go-secdump

go-secdump Description Package go-secdump is a tool built to remotely extract hashes from the SAM registry hive as well as LSA secrets and cached hashes from the SECURITY hive without any remote agent and without touching disk. The tool is built on top of the library go-smb and use it to...

backup_dc_registry

Backup Operator Registry Backup to Domain Compromise（バックアップオペレータのレジストリバックアップによるドメイン侵害） Backup Operator の権限を悪用して SAM、SYSTEM、SECURITY ハイブをリモートダンプするシンプルな POC です。 研究クレジット: @filipdragovic 移植元: @mpgn の Windows PoC 使用方法 この proof of concept は impacket/examples/reg.py の修正版であり、最新の impacket...

CVE-2021-36934-HiveNightmare-Lab

CVE-2021-36934 HiveNightmare - 교육용 연구실 🎯 목표 통제된 연구실 환경에서 HiveNightmare 취약점을 재현하고 분석합니다. 📋 목차 취약점 설명 구현 데모 연구실 설정 및 도구 악용 단계 완화 조치 데모 결론 참고 자료 1. 취약점 설명 CVE-2021-36934, 일명 "SeriousSAM" 또는 "HiveNightmare"은 Windows 10 버전 1809 이후, 초기 Windows 11 버전, Windows Server 2019 및 2022에 영향을 미치는 로컬 권한 상승LPE...

Microsoft Windows 10 19031809 - RPCSS Activation Kernel Security Callback Privilege Escalation

Microsoft Windows 10 19031809 - RPCSS Activation Kernel Security Callback Privilege Escalation Windows: RPCSS Activation Kernel Security Callback EoP Platform: Windows 10 1903/1809 not tested earlier Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User...

Microsoft Windows 10 1809 - 'CmKeyBodyRemapToVirtualForEnum' Arbitrary Key Enumeration Privilege Escalation

Windows: CmKeyBodyRemapToVirtualForEnum Arbitrary Key Enumeration EoP Platform: Windows 10 1809 not tested earlier Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User boundary Summary: The kernel’s Registry Virtualization doesn’t safely open the real key fo...