go-secdump

go-secdump Description Package go-secdump is a tool built to remotely extract hashes from the SAM registry hive as well as LSA secrets and cached hashes from the SECURITY hive without any remote agent and without touching disk. The tool is built on top of the library go-smb and use it to...

HiveJack

HiveJack This tool can be used during internal penetration testing to dump Windows credentials from an already-compromised host. It allows one to dump SYSTEM, SECURITY and SAM registry hives and once copied to the attacker machines provides an option to delete these files to clear the trace. Ofte...

LegacyHive

LegacyHive : Windows user profile service arbitrary hive load elevation of privileges vulnerability The PoC requires another standard user credentials and a third username which can be an administrator account, if the PoC is successful, it will end up mounting the target user hive in current user...

RawHive

RawHive RawHive is a Cobalt Strike BOF for pulling selected Windows registry hives directly from a raw NTFS volume. It skips the normal file APIs, walks NTFS metadata to find the target file records, and copies the bytes straight from disk. It currently looks for: C:\Windows\System32\config\SAM...

CVE-2021-36934

CVE-2021-36934 CVE-2021-36934 HiveNightmare vulnerability checker and workaround Flow The script has the following flow: Requires it to run with Administrator privileges Check Windows 10 version is affected by the vulnerability. IF affected by vulnerability: Show Windows version may be affected b...

Registry-Spy

Registry Spy: Cross-Platform Windows Registry Browser Registry Spy is a free, open-source cross-platform Windows Registry viewer. It is a fast, modern, and versatile explorer for raw registry files. Features include: Windows, macOS, and Linux support Fast, on-the-fly parsing means no upfront...

aggrokatz

aggrokatz What is this aggrokatz is an Aggressor plugin extension for CobaltStrike which enables pypykatz to interface with the beacons remotely. The current version of aggrokatz allows pypykatz to parse LSASS dump files and Registry hive files to extract credentials and other secrets stored...

HiveV5_keystream_decryptor

PoC de descifrado de flujo de claves keystream de HiveV5 Introducción La muestra de Hive analizada y referenciada en este documento fue elegida aleatoriamente de esta lista creada por @rivitna, a quien agradezco enormemente. Los artefactos están disponibles en la plataforma VirusTotal. En este...

hive

De WikiLeaks: Hoy, 9 de noviembre de 2017, WikiLeaks publica el código fuente y los registros de desarrollo de Hive, un componente principal de la infraestructura de la CIA para controlar su malware. Hive resuelve un problema crítico para los operadores de malware de la CIA. Incluso el implante d...

CLEANSTART-2026-IQ19736 Security fix for CVE-2024-23454 applied in: apache-hive 4.0.0-r0, apache-hive 4.2.0-r0, spark-sc213-jdk17-py312 3.5.8-r0

CVE-2024-23454 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VG05953 Security fix for CVE-2023-20861 applied in: apache-hive 4.0.0-r1

Security vulnerability affects the apache-hive package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-WW03960 Security fix for CVE-2026-45300 applied in: apache-hive 4.0.0-r2, apache-hive 4.2.0-r4

CVE-2026-45300 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VY64057 Security fix for CVE-2026-40490 applied in: apache-hive 4.2.0-r2

Security vulnerability affects the apache-hive package. This issue is resolved in later releases. See references for vulnerability details...

dfir-toolkit

!CAUTION DFIR Toolkit is leaving github Why? We believe that all men and women, and all human between and above are created equal. In this mindset, it does not make sense to judge people based on their birthplace, or their language, color, religion, or whatsoever. We believe that who you are is...

backup_dc_registry

Copia de seguridad del registro de Backup Operator para comprometer el dominio Un POC simple que abusa de los privilegios de Backup Operator para volcar de forma remota las hives SAM, SYSTEM y SECURITY. Créditos de la investigación: @filipdragovic Portado del PoC de Windows de @mpgn Uso Esta prue...

CVE-2021-36934-HiveNightmare-Lab

CVE-2021-36934 HiveNightmare - Educational Lab 🎯 Objective Reproduce and analyze the HiveNightmare vulnerability in a controlled lab environment. 📋 Table of Contents Vulnerability Description Implementation Demonstration Lab Setup & Tools Exploitation Steps Mitigation Measures Demonstration...

regipy

regipy ⚠️ Breaking Changes in v6.0.0 Version 6.0.0 includes significant modernization changes: Python 3.9+ required - Dropped support for Python 3.6, 3.7, and 3.8 attrs library removed - Data classes now use Python's built-in dataclasses module If your code imports internal classes Cell,...

CVE-2020-1472-Easy

CVE-2020-1472-Easy Definitivamente no es algo que querrías ejecutar en nada que te importe. Construido a partir de un writeup y trabajo de @obfuscatee y otra fuente Usa código de https://github.com/dirkjanm/CVE-2020-1472 https://github.com/SecuraBV/CVE-2020-1472...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fixed the issue of unexpected dereferencing of the hive. Check whether the amdgpuhiveinfo hive might be NULL...

CLEANSTART-2026-CL03013 Netty is an asynchronous, event-driven network application framework

Multiple security vulnerabilities affect the apache-hive package. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...