go-secdump

go-secdump Description Package go-secdump is a tool built to remotely extract hashes from the SAM registry hive as well as LSA secrets and cached hashes from the SECURITY hive without any remote agent and without touching disk. The tool is built on top of the library go-smb and use it to...

backup_dc_registry

Backup Operator Registry Backup to Domain Compromise A simple POC that abuses Backup Operator privileges to remote dump SAM, SYSTEM, and SECURITY hives. Research credit to: @filipdragovic Ported from @mpgn Windows PoC Usage This proof of concept is a modified version of impacket/examples/reg.py a...

CVE-2021-36934-HiveNightmare-Lab

CVE-2021-36934 HiveNightmare - Educational Lab 🎯 Objective Reproduce and analyze the HiveNightmare vulnerability in a controlled lab environment. 📋 Table of Contents Vulnerability Description Implementation Demonstration Lab Setup & Tools Exploitation Steps Mitigation Measures Demonstration...

Microsoft Windows 10 19031809 - RPCSS Activation Kernel Security Callback Privilege Escalation

Microsoft Windows 10 19031809 - RPCSS Activation Kernel Security Callback Privilege Escalation Windows: RPCSS Activation Kernel Security Callback EoP Platform: Windows 10 1903/1809 not tested earlier Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User...

Microsoft Windows 10 1809 - 'CmKeyBodyRemapToVirtualForEnum' Arbitrary Key Enumeration Privilege Escalation

Windows: CmKeyBodyRemapToVirtualForEnum Arbitrary Key Enumeration EoP Platform: Windows 10 1809 not tested earlier Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User boundary Summary: The kernel’s Registry Virtualization doesn’t safely open the real key fo...