SrHollow

SrHollow Extracción de secretos LSA, reutilización de una copia de sombra VSS preexistente + parser regf en línea + descifrado AES-256 de LSA mediante bcrypt.dll. Cadena en 6 pasos 1. Enumerar\GLOBAL?? mediante NtOpenDirectoryObject + NtQueryDirectoryObject. Elegir el HarddiskVolumeShadowCopyN co...

Microsoft Windows 10 gives unprivileged user access to system32\config files

Overview Multiple versions of Windows 10 grant non-administrative users read access to files in the %windir%\system32\config directory. This can allow for local privilege escalation LPE. Description With multiple versions of Windows 10, the BUILTIN\Users group is given RX permissions to files in...