Open in app

Sign In

Write

Sign In

Grzegorz Tworek
Grzegorz Tworek

41 Followers

Home

About

Feb 27, 2021

Windows object permissions as a backdoor

As the typical cyberattack kill chain follows the well-known schema, the response should follow it. This is also true in the “Local privilege escalation” scenarios, and it may be quite interesting in all cases, when the system needs to support unprivileged users, but such users reach sometimes for more than…

Windows

8 min read

Windows object permissions as a backdoor
Windows object permissions as a backdoor
Windows

8 min read


Dec 9, 2019

Persistence with Windows Services

When it comes to hacking, Windows Services are priceless due to couple of factors: They natively work over the network — the entire Services API was designed with remote servers in mind, They start automatically when the system boots up, They may have extremely high privileges in the OS, They…

Microsoft

11 min read

Microsoft

11 min read


Nov 2, 2019

Cleaning NTFS artifacts with FSCTL_CLEAN_VOLUME_METADATA

NTFS is the main filesystem used within Windows OS to store your files and folders. As every single filesystem, NTFS not only stores your data, but also some additional data about your data, usually called metadata. It may be not the most important thing for you, but it is priceless…

Microsoft

3 min read

Microsoft

3 min read


Sep 28, 2019

GPO Forensics

GPO Forensics GPO (Group Policy Object) is one of the most useful features of the Windows ecosystem. Simply saying, GPO allows an admin to create a set of rules to be applied on domain-joined computers, making him no longer care about “how”, but rather “what”. …

Forensics

4 min read

Forensics

4 min read


Sep 9, 2019

Using UEFI to inject executable files into BitLocker protected drives

To keep important things clear: BitLocker is a Windows-based full volume encryption solution. It encrypts every single sector of the volume, acting on the lowest possible layer — encrypting the data just before being written to the hardware and decrypting freshly it immediately after reading. BitLocker is considered relatively secure…

Security

3 min read

Security

3 min read


Aug 13, 2019

I’ve got the power - enabling SeBackupPrivilege to make cmd.exe run on steroids

Let’s start from the beginning, trying to keep it as simple as possible: objects (in this case folders and files) may have their Access Control Lists (ACL) to determine who has an access to the data. …

Security

3 min read

I’ve got the power
I’ve got the power
Security

3 min read


Jul 11, 2019

Bad parenting — forensics value of parent-child process statistics

Let’s assume you know what the “process” means in Windows OS. If not sure, I would definitely recommend the sample chapter from Windows Internals book, named “Processes, Threads, and Jobs”. …

Microsoft

5 min read

Bad parenting
Bad parenting
Microsoft

5 min read

Grzegorz Tworek

Grzegorz Tworek

41 Followers

Help

Status

Writers

Blog

Careers

Privacy

Terms

About

Text to speech