CVE-2021-36934

CVE-2021-36934 Utilizzo Rilevamento root@kitploit: .\Get-HiveNightmareStatus.ps1 Rilevamento per strumenti di gestione che richiedono output True/False root@kitploit: .\Get-HiveNightmareStatus.ps1 -PostureCheck Correzione root@kitploit: For initial SAM fixes and vss removal...

vss-fr2system

vss-fr2system Due piccoli strumenti che trasformano un bug di lettura arbitraria di file su Windows in una shell SYSTEM. vssfreeze/ — crea una Volume Shadow Copy come utente standard , poi la tiene aperta così hai tempo di leggere gli hive SAM/SECURITY/SYSTEM al suo interno fr2system/ — prende gl...

ir-rescue

ir-rescue ir-rescue è composto da due script gemelli che raccolgono una miriade di dati forensi da sistemi Windows a 32 e 64 bit ir-rescue-win e da sistemi Unix ir-rescue-nix. Gli script rispettano l'ordine di volatilità e gli artefatti che vengono modificati con l'esecuzione ad es. , file prefet...

CVE-2021-36934

CVE-2021-36934 CVE-2021-36934 scripts PowerShell Detection.ps1 Este é um script rápido e simples para verificar se uma máquina pode estar vulnerável. Escreve uma mensagem no shell a indicar se BUILTIN\Users foi detetado na lista de permissões e inclui as permissões atuais no caminho do SAM para...

CVE-2021-36934

CVE beschrieben im MSRC. Behoben unter Verwendung von ECM aka SCCM Konfigurationselementen: Siehe die Remediierungs- und Erkennungsskripte im Repository. Das Konfigurationselement führt für die Compliance eine boolesche $false-Prüfung durch. Behebung Im Produktionsbetrieb haben wir festgestellt,...

BlueSAM

BlueSAM BOF Eine Cobalt Strike Beacon Object File-Adaption von BlueHammer, die versucht, eine Kopie der SAM-Datenbank über Windows Defender Update/VSS-Verhalten zu erhalten und Offline-Registrierungsdaten von Beacon zu verarbeiten. Credits an Nightmare-Eclipse's BlueHammer...

w11_shadow_copies

Copie Shadow di Windows 11 In Windows 11, il vssadmin integrato può elencare, eliminare o ridimensionare le Copie Shadow, ma Microsoft ha rimosso la possibilità di crearle. Tuttavia, è ancora possibile farlo interagendo direttamente con l'API del Volume Shadow Copy Service VSS, che ho già...

Malicious code in @uipath/vss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfeb2de2eaeb02a5d8f7ce7edf48891f2dad988fb8fd5ed5b26e7c7118f3c9cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-3586 Malicious code in @uipath/vss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfeb2de2eaeb02a5d8f7ce7edf48891f2dad988fb8fd5ed5b26e7c7118f3c9cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in thumbi-vss-budhi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a191520502165f78b7c8dfe2036692d37bcde142a9e3a571f572a3230ec99611 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-135382

Malicious code in thumbi-vss-busdi npm...

EUVD-2025-135385

Malicious code in thumbi-vss-budhi npm...

EUVD-2025-135408

Malicious code in thumba-vss-budi npm...

MAL-2025-179179 Malicious code in thumbi-vss-budi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3fabf03b69292801a5c5b1fa40eb540b20933d0b673d2dcf8916589e0f2f4ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-135384

Malicious code in thumbi-vss-budi npm...

EUVD-2025-135383

Malicious code in thumbi-vss-budi npm...

EUVD-2025-135386

Malicious code in thumbi-vss-budhi npm...

EUVD-2025-135409

Malicious code in thumba-vss-budi npm...

Malicious code in thumbi-vss-budi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3fabf03b69292801a5c5b1fa40eb540b20933d0b673d2dcf8916589e0f2f4ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in thumba-vss-budi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cee136da6640db075ebbb3ec4bf2b249a7b779ad4267711dbba3022b9eb56c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...