40 matches found
VulnCheck KEV: CVE-2021-36934
If a Volume Shadow Copy VSS shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level...
Security Bulletin: IBM Storage Support for Microsoft Volume Shadow Copy Service (VSS) and Virtual Disk Service (VDS) is affected by a vulnerability in Apache Log4j (CVE-2021-4104)
Summary A vulnerability was identified within the Apache Log4j library that is used by IBM Storage Support for Microsoft Volume Shadow Copy Service VSS and Virtual Disk Service VDS for IBM Spectrum Virtualize family and IBM DS8000 family storage systems. This vulnerability has been addressed...
Conti Ransomware
Conti is a sophisticated Ransomware-as-a-Service RaaS model first detected in December 2019. Since its inception, its use has grown rapidly and has even displaced the use of other RaaS tools like Ryuk. The Cybersecurity and Infrastructure Security Agency CISA and the Federal Bureau of Investigati...
Windows SAM secrets leak - HiveNightmare
Due to mismanagement of SAM and SYSTEM hives in Windows 10, it is possible for an unprivileged user to read those files. But, as they are locked while Windows is running we are not able to read them directly. The trick is to take advantage of Volume Shadow Copy, which is generally enabled, to...
IRTriage - Incident Response Triage - Windows Evidence Collection For Forensic Analysis
Scripted collection of system information valuable to a Forensic Analyst. IRTriage will automatically "Run As ADMINISTRATOR" in all Windows versions except WinXP. The original source was Triage-ir v0.851 an Autoit script written by Michael Ahrendt. Unfortunately Michael's last changes were posted...
How to Use VSSTrace to Collect VSS Diagnostic Logging
Challenge This article explains how to collect additional VSS diagnostic data with the VSSTrace tool, a Microsoft Windows Software Development Kit SDK component. Cause Veeam products use Microsoft Volume Shadow Copy Service VSS for various tasks. Sometimes it is necessary to go through the...
March 22, 2018—KB4088889 (OS Build 14393.2155)
None None...
Cannot find anymore diff area candidates for volume
Challenge Backup or replication of a Windows OS fails. In the Windows event logs of the machine being backed up, there is an error with ID 8193 from source VSS: Volume Shadow Copy Service error: Unexpected error calling routine Cannot find anymore diff area candidates for volume...
Latest TeslaCrypt Targets New File Extensions, Invests Heavily in Evasion
TeslaCrypt, like many of its ransomware cousins, doesn’t sleep on past success. Researchers at Endgame Inc., have found two updates for the cryptoransomware in the past two weeks that invest heavily in obfuscation and evasion techniques, and also target a host of new file extensions. These sample...
Windows Domain Controller Hashdump
This module attempts to copy the NTDS.dit database from a live Domain Controller and then parse out all of the User Accounts. It saves all of the captured password hashes, including historical ones. This module requires Metasploit: https://metasploit.com/download Current source:...
Using the Diskshadow Utility to Manually Test VSS Operations
Windows Server Required This article documents how to use Diskshadow , which is only available in Server versions of Windows 2008+. Purpose This article documents how to manually create a volume shadow copy using the Diskshadow command-line utility in Windows. Cause Veeam products use the Microso...
Persistent Payload In Windows Volume Shadow Copy
This Metasploit module will attempt to create a persistent payload in a new volume shadow copy. This is based on the VSSOwn Script originally posted by Tim Tomes and Mark Baggett. This Metasploit module has been tested successfully on Windows 7. In order to achieve persistence through the RUNKEY...
Persistent Payload In Windows Volume Shadow Copy
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' require 'msf/core/exploit/exe' class...
Persistent Payload in Windows Volume Shadow Copy
This module will attempt to create a persistent payload in a new volume shadow copy. This is based on the VSSOwn Script originally posted by Tim Tomes and Mark Baggett. This module has been tested successfully on Windows 7. In order to achieve persistence through the RUNKEY option, the user shoul...
0x80042327 or Error: VSSControl: -2147212505
Challenge You receive the following error on backup or replication processes during VSS guest processing: 0x80042327 or Error: VSSControl: -2147212505 Solution 0x80042327 translates to the VSS error "VSSEREBOOTREQUIRED". This error is reflecting that the system is pending reboot due to an...
PsExec NTDS.dit And SYSTEM Hive Download Utility
This module authenticates to an Active Directory Domain Controller and creates a volume shadow copy of the %SYSTEMDRIVE%. It then pulls down copies of the ntds.dit file as well as the SYSTEM hive and stores them. The ntds.dit and SYSTEM hive copy can be used in combination with other tools for...
[smbexec] A rapid psexec style attack with samba tools
smbexec A rapid psexec style attack with samba tools Original Concept and Script by PureHate & Brav0Hax Codename - Diamond in the Rough Gonna pha-q up - PurpleTeam Smash! Written because we got sick of Metasploit PSExec getting popped Special thanks to Carnal0wnage who's blog inspired us to go th...
Windows Manage Mount Shadow Copy
This module will attempt to mount a Volume Shadow Copy on the system. This is based on the VSSOwn Script originally posted by Tim Tomes and Mark Baggett. Works on win2k3 and later...