30 matches found
CVE-2021-36934
CVE-2021-36934 CVE-2021-36934 PowerShell Fix This powershell script fixes CVE-2021-36934, based on the original script of Joran Slingerland https://github.com/JoranSlingerland https://github.com/JoranSlingerland/CVE-2021-36934/blob/main/CVE-2021-36934.ps1 The Powershell script will do following:...
SeriousSam
Windows Elevation of Privilege Vulnerability CVE-2021-36934 SeriousSAM Description see MS article: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934 To deploy the workaround via GPO Copy paste the below commands in notepad, save as a batch file .bat extension and then use to pu...
poc_CVE-2021-36934
pocCVE-2021-36934 POC experiments with Volume Shadow copy Service VSS...
Invoke-HiveDreams
Invoke-HiveDreams A capability to identify and remediate CVE-2021-36934 HiveNightmare...
CVE-2021-36934
CVE-2021-36934 CVE-2021-36934 PowerShell scripts Detection.ps1 This is a quick and dirty script to see if a machine may be vulnerable. It writes out a message to the shell indicating if BUILTIN\Users was detected in the permission list and includes the current permissions on the SAM path for...
VSSCopy
VSSCopy Small and dirty PoC for CVE-2021-36934 Usage: VSSCopy.exe C:\temp Credits: https://twitter.com/jonasLyk https://twitter.com/gentilkiwi...
Serious-Sam---CVE-2021-36934-Mitigation-for-Datto-RMM
Overview This is a Datto RMM component to mitigate CVE-2021-36934, aka Serious SAM. It follows the mitigation measures outlined at: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934 https://kb.cert.org/vuls/id/506989 USE AT YOUR OWN RISK. EXPECT THIS TO BREAK SOME BACKUPS...
CVE-2021-36934
CVE-2021-36934 Fix for the CVE-2021-36934 Script will run and check if your system is affected and then apply the fix...
Invoke-HiveNightmare
Invoke-HiveNightmare PowerShell-based PoC for CVE-2021-36934, which enables a standard user to be able to retrieve the SAM, Security, and Software Registry hives in Windows 10 version 1809 or newer. Situation In specific versions of Windows 10, standard users have read/execute rights to files in...
SeriousSam
SeriousSam HiveNightmare a.k.a. SeriousSam Local Privilege Escalation in Windows – CVE-2021-36934...
CVE-2021-36934
CVE described on MSRC. Remediated using ECM aka SCCM Config Items: See the remediation and Discovery scripts in repo. Config Item does a boolean $false check for compliance. Remediation In production, we found the need to remediate purge copies other than ClientAccessible ones; we've seen Backup...
CVE-2021-36934
CVE-2021-36934 HiveNightmare aka SeriousSAM...
CVE-2021-36934-DLL-Hijacking-DFIR-Investigation
" CVE-2021-36934-DLL-Hijacking-DFIR-Investigation"...
VulnCheck KEV: CVE-2021-36934
If a Volume Shadow Copy VSS shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level...
Metasploit Wrap-Up
New Olympic Discipline: Hive Hunting This week, community contributor Hakyac added a new Olympic discipline to Metasploit exploit sport category, which is based on the work of community security researchers @jonasLyk and Kevin Beaumont. The rules are simple: You need to abuse a flaw in Windows 10...
How to Mitigate Microsoft Windows 10, 11 SeriousSAM Vulnerability
Microsoft Windows 10 and Windows 11 users are at risk of a new unpatched vulnerability that was recently disclosed publicly. As we reported last week, the vulnerability — SeriousSAM — allows attackers with low-level permissions to access Windows system files to perform a Pass-the-Hash and...
Exploit for CVE-2021-36934
CVE-2021-36934 !Screenshothttps://github...
Exploit for CVE-2021-36934
PyNightmare PoC for CVE-2021-36934 Aka HiveNightmare/SeriousSA...
Microsoft Issues Windows 10 Workaround Fix for ‘SeriousSAM’ Bug
A privilege escalation bug, affecting versions of Windows 10, received a workaround fix by Microsoft Wednesday to prevent attackers from accessing data and creating new accounts on compromised systems. The bug, dubbed SeriousSAM, affects the Security Accounts Manager SAM database in all versions ...