SrHollow

SrHollow LSA secrets extraction, reuse a preexisting VSS shadow copy + inline regf parser + AES-256 LSA decrypt via bcrypt.dll. Chain in 6 steps 1. Enumerate\GLOBAL?? via NtOpenDirectoryObject + NtQueryDirectoryObject. Pick the highest-numbered HarddiskVolumeShadowCopyN. 2. If none exists , fall...

Windows Backup SAM and SYSTEM (VSS)

Create a VSS shadow copy and copy SAM/SYSTEM registry hives or NTDS.dit and SYSTEM on domain controllers to a remote directory, then download the files through the current session. !/usr/bin/env python3 -- coding: utf-8 -- """ Backup SAM and SYSTEM hives or NTDS.dit + SYSTEM on domain controllers...

Microsoft Windows 10 gives unprivileged user access to system32\config files

Overview Multiple versions of Windows 10 grant non-administrative users read access to files in the %windir%\system32\config directory. This can allow for local privilege escalation LPE. Description With multiple versions of Windows 10, the BUILTIN\Users group is given RX permissions to files in...