164 matches found
CVE-2021-36934
CVE-2021-36934 Usage Detection .\Get-HiveNightmareStatus.ps1 Detection for management tools that need True/False output .\Get-HiveNightmareStatus.ps1 -PostureCheck Remediation For initial SAM fixes and vss removal .\Get-HiveNightmareStatus.ps1 -Remediate Remediate even if the checks say healthy o...
SrHollow
SrHollow LSA secrets extraction, reuse a preexisting VSS shadow copy + inline regf parser + AES-256 LSA decrypt via bcrypt.dll. Chain in 6 steps 1. Enumerate\GLOBAL?? via NtOpenDirectoryObject + NtQueryDirectoryObject. Pick the highest-numbered HarddiskVolumeShadowCopyN. 2. If none exists , fall...
vss-fr2system
vss-fr2system Two small tools that turn an arbitrary file read bug on Windows into a SYSTEM shell. vssfreeze/ — creates a Volume Shadow Copy as a standard user , then holds it open so you have time to read the SAM/SECURITY/SYSTEM hives out of it fr2system/ — takes the hives you copied out, decryp...
SAMDump
SAMDump Extracts Windows SAM and SYSTEM files using Volume Shadow Copy Service VSS with multiple exfiltration options and XOR obfuscation: Lists Volume Shadow Copies using VSS and creates one if necessary Extracts SAM and SYSTEM files from the Shadow Copy Uses NT API calls for file operations...
BlueSAM
BlueSAM BOF A Cobalt Strike Beacon Object File adaptation of BlueHammer that attempts to obtain a copy of the SAM database through Windows Defender update/VSS behavior and process offline registry data from Beacon. Credits to Nightmare-Eclipse's BlueHammer...
CVE-2021-36934
CVE described on MSRC. Remediated using ECM aka SCCM Config Items: See the remediation and Discovery scripts in repo. Config Item does a boolean $false check for compliance. Remediation In production, we found the need to remediate purge copies other than ClientAccessible ones; we've seen Backup...
CVE-2021-36934
CVE-2021-36934 CVE-2021-36934 PowerShell scripts Detection.ps1 This is a quick and dirty script to see if a machine may be vulnerable. It writes out a message to the shell indicating if BUILTIN\Users was detected in the permission list and includes the current permissions on the SAM path for...
ir-rescue
ir-rescue ir-rescue is composed of two sister scripts that collect a myriad of forensic data from 32-bit and 64-bit Windows systems ir-rescue-win and from Unix systems ir-rescue-nix. The scripts respect the order of volatility and artifacts that are changed with the execution e.g. , prefetch file...
vss-ctx-rag (>=0.5.0, <=0.5.1) potentially affected by unknown CVE via langchain-nvidia-ai-endpoints (0.3.7)
langchain-nvidia-ai-endpoints PYPI version 0.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-nvidia-ai-endpoints and may be impacted: - vss-ctx-rag =0.5.0, =0.5.1 Source cves: unknown CVE Source advisory: OSV:GHSA-G28H-2CMM-RJ9X...
Windows Backup SAM and SYSTEM (VSS)
Create a VSS shadow copy and copy SAM/SYSTEM registry hives or NTDS.dit and SYSTEM on domain controllers to a remote directory, then download the files through the current session. !/usr/bin/env python3 -- coding: utf-8 -- """ Backup SAM and SYSTEM hives or NTDS.dit + SYSTEM on domain controllers...
Malicious code in @uipath/vss (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfeb2de2eaeb02a5d8f7ce7edf48891f2dad988fb8fd5ed5b26e7c7118f3c9cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-3586 Malicious code in @uipath/vss (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfeb2de2eaeb02a5d8f7ce7edf48891f2dad988fb8fd5ed5b26e7c7118f3c9cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in thumbi-vss-busdi (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43f9d6ab4157b171560a40bce91a05930d9c42feeebefe9e306ba51139f7adc5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-135408
Malicious code in thumba-vss-budi npm...
EUVD-2025-135381
Malicious code in thumbi-vss-busdi npm...
Malicious code in thumbi-vss-budi (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3fabf03b69292801a5c5b1fa40eb540b20933d0b673d2dcf8916589e0f2f4ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-135384
Malicious code in thumbi-vss-budi npm...
MAL-2025-179179 Malicious code in thumbi-vss-budi (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3fabf03b69292801a5c5b1fa40eb540b20933d0b673d2dcf8916589e0f2f4ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...