS_INFO` and filter for the service named 'eventlog'. The returned `SERVICE_STATUS_PROCESS` structure contains the `dwProcessId` for that service. This technique is used in the C++ code examples in the article, and a PowerShell one-liner `Get-WmiObject -Class win32_service -Filter "name = 'eventlog'"` also works.
Why can't I directly open an EVTX log file for modification while the Eventlog service is running?
The Eventlog service opens its EVTX log files in exclusive mode, preventing other processes from opening them for writing. To modify a log record, you must either terminate the service process (releasing file handles) or obtain a handle from within the service process. This article covers the first approach, while subsequent parts discuss obtaining handles via [injection](/news/windows-xml-event-log-evtx-single-log-entry-deletion-part-4-deleting-a-single-log-record-from-the-current-system-by-obtaining-log-file-handle-via-injection) or [DuplicateHandle](/news/windows-xml-event-log-evtx-single-log-entry-deletion-part-5-deleting-a-single-log-entry-from-the-current-system-by-obtaining-log-file-handle-via-duplicatehandle).
What are the recommended defenses against CVE-2019-15107?
The primary defense is to upgrade Webmin to version 1.930 or later, which patches the vulnerability. Alternatively, ensure the password expiry policy remains at the default setting 'Always deny users with expired passwords', which prevents exploitation even on vulnerable versions. For more on securing authentication mechanisms, see our article on [Phishing credentials via Basic Authentication (phishery) exploitation test](/news/phishing-credentials-via-basic-authentication-phishery-exploitation-test).
What considerations are needed when writing a Python POC for the Webmin RCE vulnerability, especially regarding HTTPS?
The Python POC must handle both HTTP and HTTPS targets. When the server responds with 'This web server is running in SSL mode', the script switches to HTTPS and disables certificate verification using `verify=False`. Additionally, to suppress SSL warnings, `warnings.filterwarnings('ignore')` should be added. For tips on disabling URL encoding in the Requests library, see [Python Development Tips - Disabling URL Encoding in the Requests Library](/news/python-development-tips-disabling-url-encoding-in-the-requests-library).
How can an attacker exploit the Webmin RCE vulnerability using Burp Suite?
After setting the password expiry policy to prompt for new passwords and creating a user with 'Force change at next login', the attacker logs in and captures the password change POST request in Burp Suite. The attacker then modifies the 'old' parameter (e.g., old=123|id) to inject commands, which are executed by the server. The response includes the command output, confirming RCE. This process is demonstrated in the [Webmin<=1.920-Unauthenticated_RCE(CVE-2019-15107) Exploitation Test](/news/webmin-1-920-unauthenticated-rce-cve-2019-15107-exploitation-test) article.
What is the CVE-2019-15107 vulnerability in Webmin, and what condition must be present for it to be exploitable?
CVE-2019-15107 is an unauthenticated remote code execution vulnerability in Webmin versions below 1.930. It requires the Webmin Password expiry policy to be set to 'Prompt users with expired passwords to enter a new one' (instead of the default 'Always deny'). As detailed in our [Webmin<=1.920-Unauthenticated_RCE(CVE-2019-15107) Exploitation Test](/news/webmin-1-920-unauthenticated-rce-cve-2019-15107-exploitation-test), this allows an attacker to inject commands via a crafted POST request to password_change.cgi.
How does the Preferred file indicate the active MasterKey and its expiration, and how can the expiration time be modified?
The Preferred file, located in the same directory as Master Key files, stores a 16-byte GUID identifying the current MasterKey and an 8-byte FILETIME representing its expiration (default 90 days). Using C code, an attacker can parse the file to read these values and calculate the expiry date. By overwriting the FILETIME bytes with a desired future time, the MasterKey's validity can be extended indefinitely, allowing continued decryption of data without needing a new login.
What offline methods exist to obtain the DPAPI MasterKey without direct access to the running system?
One method is to dump the LSASS process memory using `procdump.exe -ma lsass.exe`, then load the dump file into mimikatz with `sekurlsa::minidump` and run `sekurlsa::dpapi`. Another approach involves saving the SYSTEM and SECURITY registry hives, extracting the DPAPI_SYSTEM hash via `lsadump::secrets`, and using that hash to decrypt system Master Key files directly. For a full walkthrough, see [Penetration Techniques - Obtaining the MasterKey in DPAPI on Windows Systems](/news/penetration-techniques-obtaining-the-masterkey-in-dpapi-on-windows-systems).
How can an attacker recover the DPAPI MasterKey from a live Windows system using mimikatz?
With administrator privileges, an attacker can run mimikatz in an interactive session and execute the commands `privilege::debug` followed by `sekurlsa::dpapi`. This reads the LSASS process memory and displays all cached MasterKeys along with their corresponding Master Key files. This online technique is effective for immediate decryption of DPAPI blobs on the compromised system.
What is DPAPI and why is the MasterKey critical for decrypting protected data on Windows?
DPAPI (Data Protection Application Programming Interface) is a Windows component used to encrypt sensitive data such as EFS files, wireless passwords, and credentials stored in Windows Credential Manager. The MasterKey is a 64-byte key that is required to decrypt DPAPI-protected blobs; it is stored in a Master Key file encrypted with the user's login password, SID, and a random salt. Obtaining the MasterKey is essential for an attacker to access encrypted user data, similar to how extracting password hashes from the SAM database enables credential theft ([Penetration Techniques - Obtaining Local User Hashes via SAM Database](/news/penetration-techniques-obtaining-local-user-hashes-via-sam-database)).
How can MSBuild be used for persistence in Visual Studio projects?
Attackers can achieve persistence by modifying a Visual Studio `.csproj` file to include an Inline Task that runs arbitrary code (e.g., shellcode) every time the project is built. This technique, described in the article [Use MSBuild To Do More](/news/use-msbuild-to-do-more), leverages the fact that Visual Studio automatically invokes MSBuild during compilation, so malicious code executes without additional triggers. It builds on the concept of Visual Studio build events and can be combined with [Use AppDomainManager to maintain persistence](/news/use-appdomainmanager-to-maintain-persistence) for stealthier execution.
Can I execute arbitrary shellcode directly with MSBuild, and what are the platform considerations?
Yes, you can execute shellcode by embedding a byte array and calling `VirtualAlloc` and `CreateThread` from kernel32.dll within an MSBuild Inline Task. For 32-bit shellcode, use `C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe`; for 64-bit, you must use the 64-bit MSBuild and corresponding shellcode. The article [Use MSBuild To Do More](/news/use-msbuild-to-do-more) shows a full example that successfully launches calc.exe, and the technique can be combined with [Penetration Techniques - Multiple Methods for Downloading Files from GitHub](/news/penetration-techniques-multiple-methods-for-downloading-files-from-github) to fetch shellcode remotely.