w11_shadow_copies

Copias de Sombra de Windows 11 En Windows 11, la herramienta integrada vssadmin puede listar, eliminar o redimensionar las Copias de Sombra, pero Microsoft eliminó la capacidad de crearlas. Sin embargo, aún se puede hacer interactuando directamente con la API del Servicio de Copias de Sombra de...

PyNightmare

PyNightmare PoC for CVE-2021-36934 Aka HiveNightmare/SeriousSAM fully written in python3 Explanation CVE-2021-36934 is a recently discovered vulnerability found by @jonasLyk allowing non-admin users to copy all registry hives which contain very private information like hashes which could lead to...

CVE-2021-36934

CVE-2021-36934 CVE-2021-36934 Scripts de PowerShell Detection.ps1 Este es un script rápido y básico para comprobar si una máquina puede ser vulnerable. Escribe un mensaje en la shell indicando si se detectó BUILTIN\Users en la lista de permisos e incluye los permisos actuales en la ruta SAM para...

oxide_hive

Oxide Hive HiveNightmare/SeriousSAM 취약점을 익스플로잇하여 관리자 권한 없이 민감한 데이터가 포함된 레지스트리 하이브를 읽을 수 있게 해주는 도구입니다. 그게 권한 상승처럼 들리지 않는다면 저는 뭐가 권한 상승인지 모르겠군요. 사용법 cargo build로 익스플로잇을 빌드하고 바이너리를 획득한 후, 테스트 환경에 배포하고 CMD를 열어 .\oxidehive max shadow copies를 실행하세요. 섀도 복사본의 기본값은 15입니다. SAM, SECURITY, SYSTEM 하이브가 작업 디렉터...

CVE-2021-36934

CVE descrito en MSRC. Remediado usando elementos de configuración de ECM también conocido como SCCM: Consulte los scripts de remediación y detección en el repositorio. El elemento de configuración realiza una verificación booleana de $false para el cumplimiento. Remediación En producción,...

CVE-2021-36934-HiveNightmare-Lab

CVE-2021-36934 HiveNightmare - Laboratorio Educativo 🎯 Objetivo Reproducir y analizar la vulnerabilidad HiveNightmare en un entorno de laboratorio controlado. 📋 Tabla de Contenidos Descripción de la Vulnerabilidad Implementación Demostración Configuración del Laboratorio y Herramientas Pasos de...

CVE-2024-39708

An issue was discovered in the Agent in Delinea Privilege Manager formerly Thycotic Privilege Manager before 12.0.1096 on Windows. Sometimes, a non-administrator user can copy a crafted DLL file to a temporary directory used by .NET Shadow Copies such that privilege escalation can occur if the co...

CVE-2024-39708

An issue was discovered in the Agent in Delinea Privilege Manager formerly Thycotic Privilege Manager before 12.0.1096 on Windows. Sometimes, a non-administrator user can copy a crafted DLL file to a temporary directory used by .NET Shadow Copies such that privilege escalation can occur if the co...

FakeSG campaign, Akira ransomware and AMOS macOS stealer

Introduction The crimeware landscape is diverse. Cybercriminals try to capitalize on their victims in every possible way by distributing various types of malware designed for different platforms. In recent months, we have written private reports on a wide range of topics, such as new cross-platfo...

New BiBi-Windows Wiper Targets Windows Systems in Pro-Hamas Attacks

Cybersecurity researchers have warned about a Windows version of a wiper malware that was previously observed targeting Linux systems in cyber attacks aimed at Israel. Dubbed BiBi-Windows Wiper by BlackBerry, the wiper is the Windows counterpart of BiBi-Linux Wiper, which has been put to use by a...

Velociraptor 0.7.0 Release: Dig Deeper With Enhanced Client Search, Server Improvements and Expanded VQL Library

Carlos Canto contributed to this article. Rapid7 is thrilled to announce version 0.7.0 of Velociraptor is now LIVE and available for download. The focus of this release was on improving user efficiency while also expanding and strengthening the library of VQL plug-ins and artifacts. Let’s take a...

Mallox Ransomware Exploits Weak MS-SQL Servers to Breach Networks

Mallox ransomware activities in 2023 have witnessed a 174% increase when compared to the previous year, new findings from Palo Alto Networks Unit 42 reveal. "Mallox ransomware, like many other ransomware threat actors, follows the double extortion trend: stealing data before encrypting an...

Ukraine Hit with New Golang-based 'SwiftSlicer' Wiper Malware in Latest Cyber Attack

Ukraine has come under a fresh cyber onslaught from Russia that involved the deployment of a previously undocumented Golang-based data wiper dubbed SwiftSlicer. ESET attributed the attack to Sandworm, a nation-state group linked to Military Unit 74455 of the Main Intelligence Directorate of the...

New Ransomware Mimic Emerges in the Wild, Abusing Legitimate Tool for Faster Encryption

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Mimic is a new ransomware that uses the APIs of a legitimate tool called Everything to encrypt target files and has multiple capabilities such as deleting shadow copies, terminating multiple applications...

Russian Courts Targeted by New CryWiper Data Wiper Malware Posing as Ransomware

A new data wiper malware called CryWiper has been found targeting Russian government agencies, including mayor's offices and courts. "Although it disguises itself as a ransomware and extorts money from the victim for 'decrypting' data, it does not actually encrypt, but purposefully destroys data ...

New Incident Report Reveals How Hive Ransomware Targets Organizations

A recent Hive ransomware attack carried out by an affiliate involved the exploitation of "ProxyShell" vulnerabilities in the Microsoft Exchange Server that were disclosed last year to encrypt an unnamed customer's network. "The actor managed to achieve its malicious goals and encrypt the...

Multi-Ransomwared Victims Have It Coming–Podcast

You hate to blame the victim, but the fact of the matter is that businesses are just asking to get whacked with ransomware multiple times. A recent study of IT leaders from cloud-native network detection and response firm ExtraHop shows that businesses aren’t even aware of the “attack me,” “easy...

RangnarLocker Ransomware hits Critical Infrastructure Compromising 50+ Organizations

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here The Federal Bureau of Investigation FBI has released an alert on Ragnarlocker campaign that has affected nearly 52 organizations encompassing 10 critical infrastructure sectors, including entities in significant manufacturing,...

The Chaos Ransomware Can Be Ravaging

The Qualys Research Team has observed a new version of Chaos ransomware in development. This blog reviews the malware’s updated functionality as well as its ongoing evolution. A ransomware builder called Chaos is still actively under development. The fourth version has recently been observed bein...

Veeam Best Practices regarding CVE-2021-36934

Challenge This article documents Veeam's position on Windows Elevation of Privilege Vulnerability CVE-2021-36934. Specifically regarding the listed mitigation steps involving removal of all shadow copies, and the "Impact of workaround" mentioned in the Workarounds section of CVE-2021-36934...