RawHive

RawHive RawHive is a Cobalt Strike BOF for pulling selected Windows registry hives directly from a raw NTFS volume. It skips the normal file APIs, walks NTFS metadata to find the target file records, and copies the bytes straight from disk. It currently looks for: C:\Windows\System32\config\SAM...

go-secdump

go-secdump Description Package go-secdump is a tool built to remotely extract hashes from the SAM registry hive as well as LSA secrets and cached hashes from the SECURITY hive without any remote agent and without touching disk. The tool is built on top of the library go-smb and use it to...

LegacyHive

LegacyHive : Windows user profile service arbitrary hive load elevation of privileges vulnerability The PoC requires another standard user credentials and a third username which can be an administrator account, if the PoC is successful, it will end up mounting the target user hive in current user...

aggrokatz

aggrokatz What is this aggrokatz is an Aggressor plugin extension for CobaltStrike which enables pypykatz to interface with the beacons remotely. The current version of aggrokatz allows pypykatz to parse LSASS dump files and Registry hive files to extract credentials and other secrets stored...

Registry-Spy

Registry Spy: Cross-Platform Windows Registry Browser Registry Spy is a free, open-source cross-platform Windows Registry viewer. It is a fast, modern, and versatile explorer for raw registry files. Features include: Windows, macOS, and Linux support Fast, on-the-fly parsing means no upfront...

HiveJack

HiveJack This tool can be used during internal penetration testing to dump Windows credentials from an already-compromised host. It allows one to dump SYSTEM, SECURITY and SAM registry hives and once copied to the attacker machines provides an option to delete these files to clear the trace. Ofte...

HiveV5_keystream_decryptor

PoC de descifrado de flujo de claves keystream de HiveV5 Introducción La muestra de Hive analizada y referenciada en este documento fue elegida aleatoriamente de esta lista creada por @rivitna, a quien agradezco enormemente. Los artefactos están disponibles en la plataforma VirusTotal. En este...

CVE-2021-36934

CVE-2021-36934 CVE-2021-36934 HiveNightmare Verwundbarkeitsprüfer und Problemumgehung Ablauf Das Skript hat den folgenden Ablauf: Erfordert die Ausführung mit Administratorrechten Überprüft, ob die Windows 10 Version von der Sicherheitslücke betroffen ist. Falls von der Sicherheitslücke betroffen...

hive

Von WikiLeaks: Heute, am 9. November 2017, veröffentlicht WikiLeaks den Quellcode und die Entwicklungsprotokolle von Hive, einer wichtigen Komponente der CIA-Infrastruktur zur Steuerung ihrer Malware. Hive löst ein kritisches Problem für die Malware-Betreiber der CIA. Selbst das ausgefeilteste...

dfir-toolkit

!CAUTION DFIR Toolkit lascia github Perché? Crediamo che tutti gli uomini e le donne, e tutti gli esseri umani nel mezzo e oltre siano creati uguali. In quest'ottica, non ha senso giudicare le persone in base al luogo di nascita, alla lingua, al colore della pelle, alla religione o a qualsiasi...

backup_dc_registry

Dal backup del registro di Backup Operator alla compromissione del dominio Un semplice POC che abusa dei privilegi di Backup Operator per eseguire il dump remoto degli hive SAM, SYSTEM e SECURITY. Crediti della ricerca a: @filipdragovic Porting dal @mpgn Windows PoC Utilizzo Questa prova di...

regipy

regipy ⚠️ Modifiche importanti in v6.0.0 La versione 6.0.0 include importanti modifiche di modernizzazione: Richiede Python 3.9+ - Supporto terminato per Python 3.6, 3.7 e 3.8 Rimossa la libreriaattrs - Le classi data ora usano il modulo dataclasses integrato di Python Se il tuo codice importa...

CVE-2021-36934-HiveNightmare-Lab

CVE-2021-36934 HiveNightmare - Laboratorio Didattico 🎯 Obiettivo Riprodurre e analizzare la vulnerabilità HiveNightmare in un ambiente di laboratorio controllato. 📋 Indice Descrizione della Vulnerabilità Implementazione Dimostrazione Configurazione del Laboratorio e Strumenti Fasi di Sfruttamento...

CVE-2020-1472-Easy

CVE-2020-1472-Easy Questa è decisamente una cosa che non vorresti eseguire su nulla a cui tieni. Costruito da un write-up e dal lavoro di @obfuscatee e un'altra fonte Utilizza codice da https://github.com/dirkjanm/CVE-2020-1472 https://github.com/SecuraBV/CVE-2020-1472...

CVE-2026-55976

Server-Side Request Forgery SSRF in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url table property on an Avro table that is...

CVE-2026-53561

An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...

CVE-2026-49845

SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata including statistics updates, truncation targets, and...

CVE-2026-21758

HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment...

CVE-2026-21754

HCL Hive is affected by multiple infrastructure and network configuration vulnerabilities, which could lead to unauthorized lateral movement, container breakout, and sensitive data exposure within internal communications...

CVE-2026-21753

HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious third-party dependencies within the application environment...