Windows 10/11 Installation Bypass

In the past, we can choose to use Microsoft account (Hotmail/Outlook) to setup the login or use an offline account (like how we did traditionally) during the installation.

Recently, the "offline account" option isn't available any more if Internet connection is available during the installation. 

There are some advantages to use online account, but if you still prefer offline account, there are 2 ways.

First, cut off the Internet during the Windows 10/11 installation.

Second, cheat them while maintain the Internet connection. 

Microsoft will continue to ask for a valid Microsoft account if you provide an invalid Hotmail/Outlook account. So, simply enter "sample@hotmail.com" and fill in with any random password, till the system gives up. 

Then the offline account option will be available.

Start MSIE Browser Even Replaced by MS-Edge Browser

Internet Explorer 11 (on Windows 10)

Still miss your MS Internet Explorer browser?

Here's a way to "start" your IE browser even it has been replaced by MS Edge.

1. Press "win" key, and start typing "Internet Options".
2. Click on "Internet Options", and you should see "Internet Properties" control panel.
3. Click on "Programs" tab.
4. Click on "Manage add-ons" button, and see the "Manage Add-ons" window.
   
5. At the bottom, click on "Learn more about toolbars and extensions" link.
6. MSIE browser is back!! 😜

 

Note that this method works in both Windows 10 and 11. Let's start 🏄 with MSIE again.

Windows Virtual Machines

Here're the 2 ways to actually get a pre-made Windows Virtual Machine directly from Microsoft. Note that this isn't a permanent solution. 

The first is the Microsoft Edge Developer page under Tools and then VMS. You can choose between Windows 8, 8.1, and 10. For VM platform, we can choose between VirtualBox, Vagrant, VMware, HyperV, and Parallels (Mac).

For Windows 11 VM, we need to head over to the Windows 11 development environment page. Again, we can choose between 4 different virtualization software options. Note the expiration date!

Microsoft recommends to save a "snapshot" of the VM. But this only works for the first method.

Links:

• https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/
• https://developer.microsoft.com/en-us/windows/downloads/virtual-machines/
• How to Legally Download a Windows Virtual Machine

Misconfigured ACL for SAM

Windows 10 version 1809 and newer could be affected by this vulnerability. According to Microsoft, an elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

This means, we, as non-admin user, don't need to crack the hashes any more; we can use Mimikatz, for instance, to elevate privileges using this extracted data. 

The advisory states that, if successfully exploited, this bug, dubbed by some as HiveNightmare, can be used to:

• Extract and leverage account password hashes.
• Discover the original Windows installation password.
• Obtain DPAPI computer keys, which can be used to decrypt all computer private keys.
• Obtain a computer machine account, which can be used in a silver ticket attack.

Or, shorter, "a local authenticated attacker may be able to achieve [local privilege escalation], masquerade as other users, or achieve other security-related impacts." This can be used to thoroughly infect a system with malware, snoop on other users, and so on. 

According to the advisory: "Note that VSS shadow copies may not be available in some configurations, however simply having a system drive that is larger that 128GB in size and then performing a Windows Update or installing an MSI will ensure that a VSS shadow copy will be automatically created."

US-CERT describes how to detect whether you have VSS shadow copies available, and it involves running vssadmin list shadows as a privileged user and seeing if any shadow copies are listed.

The VSS shadow copies are a key ingredient because the registry hive files are in use by Windows during normal operation, so can't be accessed by a normal user even with the loose ACL. However, if shadow copies available, you'll find you can open copies of the files for inspection thanks to the sloppy ACL.

[ CVE Description ]
 [*] CVE_ID : CVE-2021-36934
 [_] Desc   : Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by an overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to execute arbitrary code with SYSTEM privileges..

 [_] C:2021-07-20 / P:2021-07-20 / L:2021-07-20
 [*] Vuln Risk           : 18.5605
 [*] Exploited [trend]   : 0 [holding]
 [_] Exploit/likehood    : False/None

 [*] Malware sample : 0
 [*] Exploits/POC   : [0]
 [_] Fixes          : [0]
 [_] Threat Actors  : [0]
 [_] CVSS2 / CVSS3  : [ 6.8 / 7.8 ]

 [_] Vuln Products  : [0]

[ CVE Malware Family Info : None ]

[ High_Profile_Vulnerability ]
 [!!!]   CVE-2021-36934 (18.5605) : []


 ** [5] threads completed [2 tasks] / [1.99 KB] within [2.60 sec].
 ** [ 2021-07-22 ]

Updates on PrintNightmare

After the CVE-2021-1675 and CVE-2021-34527 updates on Print Spooler issue, some new updates about the PrintNightmare vulnerabilities added today.

• CVE-2021-34527 affects all versions of Windows (including but not limited to DC). 
  
• Successful exploitation requires authentication and results in remote code execution (RCE) and local privilege escalation (LPE) on a vulnerable target.
• To fully remediate risk introduced by CVE-2021-34527, Windows systems administrators must disable Point and Print across their environments. This is an essential step in the remediation process, without which the out-of-band updates are ineffective.

Conclusion is, CVE-2021-34527 did not remediate the vulnerability as long as Point and Print was still enabled.

Link:

• https://attackerkb.com/topics/MIHLz4sY3s/cve-2021-34527-printnightmare?referrer=notificationEmail#rapid7-analysis
  

WiFi Password

• Open command prompt and run it as administrator
• Llist all the Wi-Fi profiles, type this command in CMD “netsh wlan show profile.”
• Show the password by type the command “netsh wlan show profile [wifi- name] key=clear.”