Reply to thread

Message

<blockquote data-quote="509322" data-source="post: 619649">LOL... the guy (I think Alessandro) that asked Black Cipher Security to test NVT ERP wanted him to test the most recent stable build of ERP with the default Vulnerable Process List - which includes both cmd.exe and powershell.exe on it - to verify that ERP would protect a home system.However, Black Cipher Security tested ERP from an Enterprise perspective - and not a home use one.&nbsp; So however he chose the version of ERP - whether deliberately or by chance - he used the old stable version that does not include powershell.exe on the default Vulnerable Process List and he probably removed cmd.exe from the list as well.If bypassuac is still using Invoke-BypassUAC.ps1 (or whatever the pen-test community is passing around at the moment), then there would have been an alert for powershell.exe in the most recent stable build of ERP.&nbsp; Even in the old stable version of ERP there should be an alert if cmd.exe is launched.&nbsp; As there are no cmd.exe alerts in the video, one of the possible reasons is that he removed cmd.exe from the Vulnerable Process List.For the guys who wanted or are interested in the ERP test and its results, Black Cipher Security should have shown the Vulnerable Process List - and not just the Settings (which for the most part are irrelevant).The only thing that people here wanted to know is &quot;Will ERP protect against this type of attack ?&quot;&nbsp; But the video creator performed a test that was not asked for.&nbsp; It&#039;s a change-up and sowing confusion.&nbsp; It&#039;s simple, home users want a test of actual home use and not Enterprise.&nbsp; The version of ERP and the ERP VPL was probably modified to allow scripts as if ERP were being used in a corporate environment.Black Cipher Security should be given a break on this one as he probably did not know that the users he was interacting with are home users and wanted ERP tested from that perspective.</blockquote>

[QUOTE="509322, post: 619649"] LOL... the guy (I think Alessandro) that asked Black Cipher Security to test NVT ERP wanted him to test the most recent stable build of ERP with the default Vulnerable Process List - which includes both cmd.exe and powershell.exe on it - to verify that ERP would protect a home system. However, Black Cipher Security tested ERP from an Enterprise perspective - and not a home use one. So however he chose the version of ERP - whether deliberately or by chance - he used the old stable version that does not include powershell.exe on the default Vulnerable Process List and he probably removed cmd.exe from the list as well. If bypassuac is still using Invoke-BypassUAC.ps1 (or whatever the pen-test community is passing around at the moment), then there would have been an alert for powershell.exe in the most recent stable build of ERP. Even in the old stable version of ERP there should be an alert if cmd.exe is launched. As there are no cmd.exe alerts in the video, one of the possible reasons is that he removed cmd.exe from the Vulnerable Process List. For the guys who wanted or are interested in the ERP test and its results, Black Cipher Security should have shown the Vulnerable Process List - and not just the Settings (which for the most part are irrelevant). The only thing that people here wanted to know is "Will ERP protect against this type of attack ?" But the video creator performed a test that was not asked for. It's a change-up and sowing confusion. It's simple, home users want a test of actual home use and not Enterprise. The version of ERP and the ERP VPL was probably modified to allow scripts as if ERP were being used in a corporate environment. Black Cipher Security should be given a break on this one as he probably did not know that the users he was interacting with are home users and wanted ERP tested from that perspective. [/QUOTE]

Verification