155 matches found
vss-fr2system
vss-fr2system Two small tools that turn an arbitrary file read bug on Windows into a SYSTEM shell. vssfreeze/ — creates a Volume Shadow Copy as a standard user , then holds it open so you have time to read the SAM/SECURITY/SYSTEM hives out of it fr2system/ — takes the hives you copied out, decryp...
BlueSAM
BlueSAM BOF A Cobalt Strike Beacon Object File adaptation of BlueHammer that attempts to obtain a copy of the SAM database through Windows Defender update/VSS behavior and process offline registry data from Beacon. Credits to Nightmare-Eclipse's BlueHammer...
CVE-2021-36934
CVE-2021-36934 CVE-2021-36934 PowerShell scripts Detection.ps1 This is a quick and dirty script to see if a machine may be vulnerable. It writes out a message to the shell indicating if BUILTIN\Users was detected in the permission list and includes the current permissions on the SAM path for...
ir-rescue
ir-rescue ir-rescue is composed of two sister scripts that collect a myriad of forensic data from 32-bit and 64-bit Windows systems ir-rescue-win and from Unix systems ir-rescue-nix. The scripts respect the order of volatility and artifacts that are changed with the execution e.g. , prefetch file...
w11_shadow_copies
Windows 11 Shadow Copies On Windows 11, the built-in vssadmin can list, delete or resize Shadow Copies, but Microsoft removed the ability to create them. However, you can still do it by interacting directly with the Volume Shadow Copy Service VSS API, which I already used in my other tool SAMDump...
CVE-2021-36934
CVE-2021-36934 Usage Detection .\Get-HiveNightmareStatus.ps1 Detection for management tools that need True/False output .\Get-HiveNightmareStatus.ps1 -PostureCheck Remediation For initial SAM fixes and vss removal .\Get-HiveNightmareStatus.ps1 -Remediate Remediate even if the checks say healthy o...
SrHollow
SrHollow LSA secrets extraction, reuse a preexisting VSS shadow copy + inline regf parser + AES-256 LSA decrypt via bcrypt.dll. Chain in 6 steps 1. Enumerate\GLOBAL?? via NtOpenDirectoryObject + NtQueryDirectoryObject. Pick the highest-numbered HarddiskVolumeShadowCopyN. 2. If none exists , fall...
CVE-2021-36934
CVE described on MSRC. Remediated using ECM aka SCCM Config Items: See the remediation and Discovery scripts in repo. Config Item does a boolean $false check for compliance. Remediation In production, we found the need to remediate purge copies other than ClientAccessible ones; we've seen Backup...
Malicious code in @uipath/vss (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfeb2de2eaeb02a5d8f7ce7edf48891f2dad988fb8fd5ed5b26e7c7118f3c9cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-3586 Malicious code in @uipath/vss (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfeb2de2eaeb02a5d8f7ce7edf48891f2dad988fb8fd5ed5b26e7c7118f3c9cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in thumbi-vss-budhi (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a191520502165f78b7c8dfe2036692d37bcde142a9e3a571f572a3230ec99611 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-135385
Malicious code in thumbi-vss-budhi npm...
EUVD-2025-135408
Malicious code in thumba-vss-budi npm...
EUVD-2025-135382
Malicious code in thumbi-vss-busdi npm...
MAL-2025-179179 Malicious code in thumbi-vss-budi (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3fabf03b69292801a5c5b1fa40eb540b20933d0b673d2dcf8916589e0f2f4ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-135383
Malicious code in thumbi-vss-budi npm...
Malicious code in thumbi-vss-budi (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3fabf03b69292801a5c5b1fa40eb540b20933d0b673d2dcf8916589e0f2f4ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-135384
Malicious code in thumbi-vss-budi npm...