Jason Hill’s Post

Here is quick if you were affected by the latest Windows outage.

Crowdstrike there is a fix. 1. Click See Advanced Repair Options 2. Click Troubleshoot 3. Click Command prompt and enter the following pushd C:\Windows\System32\drivers\Crowdstrike del “C-00000291*.sys” exit 4. Click continue, system should reboot normally

According to Kyle Winton. If it helps... In relation to Crowdstrike there is a fix. Click See Advanced Repair Options Click Troubleshoot Click Command prompt and enter the following pushd C:\Windows\System32\drivers\Crowdstrike del “C-00000291*.sys” exit Click continue, system should reboot normally

Here is the workaround: Crowdstrike Update From the recovery menu: -Select Safe Mode -Select Troubleshoot -Select Advanced Options -Select Command Prompt Here is the workaround: -Select Safe Mode -Open Command Prompt "C:\Windows\System32\drivers\CrowdStrike" -run this command del C-00000291*.sys Restart laptop Login as normal

#CrowdStrike #BSOD > Boot into Safe Mode, "Advanced Startup" with Command Prompt, and use > this command to remove faulty channel files: > > del "C:\Windows\System32\drivers\CrowdStrike\C-00000291*.sys" > >This is a better choice than changing the folder name for the CrowdStrike driver, but as always, YMMV. https://lnkd.in/gzzwYtt8

Got a recent bsod? Using crowdstrike.. Boot into Safe Mode, "Advanced Startup" with the Command Prompt, and use this command to remove faulty channel files: del "C:\Windows\System32\drivers\CrowdStrike\C-00000291*.sys"

Check out the #Wireshark Conversations feature - https://wix.to/4XhsbRR #troubleshooting #tcpip

If your impacted by CrowdStrike, the issue is a particular file. You can use PowerShell if your machine works- Remove-Item “C:\Windows\System32\drivers\CrowdStrike\C-00000291*” If your stuck in the bootloop you need to enter safe mode to remove file or enter the command line to remove. I’d recommend also mass deploying the script to working machines to ensure the file doesn’t cause a bootloop. If you command line from use dir from the CrowdStrike folder put exact file name in: Operating System: Del “C:\Windows\System32\drivers\CrowdStrike\C-00000291-00000000-00000035” From blue screen: Del “C:Windows\System32\drivers\CrowdStrike\C-00000291-00000000-00000035”

For the current Croudstrike BSOD issue there are a few work around 1. Group policy to remove the file https://lnkd.in/dqzcCM3Z 2. Manually remove the file within Safe Mode, Advanced Start Up (Command Prompt): del "C:\Windows\System32\drivers\CrowdStrike\C-00000291*.sys" The Reddit thread: https://lnkd.in/gy5UPWtg My chatter on Twitter: https://lnkd.in/gXFkGWNV Try the above in a test environment prior to running it in production.

🎈 The web server on the default port 80 hosts a demo virtual host, accessible with guest credentials. While reviewing the links, I discover a MinIO Metrics section that is visible due to a Line Feed (LF) injection vulnerability. This allows me to analyze the logs, leading to the discovery of a new virtual host. This new virtual host uses the MinIO platform and reveals the service version, which is vulnerable to CVE-2023-28432. This is an information disclosure vulnerability that exposes the root user's credentials of the platform. After a thorough analysis, I determine that a specific version of a bucket leaks critical information related to an identity-based secrets and encryption management system. Finally, privilege escalation is achieved by leveraging a program that can be executed with elevated privileges by a user.