> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/system-host-based-attacks/windows-vulnerabilities.md).

# Windows Vulnerabilities

### Overview of Windows Vulnerability

**-> A brief History of Windows Vulnerabilities**

* Microsoft Windows is the dominant operating system worldwide with a market share >=70% as of 2021.
* The popularity and deployment of Windows by individuals and companies makes it a prime target for attackers given the threat surface.
* Over the last 15 years, Windows has had its fair share of severe vulnerabilities, ranging from MS08-067 (Conflicker) to MS17-010 (EternalBlue).
* Given the popularity of Windows, most of these vulnerabilities have publicly accessible exploit code making them relatively straightforward to exploit.

**-> Window Vulnerabilities**

* Microsoft Windows has various versions and releases which makes the threat surface fragmented in terms of vulnerabilities that exits in Windows 7 are not present in Windows 10.
* Regardless of the various versions and releases, all Windows OS's share a likeness given the development model and philosophy:
  * Window OS's have been developed in the C programming language, making them vulnerable to buffer overflows, arbitary code execution etc.
  * By default, Windows is not configured to run securely and require a proactive implementation of security practices in order to configure Windows to run securely
  * Newly discovered vulnerabilities are not immediately patched by Microsoft and given the fragmented nature of Windows, many systems are are left unpatched.
* The frequent release of new versions of Windows is also a contributing factor to exploitation, as many companies take a substantial length of time to upgrade their systems to the latest version of Windows and opt to use older versions that may be affected by an increasing number of vulnerabilities.
* In addition to inherent vulnerabilities, Windows is also vulnerable to cross platform vulnerabilities, for example SQL injection attacks.
* System/host's running Windows are also vulnerable to physical attacks like; theft, malicious peripheral devices etc.

**-> Types of Windows Vulnerabilities**

* Information disclosure - Vulnerability that allows an attacker to access confidential data.
* Buffer overflows - Caused by a programming error, allows attackers to write data to a buffer and overrun the allocated buffer, consequently writing data to allocated memory addresses.
* Remote code execution - Vulnerability that allows an attacker to remotely execute code on the target system.
* Privilege escalation - Vulnerability that allows an attack to elevate their privileges after initial compromise.
* Denial of Service (DoS) - Vulnerability that allows an attacker to consume a system/host's resources (CPU, RAM, Network etc) consequently preventing the system form functioning normally

### Frequently Exploited Windows Services

* Microsoft Windows has various native services and protocols that can be configured to run on a host.
* These services provide an attacker with an access vector that they can utilize to gain access to a target host.
* Having a good understanding of what these services are, how they work and their potential vulnerabilities is a vitally important skill to have as a penetration tester.

| Protocols/Service                               | Ports              | Purpose                                                                                                                                                   |
| ----------------------------------------------- | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Microsoft IIS (Internet Information Services)   | TCP ports 80/443   | Proprietary web server software developed by Microsoft that runs on Windows.                                                                              |
| WebDAV (Web Distributed Authoring & Versioning) | TCP ports 80/443   | HTTP extension that allows clients to update, delete, move and copy files on a web server. WebDAV is used to enable a web server to act as a file server. |
| SMB/CIFS (Server Message Block Protocol)        | TCP port 445       | Network file sharing protocol that is used to facilitate the sharing of files and peripherals between computers on a local network (LAN).                 |
| RDP (Remote Desktop Protocol)                   | TCP port 3389      | Proprietary GUI remote access protocol developed by Microsoft and is used to remotely authenticate and interact with a Windows system.                    |
| WinRM (Windows Remote Management Protocol)      | TCP ports 5986/443 | Windows remote management protocol that can be used to facilitate remote access with Windows systems.                                                     |