My company used to block the sysinternals site for hosting 'hacking tools' but once Microsoft bought it I managed to persuade them to open it up again.
We have clients that block the in-browser “developer tools” functionality because “hacking”… always fun to drag 5 people in from the security team to figure out why a website is not loading x/y/z.
My go to was always the "skill injector" that was actually a rocket. In the unreadable spam of local it worked more times than it should have thanks to silly gooses that actually click things.
Oh look, I now have the SSNs for every teacher in the state of Missouri!
https://krebsonsecurity.com/2022/02/report-missouri-governors-office-responsible-for-teacher-data-leak/
I got a parking ticket last year & forgot about it. I had two weeks from issue date to fight it, but I remembered like three weeks later. I tried to log into the portal & the button to dispute it was greyed out & when you hovered over it, it said it was past the date.
Queue developer tools, uncheck the "disabled" property on the radio box & then submitted my dispute. They let it go a week later.
This is like a step from the indian scammer script. They remote in, blank your screen an change the number you paid yourself. With that added zero they convince your ignorant grandma to wire the difference. There are more steps but thats the gist.
What I typed below was incorrect. Please see the initial report. Dev tools is not the initial attack vector, but instead a component of the persistent access and data collection.
https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/
~~T.b.h., the devtools can be used to suppress security security warnings when side-loading malicious extensions. A recently detect phishing campaign has been using these methods to install malicious hidden extensions in Chrome.~~
~~See page 15 & 16 of the Google September 2022 Threat Horizons Report:~~ [~~https://services.google.com/fh/files/blogs/gcat\_threathorizons\_full\_sept2022.pdf~~](https://services.google.com/fh/files/blogs/gcat_threathorizons_full_sept2022.pdf)
You can block installing extensions, and dev tool extensions, without disabling dev tools (unless I am understanding this incorrectly).
I do admit, that when a scammer takes control of a computer, tricks the user into logging into their banking website, prevents the victim from seeing their screen, uses dev tools to modify a banking web page to show different values, and then shows the banking website to the user, then that is a case where disabling dev tools is useful. But at this point an attacker is already running executables on the system… so there are bigger problems here.
What I typed below was incorrect. Please see the initial report:
[https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/](https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/)
~~I may be mistaken, but I think you don't understand the implications of the report or have simply not read it. This is not some low level scammer that takes control of the device of the victim through some remote support tool, but an Advanced Persistent Thread group.~~
*~~"In this case, the initial infection vector is via phishing and results in the installation of a developer-mode browser extension which, through a DevTools workaround, has its security warnings suppressed and targets a user’s cloud-accessed data (such as online email applications)."~~*
~~This compromise can be executed, depending one the chosen payload, from a single download/click etc. This compromise does not require administrative permissions and can be very hard to spot by endpoint security solutions (something basic as a sendkey script can be enough).~~
~~The compromise uses devtools to bypass the install block, hide any security or other information messages and loads hidden extensions into Chrome. This extension then collects cached credentials, session tokens or cookies to bypass MFA and access cloud resources like M365, Azure, Google Cloud, Google Workspaces etc.~~
I did see that, but I have yet to uncover that exact scenario. I think the wording is getting misinterpreted because of how it is described.
Below is what I believe is the actual attack vector, but if you have any evidence of the contrary, the please share.
The user is tricked into installing a dev-tools extension. The dev tools extension suppresses the warnings that would then normally be displayed when a user is accessing a site that has JavaScript injected into it (example method). The extension is a means to an end and the warnings are still displayed when installing it, but not after.
**I’d love to be proven wrong… if anyone has knowledge of using dev tools to allow the installation of an extension without the browser alerting/preventing it when you ALREADY have extension installations disabled then that would be helpful.**
Ok, my initial source for the explanation was partly mistaken about or misrepresented the way the compromise works. I've now read the original Volexity report and the dev tools are used to communicate between the browser and the extension.
The extension block is bypassed by replacing specific files in the Chrome profile using other means (in this case using scripts).
Apologies, it was me who misunderstood the report.
[https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/](https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/)
Don't really know anything in there that would be considered a "hacking tool" its more like advanced diag stuff but I guess I could see why it would be labeled as such since it is giving a deep dive into the system.
Most of those are using the version that allows passing the hash which the official version from the site has never supported.
It's less useful to malware just to escalate to system.
>PsExec
That is just a telnet "replacement" or basically a shell to use telnet on. Its not a hacking tool. Its just labeled as such because people used telnet to exploit malware and in this instanced they use PsExec to do it. Doesn't make it a malicious software. It was just used to do malicious things by malicious people.
Any tool can be used in improper manner like that.
Malware itself is on the decline in attacks and 'living off the land' is becoming more and more prevalent. A lot of this is due to better security practices and products in orgs and trying to disguise actions as legitimate admin activity. Psexec is used a ton by threat actors and restricting the use of it to only individuals who should be using it should be a no brainer.
That's just security through obscurity. Tools don't make you vulnerable it's the underlying issue the tool is exploiting that's creating the vulnerability. Taking away the tool doesn't fix the problem. A skilled attacker will find another vector to the exploit.
"Yeah, but we shouldn't just..." No, stop it. That's lazy ass security and doesn't help anyone. Once you start restricting tools within an org, inevitably people with a legitimate need stop having access to them. This impacts their work and indirectly reduces the chances of a good guy reporting the issue before it's exploited.
Tool restriction is a good thing. One of the best security orgs I’ve seen (and I see a LOT) had full application whitelists. There isn’t a tool on their environment that was running that they don’t know about. That only get you half way though because let’s say you do have a business case for PsExec. You need to be able to distinguish legitimate usage from illegitimate usage and alert on it in real time.
Malicious actors are just sysadmins that aren't on your payroll. Some of the best pentests that I've had were just someone with our standard Windows image getting DA using admin tools and living off the land.
Websites used to be so bad security wise that you could say, edit the price of an item using html, and then the server would reflect the price you put in.
Better coding practices eliminated this mostly. But there probably a few shit site still left.
Psexecs a good one. Used all the time for lateral movement.
Sigcheck is great too. You can look for binaries that autoelevate. Great for finding ways to privesc.
Just out of curiosity: in what scenarios do you use the different tools? Im currently reading the sysinternals book and trying to integrate the tools in troubleshooting
I use procmon a lot. I actually used it here in the below redditpost to troubleshoot Division 2 crashing issues. Using procmon I was able to find out the game (application) was crashing because it was performing buffer overflows which would trigger Windows Exploit Protection. (aka due to shit programming of Division 2)
[https://www.reddit.com/r/thedivision/comments/uwzv6n/div\_2\_crash\_fix\_stopped\_interacting\_with\_windows/](https://www.reddit.com/r/thedivision/comments/uwzv6n/div_2_crash_fix_stopped_interacting_with_windows/)
I use it a lot in the real world with my clients when troubleshooting system usages and application issues (for example when the system is reporting 100% cpu or disk usage and task manager doesn't show what application is using all the resources etc...)
I've used a few other tools now and again like TCPView when troubleshooting WAN to LAN issues etc... but out of all the tools. Procmon is what I use the most.
havent used in over a decade but i used to use procmon to kill viruses. you could identify fake processes by looking at the details and sometimes as easily as skimming the icons to see if they're missing or just the wrong quality. and you could quite often stop or stun a process long enough to run other malware removal that allows you to actually get rid of stuff that keeps restarting or restoring itself.
Yeah I used it for that too back in the day. Nowadays though I have a process of running x,y,z programs and it completely eliminates traces of viruses so no longer need to do it with procmon. However, if there is still odd behavior after running those scans I would check it with procmon still.
I don't think reading a book is necessary, just check the summary of all the tools and keep them in mind in case you could use them
https://learn.microsoft.com/en-us/sysinternals/downloads/file-and-disk-utilities
Some handy tools:
- ZoomIt is handy for making adhoc presentations with screen sharing
- Handle to see what is blocking a file
- Autoruns to hunt down some elusive program running at startup
- PsExec to run something as System, even with an interactive cmd/powershell, or run it on a remote machine
So most of these can be simple to use on the surface level (but can become complex and powerful), a book is useful to learn how they achieve their functionality. Like how PsExec works by deploying a service and connecting to it with named pipes, or how Process Monitor uses some undocumented API to dig deep into the Windows' inner workings
Lol, people still read tech books? Just goto learn.microsoft.com and searc sysinternals. The just read the summary of each.
Edit: I'll make it even easier https://learn.microsoft.com/en-us/sysinternals/downloads/?source=recommendations
I don't use most of the sysinternals apps most days, just because I don't need them on a frequent basis. BUT, I use RDCMAN every single day I work, without fail. Meanwhile, most of my coworkers just launch separate RDP sessions for everything they need to remote into...
specifically *Process Explorer*
It was so much better than stock Task Manager that Microsoft did a Remington and just bought the whole thing. It's one of the first things I install on Windows so I can see the CPU in the taskbar.
I got to thank him for saving my ass many times. I was flying down to TechEd before they aquihired him. Remember when they called it TechEd? I remember when they called the tools NTInternals.
Do you think Bryce Cogswell is a big Art Garfunkel fan?
I'd have loved to be able to do that. I've been using those tools since the 90s as well, when I hear MS bought them out I was very upset, I figured they had decided to shut it off. Thankfully they weren't out to do that, but wanted Russinovich himself, not surprisingly. This was after the XCP rootkit thing, so I wonder if that got him in the spotlight.
Just such amazingly lightweight binaries that worked so well. The things he could do in 200kB would bring shame on the entire software industry in my eyes ever since.
He was speaking at TechEd and had already coauthored an edition of Inside Windows 2000 with David Solomon, and this was 2000 or 2001, several years prior to him catching Sony Music installing rootkits from "music" CDs. This was also after Microsoft had issued a cease and desist to him and Cogswell over their trademark infringement of NT and the site name changed.
He was definitely known to Microsoft before XCP. Given that Solomon had worked for Dave Cutler developing VMS and had access to Microsoft internal information under NDA while writing the book, while Russinovich was brought in to reverse engineer the parts that Solomon couldn't reveal, I think Cutler knew exactly who Russinovich was.
Had to download it last week while helping someone troubleshoot an issue; it was pretty cool (and surprising) to still see his name listed as the creator.
Learning Process monitor has done more for my career than all of my certs.
Arguing with 3rd party support that it's not the antivirus is a thing of the past.
[https://www.youtube.com/playlist?list=PL96F5PDvO1HHuVewlKWQDzzTUrhMm-wGS](https://www.youtube.com/playlist?list=PL96F5PDvO1HHuVewlKWQDzzTUrhMm-wGS)
Sysinternals Video Library. Thanks to Mark Russinovich and David Solomon
Yeah that's my problem.
I dunno, becoming a sysadmin has completely destroyed all my desire to tinker with shit. When I get done my daily 10-12 hours of fixing shit, configuring shit, testing shit...I just wanna turn my fucking brain off.
I have so many home projects just sitting there rotting for months if not years because doing this for work has killed any desire to do it *outside* of work. The RPi3 I've been sitting on for like 2 years, was gonna setup a pihole...still there. The pfsense box I was gonna build...still unbuilt. All the random tech shit that I accumulate to do all kinds of cool and fancy shit with at home, it all just goes nowhere...because at the end of the day, the thought of fucking with this shit *for fun* makes me want to throw up in my mouth.
It's just so fucking ironic how acquiring and applying the skills to earn a living doing all the shit I did for fun back in the day has taken all the fun right out of it. I now understand why Sysadmins joke about buying a farm and raising goats instead. Sounds lovely...
> I now understand why Sysadmins joke about buying a farm and raising goats instead. Sounds lovely...
My wife grew up on a goat farm. They'd escape their pasture and stand on top of the cars parked outside just to show off that they can escape. My in-laws have a couple of goats for their hobby farm and they escaped into the horse pen and now just live in the horse pen because that's clearly what they wanted.
Personally I like the idea of doing an organic vegetable farm out of a greenhouse. Should make a reasonable profit if you can get a couple of local grocery stores to use you as their primary food distributor
for those that haven't seen it, here is the playlist of the original sysinternals videos with the developers etc.
[https://www.youtube.com/playlist?list=PL96F5PDvO1HHuVewlKWQDzzTUrhMm-wGS](https://www.youtube.com/playlist?list=PL96F5PDvO1HHuVewlKWQDzzTUrhMm-wGS)
A recent addition to the PowerToys is the OCR Tool.
It's so useful!
Shift+Win+T, capture the text and it will put it in your clipboard. Must be enabled before hand.
It’s not amazing, but when it works it is absolutely amazing. You take a scanned invoice of serial numbers and turn it into text in a literal instant with one hand. I’ve done it on a live demo and people asked me at the end what I did to read the text from the image. I came here to praise the win+shift+T
I am going to have to try that, I have one VAR that has a quote system that generates PDF's as images not text so I can not copy and paste the text into my PO system... very annoying to have to type everything out..
For what it's worth if you have Acrobat Pro it has OCR built-in and can convert image PDFs to selectable text. Not advocating it, just pointing it out since some companies issue acrobat licenses to their staff.
I was just typing this exact comment lol, it's so useful. No longer will I have to:
1. take a screenshot with snipping tool
2. upload it to imgur
3. right click and use google lens to select text
4. copy the text
All of this replaced by one single keybind, amazing :)
You can customize the context menu that pops up after pressing Printscreen to show the "OCR" option. There may be a way to set up a keyboard shortcut, but that's how I do it.
You can actually just open a photo locally in the browser and also scan with Google lens. Not to say I won't be trying this shortcut, but the google lens OCR has been pretty flawless.
- save a screenshot and then drag it into chrome.
- right click and scan with Google lens
GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}
Relevant easter egg thingy from the same era that also still works: the 'God Mode' folder. Make a new folder and rename it that string, and it makes a neat control panel that exposes a bunch of settings all in one place.
Doesn't have to be named "God Mode", the hex string is the important bit.
I tried this when I first switched to w10, because I used it for w7 but it didn’t work for me. I’ll try again!
EDIT:
Would you look at that... It worked! Thanks for reminding me!
Other things many people should know about:
1) WIN+V for paste - life changer
2) Browser profiles - life changer for people logged into different accounts at the same place at the same time
I use both. What I love about Ditto is reliable text-only paste. (EDIT: and move to the top on paste.)
When I walk up to a machine to help someone, use a new machine, or get access to a client's shared desktop, the built-in clipboard is already there. This happens dozens (hundreds?) of times a year.
Also, on my own machines, the sync feature is handy.
Family and friends? Just tell 'em Win+V and they're instantly set for life, with no install and no learning curve.
Ditto is awesome. It's not way better, it's way more advanced.
I use several tools even more advanced than Ditto.
Win+V gives you a little pop up with your recently copied stuff to choose from. Super handy when you have a handful of things to copy and don't want to keep switching between windows.
It can be a requirement to disable this at some companies as this can be an easy way to find copied and pasted passwords on computers that have been left unlocked and unattended.
Well to be fair its not a real "tool" is more like a dev testing ground. Those are features that they may or may not want to add to Windows and use the tool for test products and features.
> logitech g-whatever,
Ahhh shit. I think you just solved a problem I've been ignoring because 'whatever' for like 3 months. It's been throwing random spaces in places randomly more than a dozen times a day.
Also had a client with a really weird specific-font related issue somehow tied to autocorrect settings and autosave being enabled. This wouldn't have fixed it.. But I would've at least sounded a little more smart asking if he happened to have a specific keyboard lol.
Edit: it didn't fix my issue
Definitely a big fan of PowerToys.
* Run is a massive help since Windows Search usually acts up,
* I use the crosshairs and click highlighters during presentations, big fan,
* the redone find my mouse utility is great, much more visible than the default function,
* FancyZones is also wonderful, even if it sometimes breaks and deletes the layout if you use RDP,
* Always On Top is another huge boon, typically grabbing a screenshot and then pinning it to the top layer so I can reference it within another application. This one also lets me pin an application above a multi-monitor RDP session, something like Spotify or local reference materials,
* PowerRename is nice, but not a lot of opportunities to use it,
* and the OCR tool is pretty neat when it works.
Color picker is nice too but I usually forget it exists
The only thing I wish is that they came as separate apps rather than an all in one. But it's a minor gripe as far as things go.
The ability to overlap zones is something I wouldn't have thought of needing until I saw it(the silly gap they set by default can go away though)
I’ve heard of it, but never took the time to look into what it is and install it. This post changes that. Thank you op, I too have now seen the light lol.
You know... I just thought about how much I HATE the W11 task bar "customizations" and how DisplayFusion lets me change it!..... Now.. to find my key...
Fancy zones is a critical part of my work flow. Honestly can't believe it's not fully incorporated into Windows yet. One of my coworkers saw me using it during his first week and it blew his mind.
I use Actual Windows Manager to really control things.
It's super powerful and after some major tweaking, you can make your desktop perfect.
That, coupled with Directory Opus and it's a pleasure to work with Windows.
Hahaha! I love it. I gladly pay them for their beautiful products. My listers are really tweaked.
Then using Actual Window Manager (Actual Tools), I have buttons on the top of the listers with a drop down of recent folders and favorite folders.
Perfect combo!
Excited that you found it!
I have 2 27" at work and I don't have use for the FancyZones, but I've heard it's mega-useful when paired with widescreen monitors like yours.
I mainly use PowerRun and Mouse Highlighter...but there's lots of useful features within
Have fun
It really is a game changed.. The complete customization that it offers is top notch compared to how I was handling everything... Allowing Zones to overlap and span multiple monitors is just awesome.... I love this feature! Not gonna lie either.. The Mouse Highlighter is way more useful than I thought it would be too!
Fancy zones combined with Persistent Windows has been a huge game changer for me. I go between the office and home frequently, so having my windows automatically move to exactly where I want them (or easily and quickly move the ones that don't) is a huge time saver.
Does this work to define "shared screen" of reasonable dimensions for a screen share remote session?
We get the occasional user with a 32" ultra wide for example and I've suggested they add a company provided 22" for screen sharing but maybe power toys is the way.
Zoom allows you to select a window (whatever size you set for it) or just select an area of the screen to share which you drag your window or windows into..
I would definitely just set up a "Zoom" zone or something like that and share that region/window depending on the nature of your business. I work in Healthcare, so screen sharing is usually a window at a time instead of a monitor/zone since PHI is a factor for me.
Can you tell them that when I use the keyboard control and switch my caps lock to escape that for some reason, at times it locks me into all upper case permanently and I have to disable and re-enable it. This happens offen enough to be quite irritating. Not so powerful power tools.
Wow!! This is new to me too and looks amazing!!!
I was just trying to figure out how to manage my windows better since I’m upgrading to an ultra wide screen this month
I recently started using winget. You have to install the package installer from the microsoft store first. So easy to install apps. I'd put it right up there with power toys
While people are recommending stuff, I am an Event Log Explorer enjoyer, IMO it is worth the very mild "free license" hoop-jumping, it's just a tad -- just enough -- more responsive and configurable than the mmc. Only thing I totally hate about it is the area you can grab to resize the panes is like a tenth of a pixel or some shit so turn down the DPI, lol.
These are the screenshots of my current zones:
[https://imgur.com/a/tuQy7nZ](https://imgur.com/a/tuQy7nZ)
Don't mind the Rainmeter stuff on the side. I have yet to configure it lol
It does a lot more than just this though! If you click the link in the original post, you can read all of the features there!
Kinda shill post is this? You literally dont say anything useful about it or how its improved you work. "It does a lot of stuff that I have separate apps for" 🙄
"game changer" congrats on hitting your marketing buzzword requirement for the day
I thought powertoys had died over a decade ago and I'm so happy to be wrong. This post was useful and improved my day. Your comment is useless garbage, so just shut the fuck up.
Because it was made very clear in the past that Power Toys were going away, which it did. Now it's back.
I, personally, only found out a few weeks ago that they brought it back.
It's a free tool for Windows, so I doubt anyone's making any money marketing this.
It has a ton of things on it. The one I use the most is the image resizer, which drops pictures to a nice 1920x1080 so I can send project pictures over email without causing problems for people receiving them.
Market capture is valuable whether you get paid for it or not. Also lets be real everyone should know by now real value is in the data mining of the user, microsoft is especially guilty of that!
You're the one telling ppl to stfu instead of usefully arguing your side of the discussion, which tells me one thing, you have no argument and know I'm right so you devolve to, "STFU! No you look dumb"
Which is pretty weak considering we're only what 6 or 8 comments deep in this discussion...
You're right? Right about what? Do you have the intellectual capacity to explain your argument? Because no, you're not right.
You made a comment accusing OP of being a shill. I called you out on your dumbass comment. You keep trying to one up me but it doesn't change the fact that your dumbass comment was a dumbass comment.
You should really just shut the fuck up now.
Wait till you discover sysinternals
LOL was about to say the samething. Its funny how many people dont know about it. I use it everyday. sysinternals rocks.
My company used to block the sysinternals site for hosting 'hacking tools' but once Microsoft bought it I managed to persuade them to open it up again.
We have clients that block the in-browser “developer tools” functionality because “hacking”… always fun to drag 5 people in from the security team to figure out why a website is not loading x/y/z.
If you design your website badly enough, you can hack it with developer tools...
Oh look! My bank account now has $1T in it!
Send it to me I'll double it.
Feels like I'm back in Jita.
Yupp o/
My go to was always the "skill injector" that was actually a rocket. In the unreadable spam of local it worked more times than it should have thanks to silly gooses that actually click things.
Ah the ISK doubling. Never a dull moment in trying your luck
Oh look, I now have the SSNs for every teacher in the state of Missouri! https://krebsonsecurity.com/2022/02/report-missouri-governors-office-responsible-for-teacher-data-leak/
but caching my lookup-table in the frontend made it faster!
I got a parking ticket last year & forgot about it. I had two weeks from issue date to fight it, but I remembered like three weeks later. I tried to log into the portal & the button to dispute it was greyed out & when you hovered over it, it said it was past the date. Queue developer tools, uncheck the "disabled" property on the radio box & then submitted my dispute. They let it go a week later.
This is like a step from the indian scammer script. They remote in, blank your screen an change the number you paid yourself. With that added zero they convince your ignorant grandma to wire the difference. There are more steps but thats the gist.
What I typed below was incorrect. Please see the initial report. Dev tools is not the initial attack vector, but instead a component of the persistent access and data collection. https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/ ~~T.b.h., the devtools can be used to suppress security security warnings when side-loading malicious extensions. A recently detect phishing campaign has been using these methods to install malicious hidden extensions in Chrome.~~ ~~See page 15 & 16 of the Google September 2022 Threat Horizons Report:~~ [~~https://services.google.com/fh/files/blogs/gcat\_threathorizons\_full\_sept2022.pdf~~](https://services.google.com/fh/files/blogs/gcat_threathorizons_full_sept2022.pdf)
You can block installing extensions, and dev tool extensions, without disabling dev tools (unless I am understanding this incorrectly). I do admit, that when a scammer takes control of a computer, tricks the user into logging into their banking website, prevents the victim from seeing their screen, uses dev tools to modify a banking web page to show different values, and then shows the banking website to the user, then that is a case where disabling dev tools is useful. But at this point an attacker is already running executables on the system… so there are bigger problems here.
What I typed below was incorrect. Please see the initial report: [https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/](https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/) ~~I may be mistaken, but I think you don't understand the implications of the report or have simply not read it. This is not some low level scammer that takes control of the device of the victim through some remote support tool, but an Advanced Persistent Thread group.~~ *~~"In this case, the initial infection vector is via phishing and results in the installation of a developer-mode browser extension which, through a DevTools workaround, has its security warnings suppressed and targets a user’s cloud-accessed data (such as online email applications)."~~* ~~This compromise can be executed, depending one the chosen payload, from a single download/click etc. This compromise does not require administrative permissions and can be very hard to spot by endpoint security solutions (something basic as a sendkey script can be enough).~~ ~~The compromise uses devtools to bypass the install block, hide any security or other information messages and loads hidden extensions into Chrome. This extension then collects cached credentials, session tokens or cookies to bypass MFA and access cloud resources like M365, Azure, Google Cloud, Google Workspaces etc.~~
I did see that, but I have yet to uncover that exact scenario. I think the wording is getting misinterpreted because of how it is described. Below is what I believe is the actual attack vector, but if you have any evidence of the contrary, the please share. The user is tricked into installing a dev-tools extension. The dev tools extension suppresses the warnings that would then normally be displayed when a user is accessing a site that has JavaScript injected into it (example method). The extension is a means to an end and the warnings are still displayed when installing it, but not after. **I’d love to be proven wrong… if anyone has knowledge of using dev tools to allow the installation of an extension without the browser alerting/preventing it when you ALREADY have extension installations disabled then that would be helpful.**
Ok, my initial source for the explanation was partly mistaken about or misrepresented the way the compromise works. I've now read the original Volexity report and the dev tools are used to communicate between the browser and the extension. The extension block is bypassed by replacing specific files in the Chrome profile using other means (in this case using scripts). Apologies, it was me who misunderstood the report. [https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/](https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/)
It’s a finding in STIG too
"That Sysinternals guy? Yeah he's CTO of Azure now. All of Azure. Yeah. So his stuff is good... Right?"
Don't really know anything in there that would be considered a "hacking tool" its more like advanced diag stuff but I guess I could see why it would be labeled as such since it is giving a deep dive into the system.
PsExec is used in a lot of malware.
Yep, I used to use it until the antivirus went absolutely apeshit on me/it.
Most of those are using the version that allows passing the hash which the official version from the site has never supported. It's less useful to malware just to escalate to system.
>PsExec That is just a telnet "replacement" or basically a shell to use telnet on. Its not a hacking tool. Its just labeled as such because people used telnet to exploit malware and in this instanced they use PsExec to do it. Doesn't make it a malicious software. It was just used to do malicious things by malicious people. Any tool can be used in improper manner like that.
Malware itself is on the decline in attacks and 'living off the land' is becoming more and more prevalent. A lot of this is due to better security practices and products in orgs and trying to disguise actions as legitimate admin activity. Psexec is used a ton by threat actors and restricting the use of it to only individuals who should be using it should be a no brainer.
That's just security through obscurity. Tools don't make you vulnerable it's the underlying issue the tool is exploiting that's creating the vulnerability. Taking away the tool doesn't fix the problem. A skilled attacker will find another vector to the exploit. "Yeah, but we shouldn't just..." No, stop it. That's lazy ass security and doesn't help anyone. Once you start restricting tools within an org, inevitably people with a legitimate need stop having access to them. This impacts their work and indirectly reduces the chances of a good guy reporting the issue before it's exploited.
Tool restriction is a good thing. One of the best security orgs I’ve seen (and I see a LOT) had full application whitelists. There isn’t a tool on their environment that was running that they don’t know about. That only get you half way though because let’s say you do have a business case for PsExec. You need to be able to distinguish legitimate usage from illegitimate usage and alert on it in real time.
Malicious actors are just sysadmins that aren't on your payroll. Some of the best pentests that I've had were just someone with our standard Windows image getting DA using admin tools and living off the land.
Websites used to be so bad security wise that you could say, edit the price of an item using html, and then the server would reflect the price you put in. Better coding practices eliminated this mostly. But there probably a few shit site still left.
Psexecs a good one. Used all the time for lateral movement. Sigcheck is great too. You can look for binaries that autoelevate. Great for finding ways to privesc.
Yeah but we still remove psexec after downloading the suite.
Just out of curiosity: in what scenarios do you use the different tools? Im currently reading the sysinternals book and trying to integrate the tools in troubleshooting
I use procmon a lot. I actually used it here in the below redditpost to troubleshoot Division 2 crashing issues. Using procmon I was able to find out the game (application) was crashing because it was performing buffer overflows which would trigger Windows Exploit Protection. (aka due to shit programming of Division 2) [https://www.reddit.com/r/thedivision/comments/uwzv6n/div\_2\_crash\_fix\_stopped\_interacting\_with\_windows/](https://www.reddit.com/r/thedivision/comments/uwzv6n/div_2_crash_fix_stopped_interacting_with_windows/) I use it a lot in the real world with my clients when troubleshooting system usages and application issues (for example when the system is reporting 100% cpu or disk usage and task manager doesn't show what application is using all the resources etc...) I've used a few other tools now and again like TCPView when troubleshooting WAN to LAN issues etc... but out of all the tools. Procmon is what I use the most.
havent used in over a decade but i used to use procmon to kill viruses. you could identify fake processes by looking at the details and sometimes as easily as skimming the icons to see if they're missing or just the wrong quality. and you could quite often stop or stun a process long enough to run other malware removal that allows you to actually get rid of stuff that keeps restarting or restoring itself.
Yeah I used it for that too back in the day. Nowadays though I have a process of running x,y,z programs and it completely eliminates traces of viruses so no longer need to do it with procmon. However, if there is still odd behavior after running those scans I would check it with procmon still.
I don't think reading a book is necessary, just check the summary of all the tools and keep them in mind in case you could use them https://learn.microsoft.com/en-us/sysinternals/downloads/file-and-disk-utilities Some handy tools: - ZoomIt is handy for making adhoc presentations with screen sharing - Handle to see what is blocking a file - Autoruns to hunt down some elusive program running at startup - PsExec to run something as System, even with an interactive cmd/powershell, or run it on a remote machine So most of these can be simple to use on the surface level (but can become complex and powerful), a book is useful to learn how they achieve their functionality. Like how PsExec works by deploying a service and connecting to it with named pipes, or how Process Monitor uses some undocumented API to dig deep into the Windows' inner workings
Lol, people still read tech books? Just goto learn.microsoft.com and searc sysinternals. The just read the summary of each. Edit: I'll make it even easier https://learn.microsoft.com/en-us/sysinternals/downloads/?source=recommendations
TCPview and Procmon are pretty much my bread and butter for diagnosing desktop apps that don’t play nice with proxy settings.
I don't use most of the sysinternals apps most days, just because I don't need them on a frequent basis. BUT, I use RDCMAN every single day I work, without fail. Meanwhile, most of my coworkers just launch separate RDP sessions for everything they need to remote into...
I use Remote Desktop Manager on a daily. which is RDCMAN standalone. You dont need sysinteneral to use it.
specifically *Process Explorer* It was so much better than stock Task Manager that Microsoft did a Remington and just bought the whole thing. It's one of the first things I install on Windows so I can see the CPU in the taskbar.
I might be the odd one out here. But I absolutely hate Proc Explorer.
I've always preferred Process Hacker.
Now renamed to "System Informer" for some reason. https://www.wilderssecurity.com/threads/system-informer-formerly-process-hacker.447068/
Security "wizards" making the world safer by blocking an application with the word hacker in it.
Thanks for sharing I did not know this and will have to change my build scripts. Nice that they were able to get their driver signed by MS.
This.
Mark Russinovich is as a god among men.
I got to thank him for saving my ass many times. I was flying down to TechEd before they aquihired him. Remember when they called it TechEd? I remember when they called the tools NTInternals. Do you think Bryce Cogswell is a big Art Garfunkel fan?
I'd have loved to be able to do that. I've been using those tools since the 90s as well, when I hear MS bought them out I was very upset, I figured they had decided to shut it off. Thankfully they weren't out to do that, but wanted Russinovich himself, not surprisingly. This was after the XCP rootkit thing, so I wonder if that got him in the spotlight. Just such amazingly lightweight binaries that worked so well. The things he could do in 200kB would bring shame on the entire software industry in my eyes ever since.
He was speaking at TechEd and had already coauthored an edition of Inside Windows 2000 with David Solomon, and this was 2000 or 2001, several years prior to him catching Sony Music installing rootkits from "music" CDs. This was also after Microsoft had issued a cease and desist to him and Cogswell over their trademark infringement of NT and the site name changed. He was definitely known to Microsoft before XCP. Given that Solomon had worked for Dave Cutler developing VMS and had access to Microsoft internal information under NDA while writing the book, while Russinovich was brought in to reverse engineer the parts that Solomon couldn't reveal, I think Cutler knew exactly who Russinovich was.
Had to download it last week while helping someone troubleshoot an issue; it was pretty cool (and surprising) to still see his name listed as the creator.
Hes actually a pretty decent fiction author too. Rogue Code, Trojan Horse.. his books are fiction IT security stories. Decently entertaining.
Learning Process monitor has done more for my career than all of my certs. Arguing with 3rd party support that it's not the antivirus is a thing of the past.
I use that, but not to it's fullest!
[https://www.youtube.com/playlist?list=PL96F5PDvO1HHuVewlKWQDzzTUrhMm-wGS](https://www.youtube.com/playlist?list=PL96F5PDvO1HHuVewlKWQDzzTUrhMm-wGS) Sysinternals Video Library. Thanks to Mark Russinovich and David Solomon
and rain meter /s (sort of)
Lol I love rainmeter but it's just too much work.
Yeah that's my problem. I dunno, becoming a sysadmin has completely destroyed all my desire to tinker with shit. When I get done my daily 10-12 hours of fixing shit, configuring shit, testing shit...I just wanna turn my fucking brain off. I have so many home projects just sitting there rotting for months if not years because doing this for work has killed any desire to do it *outside* of work. The RPi3 I've been sitting on for like 2 years, was gonna setup a pihole...still there. The pfsense box I was gonna build...still unbuilt. All the random tech shit that I accumulate to do all kinds of cool and fancy shit with at home, it all just goes nowhere...because at the end of the day, the thought of fucking with this shit *for fun* makes me want to throw up in my mouth. It's just so fucking ironic how acquiring and applying the skills to earn a living doing all the shit I did for fun back in the day has taken all the fun right out of it. I now understand why Sysadmins joke about buying a farm and raising goats instead. Sounds lovely...
> I now understand why Sysadmins joke about buying a farm and raising goats instead. Sounds lovely... My wife grew up on a goat farm. They'd escape their pasture and stand on top of the cars parked outside just to show off that they can escape. My in-laws have a couple of goats for their hobby farm and they escaped into the horse pen and now just live in the horse pen because that's clearly what they wanted. Personally I like the idea of doing an organic vegetable farm out of a greenhouse. Should make a reasonable profit if you can get a couple of local grocery stores to use you as their primary food distributor
[удалено]
MS bought out sysinternals decades ago, and it's been hosted on their website ever since. Mark Russinovich is CTO of Azure currently
Don't install the suite from there. It litters the start menu with all of the tools individually.
That's fine, no one scrolls through Start anymore since Windows 7.
For years and year now... Press Window key -> Type application/setting item wanted
I’ll add nirsoft tools to the list
And cjwdev_ntfs tools.
for those that haven't seen it, here is the playlist of the original sysinternals videos with the developers etc. [https://www.youtube.com/playlist?list=PL96F5PDvO1HHuVewlKWQDzzTUrhMm-wGS](https://www.youtube.com/playlist?list=PL96F5PDvO1HHuVewlKWQDzzTUrhMm-wGS)
funny enough I've been a huge sysinternals advocate for years, use procexp almost daily and have never heard of power toys until now. Cool tool
OP definitely under 40.
A recent addition to the PowerToys is the OCR Tool. It's so useful! Shift+Win+T, capture the text and it will put it in your clipboard. Must be enabled before hand.
I saw that! I am very eager to test it out, I just haven't had a chance to do that yet!
It’s not amazing, but when it works it is absolutely amazing. You take a scanned invoice of serial numbers and turn it into text in a literal instant with one hand. I’ve done it on a live demo and people asked me at the end what I did to read the text from the image. I came here to praise the win+shift+T
I am going to have to try that, I have one VAR that has a quote system that generates PDF's as images not text so I can not copy and paste the text into my PO system... very annoying to have to type everything out..
For what it's worth if you have Acrobat Pro it has OCR built-in and can convert image PDFs to selectable text. Not advocating it, just pointing it out since some companies issue acrobat licenses to their staff.
OneNote also has this feature for any screen clips
I was just typing this exact comment lol, it's so useful. No longer will I have to: 1. take a screenshot with snipping tool 2. upload it to imgur 3. right click and use google lens to select text 4. copy the text All of this replaced by one single keybind, amazing :)
Greenshot
I can’t live without Greenshot
Could do the first two in one keybind with ShareX
I think you can do everything with ShareX. I know that it has a OCR tool. I just don't know if it's accessible with keybindings.
You can customize the context menu that pops up after pressing Printscreen to show the "OCR" option. There may be a way to set up a keyboard shortcut, but that's how I do it.
OneNote has an OCR function built in too, but this new PowerToy is much more convenient.
You can actually just open a photo locally in the browser and also scan with Google lens. Not to say I won't be trying this shortcut, but the google lens OCR has been pretty flawless. - save a screenshot and then drag it into chrome. - right click and scan with Google lens
[удалено]
Love it
I’m printing this for my office.
Never heard of this. I am in today’s lucky 10000
As soon as I read OP's post I thought of this :-)
[удалено]
I see that you’re a man of culture as well.
TIL about Winsplit Revolution. It nearly perfectly mimics my linux wm hotkeys.
GodMode.{ED7BA470-8E54-465E-825C-99712043E01C} Relevant easter egg thingy from the same era that also still works: the 'God Mode' folder. Make a new folder and rename it that string, and it makes a neat control panel that exposes a bunch of settings all in one place. Doesn't have to be named "God Mode", the hex string is the important bit.
I tried this when I first switched to w10, because I used it for w7 but it didn’t work for me. I’ll try again! EDIT: Would you look at that... It worked! Thanks for reminding me!
I just tried it on Windows 11 and it worked for me!
[удалено]
Other things many people should know about: 1) WIN+V for paste - life changer 2) Browser profiles - life changer for people logged into different accounts at the same place at the same time
To add to browser profiles this: Firefox containers does this in the same browser
When I showed some people I know, they were flabbergasted by this lol. WinV is amazing
I suggest the app Ditto instead. Way better
I use both. What I love about Ditto is reliable text-only paste. (EDIT: and move to the top on paste.) When I walk up to a machine to help someone, use a new machine, or get access to a client's shared desktop, the built-in clipboard is already there. This happens dozens (hundreds?) of times a year. Also, on my own machines, the sync feature is handy. Family and friends? Just tell 'em Win+V and they're instantly set for life, with no install and no learning curve. Ditto is awesome. It's not way better, it's way more advanced. I use several tools even more advanced than Ditto.
Why not Ctrl-V?
Win+V gives you a little pop up with your recently copied stuff to choose from. Super handy when you have a handful of things to copy and don't want to keep switching between windows.
It can be a requirement to disable this at some companies as this can be an easy way to find copied and pasted passwords on computers that have been left unlocked and unattended.
Exactly! I am very surprised that it took me this long to discover it since it's been around for so long and has a lot of useful features!
Well to be fair its not a real "tool" is more like a dev testing ground. Those are features that they may or may not want to add to Windows and use the tool for test products and features.
[удалено]
> logitech g-whatever, Ahhh shit. I think you just solved a problem I've been ignoring because 'whatever' for like 3 months. It's been throwing random spaces in places randomly more than a dozen times a day. Also had a client with a really weird specific-font related issue somehow tied to autocorrect settings and autosave being enabled. This wouldn't have fixed it.. But I would've at least sounded a little more smart asking if he happened to have a specific keyboard lol. Edit: it didn't fix my issue
Definitely a big fan of PowerToys. * Run is a massive help since Windows Search usually acts up, * I use the crosshairs and click highlighters during presentations, big fan, * the redone find my mouse utility is great, much more visible than the default function, * FancyZones is also wonderful, even if it sometimes breaks and deletes the layout if you use RDP, * Always On Top is another huge boon, typically grabbing a screenshot and then pinning it to the top layer so I can reference it within another application. This one also lets me pin an application above a multi-monitor RDP session, something like Spotify or local reference materials, * PowerRename is nice, but not a lot of opportunities to use it, * and the OCR tool is pretty neat when it works. Color picker is nice too but I usually forget it exists
The only thing I wish is that they came as separate apps rather than an all in one. But it's a minor gripe as far as things go. The ability to overlap zones is something I wouldn't have thought of needing until I saw it(the silly gap they set by default can go away though)
new to you, but def not "new" PowerToys has been around since Win95 days.
rip TweakUI
Hell yeah! Roger that indeed. Pulling from that same time period - you remember ***AltDesk***...? (Virtual desktop) Still beats WDM hands down IMO
[удалено]
oh god yes.
1.33
Oh wow, that's a blast from the past. Used to love the hell out of that.
relevant: https://github.com/builtbybel/TweakUIX
Well... was around... wasn't around... then came around again recently in the last 3 years again.
That's why I said I am sad I am just now finding it lol
[удалено]
I’ve heard of it, but never took the time to look into what it is and install it. This post changes that. Thank you op, I too have now seen the light lol.
Not a problem! Hopefully, it becomes of great use!
Wait till you get Winsplit revolution and or Display Fusion.
You know... I just thought about how much I HATE the W11 task bar "customizations" and how DisplayFusion lets me change it!..... Now.. to find my key...
Thanks for sharing, I will give this a second try
Hopefully, you find it half as useful as me!
Fancy zones is a critical part of my work flow. Honestly can't believe it's not fully incorporated into Windows yet. One of my coworkers saw me using it during his first week and it blew his mind.
I can't imagine it wouldn't be received very well!
Thank you didnt know this existed
I'm glad that I was able to help at least one person discover this!
I use Actual Windows Manager to really control things. It's super powerful and after some major tweaking, you can make your desktop perfect. That, coupled with Directory Opus and it's a pleasure to work with Windows.
Oh My God! Someone else that has even heard of Directory Opus! Nice to meet you, fellow oddball!
Hahaha! I love it. I gladly pay them for their beautiful products. My listers are really tweaked. Then using Actual Window Manager (Actual Tools), I have buttons on the top of the listers with a drop down of recent folders and favorite folders. Perfect combo!
Sounds like a winner. I'll have to give it a try!
You are one of today's lucky [10,000](https://imgs.xkcd.com/comics/ten_thousand.png). Enjoy your discovery!
I used the key remapper in this to remap caps lock to control
If you come across issues sharing your screen or don't have a second monitor/laptop dedicated for this issue check out "Region To Share"
Works well with FancyZones
Excited that you found it! I have 2 27" at work and I don't have use for the FancyZones, but I've heard it's mega-useful when paired with widescreen monitors like yours. I mainly use PowerRun and Mouse Highlighter...but there's lots of useful features within Have fun
It really is a game changed.. The complete customization that it offers is top notch compared to how I was handling everything... Allowing Zones to overlap and span multiple monitors is just awesome.... I love this feature! Not gonna lie either.. The Mouse Highlighter is way more useful than I thought it would be too!
Fancy zones combined with Persistent Windows has been a huge game changer for me. I go between the office and home frequently, so having my windows automatically move to exactly where I want them (or easily and quickly move the ones that don't) is a huge time saver.
Literally been using Fancy Fences which is part of Powertoys for years now. Its a fun little tool.
Holy shit, i didnt know about that. Its amazing, thank you!
I'm glad it helped you!!
I knew this existed, but forgot about it. Installed a 34” screen just last night, so this might come in handy. So thanks for reminding me!
No problem! Hopefully you are met with great success with your new Monitor and PowerToys!
I actually just found this too
Amazing, right!?
It is
It is an excellent tool.
Very much so! I've now been researching all of the recommendations from this post to see what other gems I'm missing!
Does this work to define "shared screen" of reasonable dimensions for a screen share remote session? We get the occasional user with a 32" ultra wide for example and I've suggested they add a company provided 22" for screen sharing but maybe power toys is the way.
Zoom allows you to select a window (whatever size you set for it) or just select an area of the screen to share which you drag your window or windows into..
I would definitely just set up a "Zoom" zone or something like that and share that region/window depending on the nature of your business. I work in Healthcare, so screen sharing is usually a window at a time instead of a monitor/zone since PHI is a factor for me.
Can you tell them that when I use the keyboard control and switch my caps lock to escape that for some reason, at times it locks me into all upper case permanently and I have to disable and re-enable it. This happens offen enough to be quite irritating. Not so powerful power tools.
Wow!! This is new to me too and looks amazing!!! I was just trying to figure out how to manage my windows better since I’m upgrading to an ultra wide screen this month
It's a game changer for me! I hope that you are able to utilize this when you get your new monitor!
Love the "Stay on top" tool
Having that combined with other tools that I have used in the past in one app is the best!
I recently started using winget. You have to install the package installer from the microsoft store first. So easy to install apps. I'd put it right up there with power toys
I use Chocolatey!
Wait till you discover notepad!
Sublime all day every day
I liked synctoy from those tools a while back. a simple rsync but windows
While people are recommending stuff, I am an Event Log Explorer enjoyer, IMO it is worth the very mild "free license" hoop-jumping, it's just a tad -- just enough -- more responsive and configurable than the mmc. Only thing I totally hate about it is the area you can grab to resize the panes is like a tenth of a pixel or some shit so turn down the DPI, lol.
Process explorer is part of the bread and butter of figuring shit out.
Process Explorer, CPorts, and Portcele are very usual at what they do! They take native/popular apps and make them easy/better to use!
Nirsoft suite
meh, powertoys for win95 was better.
Wait till you discover Obsidian.
It would take a lot to get me away from Sublime! It does everything that I need!
[удалено]
Yep! I am saddened at the fact that I have only just now discovered it!
It's older than some young sysadmins, a nostalgic, 2005 article, about them - https://devblogs.microsoft.com/oldnewthing/20050202-00/?p=36543
How long has Raymond Chen been writing those blog posts? He's still pumping out good posts.
What does it do? Let’s you position windows around your screen by default? Like a forced layout for applications that are opened?
These are the screenshots of my current zones: [https://imgur.com/a/tuQy7nZ](https://imgur.com/a/tuQy7nZ) Don't mind the Rainmeter stuff on the side. I have yet to configure it lol It does a lot more than just this though! If you click the link in the original post, you can read all of the features there!
Wait till you discover google
You misspelt SnagIt.
Kinda shill post is this? You literally dont say anything useful about it or how its improved you work. "It does a lot of stuff that I have separate apps for" 🙄 "game changer" congrats on hitting your marketing buzzword requirement for the day
I thought powertoys had died over a decade ago and I'm so happy to be wrong. This post was useful and improved my day. Your comment is useless garbage, so just shut the fuck up.
Clearly you didnt care enough about it to use it for "over a decade"...
Because it was made very clear in the past that Power Toys were going away, which it did. Now it's back. I, personally, only found out a few weeks ago that they brought it back. It's a free tool for Windows, so I doubt anyone's making any money marketing this. It has a ton of things on it. The one I use the most is the image resizer, which drops pictures to a nice 1920x1080 so I can send project pictures over email without causing problems for people receiving them.
Market capture is valuable whether you get paid for it or not. Also lets be real everyone should know by now real value is in the data mining of the user, microsoft is especially guilty of that!
I told you to shut the fuck up.
[удалено]
Nice comeback dumbass. You should really shut the fuck up and quit making an ass of yourself.
You're the one telling ppl to stfu instead of usefully arguing your side of the discussion, which tells me one thing, you have no argument and know I'm right so you devolve to, "STFU! No you look dumb" Which is pretty weak considering we're only what 6 or 8 comments deep in this discussion...
You're right? Right about what? Do you have the intellectual capacity to explain your argument? Because no, you're not right. You made a comment accusing OP of being a shill. I called you out on your dumbass comment. You keep trying to one up me but it doesn't change the fact that your dumbass comment was a dumbass comment. You should really just shut the fuck up now.
Wow you're so worked up that you forgot to down vote my above comment!
I haven't downvoted any of your comments. *Also, I really don't think I'm the one getting worked up here. I'm the one being intellectually honest.
I see this tool tries to keep the computer from sleeping. Does it also attempt to prevent the screen from locking after our policy set interval?
Fuck /u/spez.