HiveNightmare / SeriousSAM Local Privilege Escalation in Windows

This repository is a compact malicious DLL proxy/sideloading implant rather than a traditional memory-corruption exploit. It contains three files: a README, a module-definition file (7z.def), and the main code file misleadingly named 7z.dll but shown here as C source. The .def file exports the same symbols a legitimate 7-Zip library would expose, allowing the DLL to masquerade as the real 7z.dll. In DllMain, the code loads the legitimate backing DLL, resolves the expected exports with GetProcAddress, and preserves host functionality. Separately, on first load it spawns a thread that executes embedded raw x64 shellcode. The shellcode contains clear WinINet-related artifacts, including the string "wininet", a realistic browser User-Agent string, a hardcoded IP address 172.16.179.139, port 6683, and a long URI-like path. This strongly indicates outbound network communication for command-and-control, staging, or payload retrieval. Because the payload is embedded and hardcoded rather than operator-configurable, the maturity is best classified as OPERATIONAL. Despite the README referencing CVE-2021-36934, the code itself is best understood as a DLL hijacking/sideloading payload used for post-compromise execution or DFIR demonstration. There is no evidence of vulnerability discovery or exploitation logic for HiveNightmare itself; instead, the repository provides a malicious 7z.dll that gains execution when loaded by a susceptible Windows application or workflow.

This repository is a comprehensive red/purple team framework for simulating fileless malware attacks exploiting the HiveNightmare (CVE-2021-36934) vulnerability on Windows 10/11. The structure includes C++ source code for DLLs that perform registry hive extraction, privilege escalation, and file wiping, as well as PowerShell and batch scripts for payload delivery, persistence, and lateral movement. The exploit demonstrates end-to-end attack chains using Living Off the Land Binaries (LOLBins) such as rundll32.exe, certutil.exe, and powershell.exe to achieve stealthy, in-memory execution and persistence. The code includes mechanisms for fetching and executing shellcode from remote HTTP servers, creating admin users, and establishing persistence via registry keys. The repository also contains lab simulation scripts, detection and mitigation guidance, and references to MITRE ATT&CK techniques. Notable endpoints include Windows registry hives, local and network file paths, registry autorun keys, and remote HTTP/S shares. The exploit is operational and can be used to emulate real-world adversary behavior for detection and response training in controlled environments.

This repository contains a Python proof-of-concept exploit for CVE-2021-36934 (HiveNightmare/SeriousSAM), which affects Windows 10 systems with System Protection enabled. The exploit script, PyNightmare.py, attempts to copy the SYSTEM and SAM registry hive files from all available Volume Shadow Copies to the C:\temp directory. These hives contain sensitive information, such as password hashes, which can be used for privilege escalation. The exploit operates locally and requires access to the target file system. The repository consists of the main exploit script and a README file explaining the vulnerability and usage.

This repository contains a single Metasploit post-exploitation module targeting the HiveNightmare (SeriousSAM) vulnerability (CVE-2021-36934) in Windows 10 and 11. The module exploits misconfigured permissions on the SAM and SYSTEM registry hives, which can be accessed via Volume Shadow Copy. The exploit requires a Meterpreter session on the target system. It iterates through available shadow copies, attempts to open and read the SAM and SYSTEM files, and saves them as loot for later offline password hash extraction (e.g., with secretsdump.py). The main file is written in Ruby and leverages Metasploit's Railgun API to interact with Windows file handles. The attack vector is local post-exploitation, and the main fingerprintable endpoints are the file paths to the SAM and SYSTEM hives within shadow copies.

This repository provides a working exploit for CVE-2021-36934 (SeriousSAM), a local privilege escalation vulnerability affecting certain Windows 10/11 builds. The main exploit is implemented in Nim (src/ShadowSteal.nim), with a Python script (ShadowSteal.py) to automate Docker-based building of the Windows payload. The exploit works by enumerating available shadow copies on the local system and attempting to access the SAM, SYSTEM, and SECURITY registry hives via the Win32 device namespace. If accessible, these files are exfiltrated and compressed into a zip archive for offline credential extraction. The exploit supports multiple modes (triage, bruteforce) for enumeration thoroughness. The attack vector is local, requiring code execution on the target system. The main fingerprintable endpoints are the shadow copy device paths for the registry hives. The repository is well-structured, with clear build instructions and usage documentation, and is operational for real-world exploitation of the SeriousSAM vulnerability.

This repository is an unfinished proof-of-concept exploit for CVE-2021-36934 (SeriousSAM/HiveNightmare), a privilege escalation vulnerability affecting Microsoft Windows. The main script, 'workinprogress.py', automates the process of extracting the SAM, SYSTEM, and SECURITY registry hives using an external HiveNightmare binary, then uses a compiled secretsdump utility to extract password hashes. The script then sends the extracted hash to a remote hashcat API (endpoint: https://HOST.ngrok.io/hashcat.php) for rapid cracking. The cracked administrator password is saved to a text file named after the username. The exploit requires the presence of external binaries (nightmare.exe and dump.exe) and access to a hashcat API. The README provides context and requirements, including a link to the hashcat API project. The attack vector is local, requiring code execution on a vulnerable Windows system. The repository is a work in progress and not fully automated, but demonstrates the core logic for exploiting the vulnerability and extracting credentials.

This repository contains a proof-of-concept (PoC) exploit for CVE-2021-36934 (HiveNightmare/SeriousSAM), a privilege escalation vulnerability in Microsoft Windows. The exploit is implemented in C++ and consists of a Visual Studio project with the main logic in 'Find.cpp' and the entry point in 'VSSCopy.cpp'. The tool, when executed, enumerates all accessible Volume Shadow Copies on the system and attempts to copy the SYSTEM, SAM, and SECURITY registry hives from each shadow copy to a user-specified directory. These hives can then be analyzed offline to extract sensitive information such as password hashes. The exploit requires local access to a vulnerable Windows system. No network endpoints are involved; all actions are performed locally via file system access. The repository is structured as a standard Visual Studio C++ project, with supporting files for project configuration and a brief README describing usage and credits.

This repository contains a Rust-based exploit for the HiveNightmare/SeriousSAM vulnerability (CVE-2021-36934) affecting certain versions of Microsoft Windows. The exploit leverages improper access permissions on Volume Shadow Copies to read sensitive registry hives (SAM, SECURITY, SYSTEM) without administrative privileges. The main code is in 'src/main.rs', which searches through available shadow copies for the target hives and copies them to the current working directory as '.dump' files. These files can then be used with tools like 'secretsdump.py' to extract NTLM password hashes, enabling further privilege escalation. The exploit is a local privilege escalation proof-of-concept and does not require network access. The repository is structured as a simple Rust project with a single main source file, a README with usage instructions, and standard project files.

This repository is a proof-of-concept (POC) exploit for CVE-2021-36934, also known as HiveNightmare or SeriousSAM, which affects Microsoft Windows. The exploit leverages the Volume Shadow Copy Service (VSS) to access sensitive system files (such as the SAM, SYSTEM, and SECURITY hives) that are normally protected. The repository is structured as a Visual Studio C++ project, with the main code likely residing in 'poc_CVE-2021-36934.cpp' (not included in the provided content, but referenced in the project files). Supporting files include utility functions for file and path checking, as well as Windows and VSS-specific headers. The exploit is local-only and does not target network endpoints. Its primary purpose is to demonstrate unauthorized access to protected files via VSS, which can be used for privilege escalation. The code is a POC and does not include a weaponized or customizable payload.

This repository provides a proof-of-concept (POC) exploit for CVE-2021-36934, a privilege escalation vulnerability in Microsoft Windows. The vulnerability allows low-privileged users to read sensitive registry hives (SAM, SECURITY, SYSTEM) from Volume Shadow Copies due to improper access control. The main exploit is implemented in C++ (CVE-2021-36934.cpp) and attempts to brute-force accessible shadow copy indices, copying the registry hives to C:\Windows\Temp if found. The repository includes Visual Studio project files for building the exploit. The README demonstrates how to use the extracted files with tools like secretsdump.py to obtain credentials. The exploit is local-only and does not provide remote access or a shell, but enables offline credential extraction by copying sensitive files to a location accessible by the attacker.

This repository contains a PowerShell-based proof-of-concept exploit for CVE-2021-36934 (HiveNightmare), targeting Windows 10 version 1809 or newer. The main script, Invoke-HiveNightmare.ps1, allows a standard user to extract the SAM, SOFTWARE, and SYSTEM registry hives from available Volume Shadow Copies, saving them to a specified or default directory (user's Desktop). The exploit leverages excessive permissions on registry hives in certain Windows versions, enabling offline credential extraction if Volume Shadow Copies exist. The repository consists of the exploit script and a README.md providing context, usage examples, and credits. No network or remote attack vector is present; exploitation is purely local.

This repository provides a PowerShell-based exploit and remediation toolkit for CVE-2021-36934 (HiveNightmare/SeriousSAM), a privilege escalation vulnerability in Microsoft Windows 10 and 11. The main script, Get-HiveNightmareStatus.ps1, can detect if a system is vulnerable by checking permissions on the SAM registry hive and the presence of Volume Shadow Copy snapshots. If the -Exploit flag is used, the script attempts to copy the SAM file from available shadow copies to the user's Documents directory, enabling offline credential extraction. The script also supports remediation by resetting permissions and deleting VSS snapshots. The repository includes an XML file for PDQ Inventory integration (for vulnerability scanning), a code-signing script, and a sample policy override configuration. The exploit is local and requires administrative privileges for full functionality. Key fingerprintable endpoints include the SAM file path, shadow copy device paths, and the output file location.

This repository contains a PowerShell script (serioussam.ps1) and a README describing the HiveNightmare/SeriousSam local privilege escalation vulnerability (CVE-2021-36934) affecting certain versions of Microsoft Windows. The script checks if the SAM file in the Windows system directory is readable by non-administrative users, indicating a vulnerable system. If vulnerable, it prompts the user for the number of Volume Shadow Copies and attempts to copy the SAM and SYSTEM registry hives from each shadow copy to the current working directory. These files can then be used for offline password hash extraction, potentially leading to privilege escalation. The exploit is a proof-of-concept for local exploitation and does not provide a weaponized or automated privilege escalation payload, but rather facilitates the extraction of sensitive files for further attack steps.

This repository is a C# implementation of an exploit for CVE-2021-36934 (HiveNightmare/SeriousSAM), a privilege escalation vulnerability in Microsoft Windows. The exploit targets improper access control on registry hive files (SAM, SYSTEM, SECURITY) in Volume Shadow Copies, allowing non-administrative users to read sensitive data. The main entry point is Program.cs, which searches for accessible shadow copies, copies the registry hives to a temporary directory, and uses custom C# classes (in the HiveParser directory) to parse and extract password hashes and LSA secrets. The exploit is operational and provides direct credential extraction from vulnerable systems. No network endpoints are involved; all actions are performed locally on the target system. The codebase is well-structured, with separate classes for registry parsing and cryptographic operations, and is intended for use on Windows platforms affected by CVE-2021-36934.