The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

  • Twitter Updates

  • My Flickr Stream

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,862 other subscribers

Archive for the ‘Windows’ Category

Bypassing ACLs with SeRestore privilege. And very simple User to LocalSystem elevation. – YouTube

Posted by jpluimers on 2025/05/28

This is cool and scary at the same time, especially since I knew about other privileges (SeDebugPrivilege comes to mind).

Granted you need to be local administrator for this, but still: for some tasks you do not need to elevate in the traditional way, but just give your current token more privileges.

[Wayback/Archive] Bypassing ACLs with SeRestore privilege. And very simple User to LocalSystem elevation. – YouTube

Via [WaybackSave/Archive] Grzegorz Tworek on X: “Friendly Reminder: If you have admin privileges but lack the necessary file permissions, you can leverage the SeBackup/SeRestore privileges directly from cmd.exe! There’s no need to elevate to LocalSystem, duplicate TrustedInstaller, or use similar methods. Simply enable the …”

Read the rest of this entry »

Posted in C, Development, Power User, Software Development, Windows, Windows Development | Leave a Comment »

Interesting take by Florian Roth on Twitter: “First security application I install on … “” covering various platforms (both server and workstation) with tools that are easy and quick to install

Posted by jpluimers on 2025/05/26

[Wayback/Archive] Florian Roth on Twitter: “First security application I install on … macOS: LittleSnitch Linux Server: Fail2ban Linux Workstation: etckeeper Windows Workstation: GlassWire Windows Server: Sysmon — What are yours?”

Full thread at [Wayback/Archive] Thread by @cyb3rops on Thread Reader App

Some interesting responses to the original tweet, hence me saving it.

–jeroen

Posted in *nix, *nix-tools, Apple, BSD, FreeBSD, Mac OS X / OS X / MacOS, Power User, Windows | Leave a Comment »

Exporting Chrome History (with the “new” configuration and state file structure), and Epoch dates on various systems

Posted by jpluimers on 2025/05/02

Quite a while ago, Chrome moved from a structure based on “Current Session“, “Current Tabs“, “Last Session” and “Last Tabs” into “Session_#################” and “Tabs_#################” stored in a “Sessions” folder (and similar migrations for other state and configuration files).

The numbers in the “Session_*” and “Tabs_*” files are time stamps of those sessions, for instance one needs to figure out what the “13310808970819630” in “Session_13310808970819630” and “Session_13310808970819630” means.

Lot’s of web-pages with tips and tricks around the old structures are still around, often surfacing high in Google Search results.

I was interested in a particular trick to export Google Chrome browsing history and had a hard time figuring out the easiest solution.

Read the rest of this entry »

Posted in Apple, Batch-Files, Chrome, Chrome, Database Development, Development, Google, JavaScript/ECMAScript, Mac OS X / OS X / MacOS, NirSoft, Polyglot, Power User, Scripting, SQLite, Web Browsers, Windows, Windows 10, Windows 11 | Tagged: | Leave a Comment »

Some SQLite things I recently learned a while ago

Posted by jpluimers on 2025/04/30

More on the reason why I learned a few SQLite things soon, but for my link and documentation archive, below is what I learned.

Most commands use the database file C:\temp\History which has no extension as that is how I got the file in the first place (spoiler: it’s a Chrome browser History from one of my user profiles).

Let’s get started:

Read the rest of this entry »

Posted in *nix, *nix-tools, bash, CommandLine, Conference Topics, Conferences, Console (command prompt window), Database Development, Development, Event, Power User, PowerShell, PowerShell, Software Development, SQL, SQLite | Leave a Comment »

Windows Installer is transactional, but combined with NTFS and installer processes is not fully: do more C:\Config.msi vulnerabilities exist? (plus a truckload of information on Windows SIDs)

Posted by jpluimers on 2025/04/10

Over the last years a few C:\Windows.msi vulnerabilities have been discovered (and fixed), of which some are linked below.

The core is that the Windows Installer tries to be transactional, and NTFS is, but the combination with installer processes isn’t.

That leads into vulnerabilities where you can insert malicious Roll Back Scripts (.rbs files) and Roll Back Files (.rbf files), and I wonder if by now more have been discovered.

So this post is a kind of reminder to myself (:

Oh, and I learned much more about whoami on Windows, as there  whoami /groups shows very detailed SID information. From that, I learned more on the internals of SIDs too!

Read the rest of this entry »

Posted in Blue team, C++, Development, Power User, Red team, Security, Software Development, Visual Studio C++, Windows, Windows Development | Tagged: , , , | Leave a Comment »

Run Windows 3.1 in True-Colour Full HD: GitHub – PluMGMK/vbesvga.drv: Modern Generic SVGA driver for Windows 3.1

Posted by jpluimers on 2025/04/09

This is soooo cool: [Wayback/Archive] GitHub – PluMGMK/vbesvga.drv: Modern Generic SVGA driver for Windows 3.1

Modern Generic SVGA driver for Windows 3.1
This is a rewrite of the Windows 3.1 SVGA driver, designed to support ALL available 8-bit, 16-bit, 24-bit or 32-bit graphic modes on any system providing the VESA BIOS Extensions (hence the VBE in the name). It is based on the Video 7 SVGA driver included in the Win16 Driver Development Kit, with most of the hardware-specific code gutted out, and with support added for multi-byte pixels.

Related:

It reminds me of other endevours to keep retro-software easy to use: Read the rest of this entry »

Posted in Assembly Language, Delphi, Delphi 1, Development, Power User, Software Development, Windows, Windows 3.11, x86 | Leave a Comment »

Installing Chocolatey on Windows 10 and up

Posted by jpluimers on 2025/04/02

Steps for installing Chocolatey on Windows 11 and up or 10 version 1803 and up.

Since I often install Windows on machines where it is not easy to copy/paste longer install commands my steps are slightly different than the ones on [Wayback/Archive] Chocolatey Software | Installing Chocolatey:

  1. Start a regular command prompt
  2. Either these two (the options are equivalent, see [Wayback/Archive] curl: transfer a URL | curl Commands | Man Pages | ManKier for --remote-name and -O):
    • curl --remote-name https://community.chocolatey.org/install.ps1
    • curl -O https://community.chocolatey.org/install.ps1

    Note the cURL pre-installed on Windows 10 since at least 6 years*: release 1803 or insider build 17063 is good enough to download the Chocolatey install script

  3. Inspect the downloaded install.ps1 to check if you spot anything you dislike
  4. Start an elevated (administrator) command prompt
  5. Start PowerShell
  6. Execute this command
    • Set-ExecutionPolicy Bypass -Scope Process -Force
  7. Execute this command in the folder where you downloaded install.ps1
    • .\install.ps1
  • Yup, a custom build of cURL has been pre-installed on Windows 10 and up since more than 6 years:

Read the rest of this entry »

Posted in *nix, *nix-tools, Chocolatey, cURL, Development, Power User, Software Development, Windows, Windows 10, Windows 11, Windows Development | Leave a Comment »

git on Windows: figuring out SID mismatch

Posted by jpluimers on 2025/03/31

A few years back I had an error happen a while on one of my Windows machines after a git pull: fatal: detected dubious ownership in repository at 'C:/versioned/repository' followed by a few lines with Windows SIDs (Security Identifiers) that I had to map to actual users.

I thought I had it scheduled, but my notes were in a draft post, so when I bumped into it again when upgrading an old virtual machine with new versions I finished it and scheduled it for now.

The first time I got the error was after git for Windows fixed security vulnerability [Wayback/Archive] CVE-2022-24765 and included the quote from [Wayback/Archive] Uncontrolled search for the Git directory in Git for Windows · Advisory · git-for-windows/git:

Read the rest of this entry »

Posted in CommandLine, Development, DVCS - Distributed Version Control, git, Power User, PowerShell, PowerShell, Scripting, Software Development, Source Code Management, Windows, Windows 10, Windows 11, Windows 7 | Tagged: | Leave a Comment »

Note for future self if .NET hash calculations from `ComputeHash()` are slower than expected

Posted by jpluimers on 2025/03/26

Normally when calculating hashes in .NET you use the [Wayback/Archive] HashAlgorithm.ComputeHash Method (System.Security.Cryptography) | Microsoft Learn.

This can be slow as [Wayback/Archive] cmcginty showed while answering the question [Wayback/Archive] How to get an MD5 checksum in PowerShell – Stack Overflow by [Wayback/Archive] Luke101 posing a faster solution (in this case for md5, but it can be generalised):

Read the rest of this entry »

Posted in .NET, C#, Chocolatey, CommandLine, Development, Power User, PowerShell, PowerShell, Scripting, Software Development, Windows | Tagged: | Leave a Comment »

I was today years old when I found there is a shortcut to switch to the Terminal tab in Visual Studio Code

Posted by jpluimers on 2025/03/12

Boy, I always to the Ctrl+Shift+Space on Microsoft Windows (or on MacOS Command+Shift+Space) detour to switch to the Terminal tab in Visual Studio Code

So I was amazed to find the shortcut inside the first bullet in the Google Search quote of the first result at [Wayback/Archive] vscode terminal open new terminal – Recherche Google:

Read the rest of this entry »

Posted in .NET, Apple, Development, Keyboards and Keyboard Shortcuts, KVM keyboard/video/mouse, Mac OS X / OS X / MacOS, Power User, Software Development, Terminal, vscode Visual Studio Code, Windows, Windows Terminal | Tagged: | Leave a Comment »