1456 matches found
CVE-2021-36934
CVE-2021-36934 CVE-2021-36934 HiveNightmare vulnerability checker and workaround Flow The script has the following flow: Requires it to run with Administrator privileges Check Windows 10 version is affected by the vulnerability. IF affected by vulnerability: Show Windows version may be affected b...
Registry-Spy
Registry Spy: Cross-Platform Windows Registry Browser Registry Spy is a free, open-source cross-platform Windows Registry viewer. It is a fast, modern, and versatile explorer for raw registry files. Features include: Windows, macOS, and Linux support Fast, on-the-fly parsing means no upfront...
go-secdump
go-secdump Description Package go-secdump is a tool built to remotely extract hashes from the SAM registry hive as well as LSA secrets and cached hashes from the SECURITY hive without any remote agent and without touching disk. The tool is built on top of the library go-smb and use it to...
RawHive
RawHive RawHive is a Cobalt Strike BOF for pulling selected Windows registry hives straight from a raw NTFS volume. It skips the normal file APIs, walks NTFS metadata to find the target file records, and reads the bytes directly from disk. Targets: C:\Windows\System32\config\SAM...
HiveJack
HiveJack This tool can be used during internal penetration testing to dump Windows credentials from an already-compromised host. It allows one to dump SYSTEM, SECURITY and SAM registry hives and once copied to the attacker machines provides an option to delete these files to clear the trace. Ofte...
aggrokatz
aggrokatz What is this aggrokatz is an Aggressor plugin extension for CobaltStrike which enables pypykatz to interface with the beacons remotely. The current version of aggrokatz allows pypykatz to parse LSASS dump files and Registry hive files to extract credentials and other secrets stored...
HiveV5_keystream_decryptor
HiveV5 keystream decryptor PoC Introduction The Hive sample analyzed and referred to in this document was randomly chosen from this list created by @rivitna to which my warmest thanks go. Artifacts are available on the VirusTotal platform. In this document, file a0h2uih3d2.exe has been taken as a...
hive
From WikiLeaks: Today, 9 November 2017, WikiLeaks publishes the source code and development logs to Hive, a major component of the CIA infrastructure to control its malware. Hive solves a critical problem for the malware operators at the CIA. Even the most sophisticated malware implant on a targe...
dfir-toolkit
!CAUTION DFIR Toolkit is leaving github Why? We believe that all men and women, and all human between and above are created equal. In this mindset, it does not make sense to judge people based on their birthplace, or their language, color, religion, or whatsoever. We believe that who you are is...
backup_dc_registry
Backup Operator Registry Backup to Domain Compromise A simple POC that abuses Backup Operator privileges to remote dump SAM, SYSTEM, and SECURITY hives. Research credit to: @filipdragovic Ported from @mpgn Windows PoC Usage This proof of concept is a modified version of impacket/examples/reg.py a...
CVE-2021-36934-HiveNightmare-Lab
CVE-2021-36934 HiveNightmare - Educational Lab 🎯 Objective Reproduce and analyze the HiveNightmare vulnerability in a controlled lab environment. 📋 Table of Contents Vulnerability Description Implementation Demonstration Lab Setup & Tools Exploitation Steps Mitigation Measures Demonstration...
CLEANSTART-2026-QI59332 FasterXML jackson-databind 2
Security vulnerability affects the apache-hive package. FasterXML jackson-databind 2...
CLEANSTART-2026-NG64377 Unbounded memory allocation in Google Guava 11
Security vulnerability affects the apache-hive package. Unbounded memory allocation in Google Guava 11...
CLEANSTART-2026-YW54942 Fasterxml Jackson version Before 2
Security vulnerability affects the apache-hive package. Fasterxml Jackson version Before 2...
CLEANSTART-2026-GF02196 FasterXML jackson-databind 2
Security vulnerability affects the apache-hive package. FasterXML jackson-databind 2...
CLEANSTART-2026-CO70761 In Connect2id Nimbus JOSE+JWT before 9
Security vulnerability affects the apache-hive package. In Connect2id Nimbus JOSE+JWT before 9...
CLEANSTART-2026-AO34403 temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com
Security vulnerability affects the apache-hive package. A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com...
CLEANSTART-2026-FI29300 Connect2id Nimbus JOSE + JWT 10
Security vulnerability affects the apache-hive package. Connect2id Nimbus JOSE + JWT 10...
CLEANSTART-2026-JS33298 flaw was discovered in FasterXML jackson-databind in all versions before 2
Security vulnerability affects the apache-hive package. A flaw was discovered in FasterXML jackson-databind in all versions before 2...