155 matches found
CVE-2021-36934
CVE-2021-36934 CVE-2021-36934 PowerShell scripts Detection.ps1 This is a quick and dirty script to see if a machine may be vulnerable. It writes out a message to the shell indicating if BUILTIN\Users was detected in the permission list and includes the current permissions on the SAM path for...
ir-rescue
ir-rescue ir-rescue consta de dos scripts hermanos que recopilan una gran cantidad de datos forenses de sistemas Windows de 32 y 64 bits ir-rescue-win y de sistemas Unix ir-rescue-nix. Los scripts respetan el orden de volatilidad y los artefactos que se modifican con la ejecución p. ej. , archivo...
w11_shadow_copies
Copias de Sombra de Windows 11 En Windows 11, la herramienta integrada vssadmin puede listar, eliminar o redimensionar las Copias de Sombra, pero Microsoft eliminó la capacidad de crearlas. Sin embargo, aún se puede hacer interactuando directamente con la API del Servicio de Copias de Sombra de...
vss-fr2system
vss-fr2system Two small tools that turn an arbitrary file read bug on Windows into a SYSTEM shell. vssfreeze/ — creates a Volume Shadow Copy as a standard user , then holds it open so you have time to read the SAM/SECURITY/SYSTEM hives out of it fr2system/ — takes the hives you copied out, decryp...
BlueSAM
BlueSAM BOF Una adaptación de BlueHammer como archivo de objeto Beacon de Cobalt Strike que intenta obtener una copia de la base de datos SAM a través del comportamiento de actualización/VSS de Windows Defender y procesar datos de registro sin conexión desde Beacon. Créditos a BlueHammer de...
CVE-2021-36934
CVE-2021-36934 Uso Detección .\Get-HiveNightmareStatus.ps1 Detección para herramientas de gestión que necesitan salida Verdadero/Falso .\Get-HiveNightmareStatus.ps1 -PostureCheck Remediación For initial SAM fixes and vss removal .\Get-HiveNightmareStatus.ps1 -Remediate Remediate even if the check...
SrHollow
SrHollow LSA secrets extraction, reuse a preexisting VSS shadow copy + inline regf parser + AES-256 LSA decrypt via bcrypt.dll. Chain in 6 steps 1. Enumerate\GLOBAL?? via NtOpenDirectoryObject + NtQueryDirectoryObject. Pick the highest-numbered HarddiskVolumeShadowCopyN. 2. If none exists , fall...
CVE-2021-36934
CVE descrito en MSRC. Remediado usando elementos de configuración de ECM también conocido como SCCM: Consulte los scripts de remediación y detección en el repositorio. El elemento de configuración realiza una verificación booleana de $false para el cumplimiento. Remediación En producción,...
Malicious code in @uipath/vss (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfeb2de2eaeb02a5d8f7ce7edf48891f2dad988fb8fd5ed5b26e7c7118f3c9cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-3586 Malicious code in @uipath/vss (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfeb2de2eaeb02a5d8f7ce7edf48891f2dad988fb8fd5ed5b26e7c7118f3c9cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in thumbi-vss-budhi (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a191520502165f78b7c8dfe2036692d37bcde142a9e3a571f572a3230ec99611 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-135382
Malicious code in thumbi-vss-busdi npm...
EUVD-2025-135408
Malicious code in thumba-vss-budi npm...
EUVD-2025-135385
Malicious code in thumbi-vss-budhi npm...
MAL-2025-179179 Malicious code in thumbi-vss-budi (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3fabf03b69292801a5c5b1fa40eb540b20933d0b673d2dcf8916589e0f2f4ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-135383
Malicious code in thumbi-vss-budi npm...
EUVD-2025-135386
Malicious code in thumbi-vss-budhi npm...
EUVD-2025-135409
Malicious code in thumba-vss-budi npm...
Malicious code in thumbi-vss-budi (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3fabf03b69292801a5c5b1fa40eb540b20933d0b673d2dcf8916589e0f2f4ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...