CVE-2021-36934-HiveNightmare-Lab

CVE-2021-36934 HiveNightmare - Laboratorio Didattico 🎯 Obiettivo Riprodurre e analizzare la vulnerabilità HiveNightmare in un ambiente di laboratorio controllato. 📋 Indice Descrizione della Vulnerabilità Implementazione Dimostrazione Configurazione del Laboratorio e Strumenti Fasi di Sfruttamento...

go-secdump

go-secdump Description Package go-secdump is a tool built to remotely extract hashes from the SAM registry hive as well as LSA secrets and cached hashes from the SECURITY hive without any remote agent and without touching disk. The tool is built on top of the library go-smb and use it to...

backup_dc_registry

Backup Operator Registry Backup zur Domänenkompromittierung Ein einfacher POC, der Backup-Operator-Berechtigungen missbraucht, um SAM-, SYSTEM- und SECURITY-Hives remote zu dumpen. Forschungs-Credits gehen an: @filipdragovic Portiert aus @mpgn Windows-PoC Verwendung Dieser Proof of Concept ist ei...

Microsoft Windows 10 19031809 - RPCSS Activation Kernel Security Callback Privilege Escalation

Microsoft Windows 10 19031809 - RPCSS Activation Kernel Security Callback Privilege Escalation Windows: RPCSS Activation Kernel Security Callback EoP Platform: Windows 10 1903/1809 not tested earlier Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User...

Microsoft Windows 10 1809 - 'CmKeyBodyRemapToVirtualForEnum' Arbitrary Key Enumeration Privilege Escalation

Windows: CmKeyBodyRemapToVirtualForEnum Arbitrary Key Enumeration EoP Platform: Windows 10 1809 not tested earlier Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User boundary Summary: The kernel’s Registry Virtualization doesn’t safely open the real key fo...