Cybersecurity Q&A
Browse concise answers derived from our published, source-linked cybersecurity coverage.
How can an attacker trigger the malicious DLL without directly running netsh?
Since some VPN software and system processes call netsh during startup, the attacker's DLL will be loaded automatically when those programs invoke netsh. Alternatively, the attacker can add netsh to startup items—only `netsh.exe` appears in the list, making it deceptive. This strategy is akin to using [Use Logon Scripts to maintain persistence](/news/use-logon-scripts-to-maintain-persistence) where legitimate scripts are abused.
What are the requirements for writing a helper DLL for Netsh persistence?
The DLL must export a function named `InitHelperDll` with the signature `DWORD WINAPI InitHelperDll(DWORD dwNetshVersion, PVOID pReserved)`. Inside this function, you can execute arbitrary code—for example, starting `cmd.exe` or loading shellcode. The export can be declared using a `.def` file or with `extern "C" __declspec(dllexport)`. Similar DLL‑based persistence techniques are discussed in [Exploitation Analysis of Executing Shellcode via Boolang Language](/news/exploitation-analysis-of-executing-shellcode-via-boolang-language).
How does Netsh persistence work using a helper DLL?
Netsh persistence involves writing a malicious DLL that exports the `InitHelperDll` function, then using the `netsh add helper` command (or directly adding a registry key under `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh`) to register it. Every time netsh runs, it loads the helper DLL and calls `InitHelperDll`, which executes the attacker's payload. This technique is similar to other persistence methods like [Use CLR to maintain persistence](/news/use-clr-to-maintain-persistence) that leverage native system components.
What are the steps to connect to the vRealize Operations Manager databases for debugging?
Database passwords are stored in `/var/vmware/vpostgres/11/.pgpass`. At least two PostgreSQL instances run on ports 5432 and 5433. For example, connect to the vcopsdb on port 5432 using: `/opt/vmware/vpostgres/11/bin/psql -h localhost -p 5432 -d vcopsdb -U vcops` and then enter the password. This setup is similar to other VMware product debugging environments, such as [vRealize Log Insight Vulnerability Debugging Environment Setup](/news/vrealize-log-insight-vulnerability-debugging-environment-setup).
How can I identify the version of a running vRealize Operations Manager instance?
You can identify the version by accessing the API endpoint `https://<server>/suite-api/docs/wadl.xml`. The XML response contains a `getCurrentVersionOfServer` field with version information. When parsing the data, handle XML escape characters (e.g., `&`) and use regex with `re.MULTILINE|re.DOTALL` flags since the data spans multiple lines. Complete example code is available in the article.
Where can I find sensitive information like admin password hashes and database credentials in vRealize Operations Manager?
The admin user password hash is stored in `/storage/vcops/user/conf/adminuser.properties`, and database passwords are found in `/var/vmware/vpostgres/11/.pgpass`. Important web and log paths include the web directory at `/usr/lib/vmware-casa/casa-webapp/webapps/` and logs at `/storage/log/vcops/log/cas`. These paths are essential for vulnerability debugging and post-exploitation analysis.
How do I set up a vRealize Operations Manager vulnerability debugging environment?
First, download the OVA file from VMware (version vROps-8.3.0-HF2) and import it into VMware Workstation. After installation, configure the admin and root passwords, then enable SSH with 'service sshd start'. To enable remote debugging, edit `/usr/lib/vmware-casa/casa-webapp/bin/setenv.sh` to add the JVM debug parameter `-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=8000`, restart the service, and open the firewall with `iptables -F`. For more details on the entire process, see the article [Setting up vRealize Operations Manager Vulnerability Debugging Environment](/news/setting-up-vrealize-operations-manager-vulnerability-debugging-environment).
After exporting emails, how can I view or remove pending export requests?
Use `Get-MailboxExportRequest` to list all export requests. To remove a specific request, use `Remove-MailboxExportRequest -Identity 'user\MailboxExport' -Confirm:$false`. To remove all requests, use `Get-MailboxExportRequest | Remove-MailboxExportRequest -Confirm:$false`. Requests are automatically retained for 30 days by default, but you can override this with the `-CompletedRequestAgeLimit 0` parameter when creating the export.
What is the main difference between exporting emails via a remote PSSession and directly on the Exchange server using a local snap-in?
When exporting directly on the Exchange server (local snap-in), you do not need to assign the user to the "Mailbox Import Export" role group; the local administrator often has sufficient privileges. The snap-in is loaded with `Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn` (or version-specific like `Microsoft.Exchange.Management.PowerShell.E2010` for Exchange 2010). In contrast, remote PSSession requires explicit role assignment because the session doesn't automatically inherit full permissions.
How can I export only emails containing a specific keyword (e.g., "pass") from a user's mailbox on an Exchange server?
Use the `-ContentFilter` parameter with `New-MailboxExportRequest`. For example: `New-MailboxExportRequest -mailbox test1 -ContentFilter {(body -like "*pass*")} -FilePath "\\localhost\c$\test\test1.pst"`. This exports a PST file containing only emails whose body matches the filter. You can also script it to loop through all mailboxes in an OU using `Get-Mailbox -OrganizationalUnit Users -Resultsize unlimited | % {New-MailboxExportRequest -mailbox $_.name -FilePath "..." -ContentFilter ...}`.
What is the prerequisite for exporting emails using the New-MailboxExportRequest cmdlet via a remote PSSession?
The user account must be assigned to the "Mailbox Import Export" role group. You can add a user with the command `New-ManagementRoleAssignment –Role "Mailbox Import Export" –User Administrator`. Without this role, the export request will fail. After exporting, you may remove the assignment using `Remove-ManagementRoleAssignment -Identity "Mailbox Import Export-Administrator" -Confirm:$false`.
How can I remotely connect to an Exchange server using PowerShell to manage emails?
You can establish a remote PowerShell session (PSSession) by providing credentials and the Exchange server's URI with the configuration name "Microsoft.Exchange". For example: `$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://Exchange01.test.com/PowerShell/ -Authentication Kerberos -Credential $Credential` then import the session with `Import-PSSession $Session -AllowClobber`. This allows you to run Exchange cmdlets like `Get-Mailbox` remotely. For more details, see the article [Penetration Basics - Searching and Exporting Emails from Exchange Servers](/news/penetration-basics-searching-and-exporting-emails-from-exchange-servers).
What is the vpxuser account and how is its password stored in vCenter's PostgreSQL database?
When an ESXi host connects to vCenter, it creates a root-privileged user named `vpxuser`. Its password is encrypted and stored in the `vc.vpxv_hosts` table, with a default 32-character length regenerated every 30 days. You can extract this encrypted password using the SQL query `SELECT name,username,password FROM vc.vpxv_hosts;`. This information is critical for lateral movement, as discussed in [vSphere Development Guide 4 - PostgreSQL](/news/vsphere-development-guide-4-postgresql).
How do I write a Go program to automatically connect to vCenter's PostgreSQL and export VM data?
Use Go with the `github.com/lib/pq` package, but note a bug in vCenter's environment: the third-party package may fail due to the `$PGSERVICEFILE` environment variable. Fix it by commenting out lines 1988-1989 in `conn.go`. Then, read the vc password from `/etc/vmware-vpx/vcdb.properties`, connect to VCDB, and query `vc.vpx_vm` and `vc.vpxv_hosts` tables. Cross-compile for Linux using `GOOS=linux GOARCH=amd64 go build`. The full code example is in [vSphere Development Guide 4 - PostgreSQL](/news/vsphere-development-guide-4-postgresql).
What SQL queries can I run to export virtual machine and ESXi host configuration from vCenter's database?
After connecting to the VCDB database, run `SELECT * FROM vc.vpx_vm;` to retrieve VM configuration (e.g., file_name, guest_os, ip_address) and `SELECT * FROM vc.vpx_host;` for ESXi host info. For ESXi passwords, use `SELECT name,username,password FROM vc.vpxv_hosts;` to get the encrypted vpxuser password. These commands are essential for penetration testing as explained in [vSphere Development Guide 4 - PostgreSQL](/news/vsphere-development-guide-4-postgresql).
How can I connect to vCenter's PostgreSQL database if the 'postgres' user has a default empty password?
If the 'postgres' user password is not set, you can connect using `psql -h localhost -U postgres`. However, if a password is set and unknown, you can use the 'vc' user by reading its plaintext password from `/etc/vmware-vpx/vcdb.properties` and then connecting with `psql -h localhost -d VCDB -U vc`. This method is detailed in [vSphere Development Guide 4 - PostgreSQL](/news/vsphere-development-guide-4-postgresql).
What are the three main methods to overwrite the original system log file after modifying it?
The three methods are: (1) Releasing file locks by terminating the EventLog process, replacing the file, and restarting the service; (2) Injecting a DLL into the log process to gain a file handle and modify memory directly; (3) Using `DuplicateHandle` to duplicate a file handle from another process and then overwrite the log file content in memory. Each method has trade-offs—injection may be intercepted, and releasing locks creates EventID 7034/7036 logs. For implementation details, refer to the related series: [Windows XML Event Log (EVTX) Single Log Entry Deletion (Part 3)](/news/penetration-techniques-deleting-single-windows-log-entries) and subsequent parts.
How can I delete a single Windows event log entry using the wevtutil command?
You can use the wevtutil command with an XPath query to filter out specific EventRecordIDs. For example, to delete a single log entry with EventRecordID=1112 from the Security log, run: `wevtutil epl Security 1.evtx "/q:*[System [(EventRecordID!=1112)]]"`. This exports all logs except that entry to a new .evtx file, which you then overwrite onto the original system file. For more details, see the original article on [Penetration Techniques - Deleting Single Windows Log Entries](/news/penetration-techniques-deleting-single-windows-log-entries).
How does the registry key creation for the exploit work, and what is the role of the GUID used in the code?
The exploit creates a new registry key under `HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\` (e.g., named `payload`) that contains an `UninstallString` value with the attacker's command (e.g., `calc.exe`). The GUID `{18E78D31-BBCC-4e6f-A21D-0A15BBC62D49}` in the code corresponds to the name of this subkey. When `LaunchUninstallStringAndWait` is called, it retrieves and executes the `UninstallString` from that registry location, effectively running the payload with high privileges. This technique is reminiscent of [Testing and Analysis of Bypassing AppLocker Using LUA Scripts](/news/testing-and-analysis-of-bypassing-applocker-using-lua-scripts), where registry-based execution paths are exploited.
Why can't we directly modify the HKEY_LOCAL_MACHINE registry key during the UAC bypass exploit?
During a UAC bypass, the attacker does not yet have administrator privileges, so they cannot write to `HKEY_LOCAL_MACHINE` (HKLM) because it requires elevated permissions. Instead, the exploit writes to `HKEY_CURRENT_USER` (HKCU) under `Software\Microsoft\Windows\CurrentVersion\Uninstall`, which maps to the user's registry hive. The COM component's `LaunchUninstallStringAndWait` method reads from both HKLM and HKCU, but the attacker can specify a registry key under HKCU (via its GUID) to execute the payload without elevation.