(UAC) User Assisted Compromise - Room362.com

A number of times during tests I’ve actually run into those mythical creatures called “patched windows machines”. At DerbyCon Chris Gates and I released the “Ask” post module (which I had failed to publish). This module very simply uses the ShellExecute windows function via Railgun with the undocumented (but very well known) operator of ‘runas’. These two lines accomplished that:



(UAC) User Assisted Compromise - Room362.com

Trick me once, ShameOnUAC

ShameOnUAC

When the Cylance SPEAR Team was formed late last year we started
looking into an area that we had long wanted to study: the potential for
subverting programs during privilege elevation through UAC. We created
proof of concept malware that attacks Windows Explorer, which we dubbed
ShameOnUAC.


ShameOnUAC injects itself into the unprivileged Explorer process,
where it hooks SHELL32!AicLaunchAdminProcess and waits for the user to
ask to run a program as administrator. It then then tampers with the
elevation requests before they're sent to the AppInfo service. (This is a
downside of having an unprivileged process submit elevation requests
for you.)


Here's how UAC works normally:





Trick me once, ShameOnUAC

Installer stuck at 18% when upgrading from Windows 10 (10074 to 10122) - Enterprise Mobility Tips - Site Home - TechNet Blogs

Are you trying to upgrade to Windows 10 preview build 10122 and the
installation hangs at 18%? The following approach unblocked me,
hopefully it works for you too – please let us know in the comments:

• Download psexec.exe from sysinternals to e.g. c:\temp
• Open an elevated command prompt
• Execute psexec with the following parameters (try not to copy/paste):
  
  • C:\Temp\psexec.exe –s –i cmd.exe
• A command prompt in the system context should launch: 
• More....

Installer stuck at 18% when upgrading from Windows 10 (10074 to 10122) - Enterprise Mobility Tips - Site Home - TechNet Blogs

Debugging Tutorial Index - Sysnative Forums

 !tz and !tzinfo WinDbg Extensions - Thermal Zone ACPI Trip Levels

• Add Windbg (kd>) Commands to Program Default for Dump Files
• Bit Flips
• BlackEnergy 2 (alias BlackEnergy Version 2) Live Debugging
• BSOD Method and Tips
• BSOD Analysis - Getting Started
• BSODs but no Dump Files?
• Collecting User Mode Dumps/ Windows Error Reporting (WER)
• Common BSOD drivers listing
• Device/Driver Objects and Stacks
• Double Fault
• DPCs and APCs
• Exception Codes (NT STATUS Codes)
• Hotfix to create a memory dump without a pagefile (Win7/Server 08 R2)
• How the BSOD actually 'works', why, etc.
• MEMORY_CORRUPTION_STRIDE
• New BSOD codes for Win8
• New BSOD codes for Win8.1
• Page Faults Explained
• Registers (x86)
• More.....

Debugging Tutorial Index - Sysnative Forums

Meet 'Tox': Ransomware for the Rest of Us - McAfee

The packaging of malware and malware-construction kits for cybercrime
“consumers” has been a long-running trend. Various turnkey kits that
cover remote access plus botnet plus stealth functions are available
just about anywhere. Ransomware, though very prevalent, has not yet
appeared in force in easy-to-deploy kits.


But now we have Tox–and it’s free.



Meet 'Tox': Ransomware for the Rest of Us - McAfee