HighExploited in the wildCISA KEVPublic exploitVulnerability

CVE-2021-36934

HiveNightmare / SeriousSAM

Published Jul 22, 2021 · Updated 8 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVSS7.8High · v3.1

EPSS67.3%99th percentile

CISA KEVYesAdded Feb 10, 2022

In the wildActiveExploitation observed

Vendor: Microsoft Corporation

IdentifiersCVE-2021-36934CWE-1220

Also known ashivenightmareserioussam

CVE-2021-36934 is a local privilege-escalation vulnerability in Microsoft Windows caused by overly permissive access control lists on sensitive system files, including the Security Accounts Manager database and other registry hives. A standard user can retrieve vulnerable hive copies from existing Volume Shadow Copies, bypassing the file locks that prevent direct copying of live hives. The exposed information can enable credential theft and arbitrary code execution with SYSTEM privileges. Affected Windows 10 versions include version 1809 and newer.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

A local authenticated attacker can obtain sensitive registry data, including password hashes, DPAPI keys, and machine account credentials. Successful exploitation can lead to SYSTEM-level code execution, installation of programs, viewing, modification or deletion of data, and creation of accounts with full user rights. Stolen credentials can also support further lateral movement.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, correct the ACLs on the directory containing the sensitive system registry hives from an elevated prompt and delete existing vulnerable VSS shadow copies. Verify that the shadow copies have been deleted. Deletion affects System Restore and other features that depend on shadow copies.

Remediation

Patch, then assume compromise.

Apply the Microsoft security update for CVE-2021-36934, then manually delete all existing shadow copies containing vulnerable system files, including the SAM database. Installing the update alone does not fully mitigate the vulnerability because previously created shadow copies remain exposed. Follow Microsoft's KB5005357 guidance for deleting Volume Shadow Copies.

Public exploits

Exploits

14 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (5 hidden).

View more in app →

windows_sam_hivenightmare.rbThis repository contains a single Metasploit post-exploitation module targeting the HiveNightmare (SeriousSAM) vulnerability (CVE-2021-36934) in Windows 10 and 11. The module exploits misconfigured permissions on the SAM and SYSTEM registry hives, which can be accessed via Volume Shadow Copy. The exploit requires a Meterpreter session on the target system. It iterates through available shadow copies, attempts to open and read the SAM and SYSTEM files, and saves them as loot for later offline password hash extraction (e.g., with secretsdump.py). The main file is written in Ruby and leverages Metasploit's Railgun API to interact with Windows file handles. The attack vector is local post-exploitation, and the main fingerprintable endpoints are the file paths to the SAM and SYSTEM hives within shadow copies.Disclosed Jul 20, 2021 · Framework: metasploit · ruby · localWeaponized ShadowStealThis repository provides a working exploit for CVE-2021-36934 (SeriousSAM), a local privilege escalation vulnerability affecting certain Windows 10/11 builds. The main exploit is implemented in Nim (src/ShadowSteal.nim), with a Python script (ShadowSteal.py) to automate Docker-based building of the Windows payload. The exploit works by enumerating available shadow copies on the local system and attempting to access the SAM, SYSTEM, and SECURITY registry hives via the Win32 device namespace. If accessible, these files are exfiltrated and compressed into a zip archive for offline credential extraction. The exploit supports multiple modes (triage, bruteforce) for enumeration thoroughness. The attack vector is local, requiring code execution on the target system. The main fingerprintable endpoints are the shadow copy device paths for the registry hives. The repository is well-structured, with clear build instructions and usage documentation, and is operational for real-world exploitation of the SeriousSAM vulnerability.HuskyHacks · Disclosed Jul 20, 2021 · python · nim · localOperational CVE-2021-36934This repository provides a PowerShell-based exploit and remediation toolkit for CVE-2021-36934 (HiveNightmare/SeriousSAM), a privilege escalation vulnerability in Microsoft Windows 10 and 11. The main script, Get-HiveNightmareStatus.ps1, can detect if a system is vulnerable by checking permissions on the SAM registry hive and the presence of Volume Shadow Copy snapshots. If the -Exploit flag is used, the script attempts to copy the SAM file from available shadow copies to the user's Documents directory, enabling offline credential extraction. The script also supports remediation by resetting permissions and deleting VSS snapshots. The repository includes an XML file for PDQ Inventory integration (for vulnerability scanning), a code-signing script, and a sample policy override configuration. The exploit is local and requires administrative privileges for full functionality. Key fingerprintable endpoints include the SAM file path, shadow copy device paths, and the output file location.n3tsurge · Disclosed Jul 21, 2021 · powershell · xml · localOperational CVE-2021-36934This repository is a C# implementation of an exploit for CVE-2021-36934 (HiveNightmare/SeriousSAM), a privilege escalation vulnerability in Microsoft Windows. The exploit targets improper access control on registry hive files (SAM, SYSTEM, SECURITY) in Volume Shadow Copies, allowing non-administrative users to read sensitive data. The main entry point is Program.cs, which searches for accessible shadow copies, copies the registry hives to a temporary directory, and uses custom C# classes (in the HiveParser directory) to parse and extract password hashes and LSA secrets. The exploit is operational and provides direct credential extraction from vulnerable systems. No network endpoints are involved; all actions are performed locally on the target system. The codebase is well-structured, with separate classes for registry parsing and cryptographic operations, and is intended for use on Windows platforms affected by CVE-2021-36934.Preventions · Disclosed Jul 24, 2021 · csharp · localOperational Why-so-Serious-SAMThis repository is a comprehensive red/purple team framework for simulating fileless malware attacks exploiting the HiveNightmare (CVE-2021-36934) vulnerability on Windows 10/11. The structure includes C++ source code for DLLs that perform registry hive extraction, privilege escalation, and file wiping, as well as PowerShell and batch scripts for payload delivery, persistence, and lateral movement. The exploit demonstrates end-to-end attack chains using Living Off the Land Binaries (LOLBins) such as rundll32.exe, certutil.exe, and powershell.exe to achieve stealthy, in-memory execution and persistence. The code includes mechanisms for fetching and executing shellcode from remote HTTP servers, creating admin users, and establishing persistence via registry keys. The repository also contains lab simulation scripts, detection and mitigation guidance, and references to MITRE ATT&CK techniques. Notable endpoints include Windows registry hives, local and network file paths, registry autorun keys, and remote HTTP/S shares. The exploit is operational and can be used to emulate real-world adversary behavior for detection and response training in controlled environments.P1rat3R00t · Disclosed Jun 9, 2025 · c++ · powershell · local · networkOperational VSSCopyThis repository contains a proof-of-concept (PoC) exploit for CVE-2021-36934 (HiveNightmare/SeriousSAM), a privilege escalation vulnerability in Microsoft Windows. The exploit is implemented in C++ and consists of a Visual Studio project with the main logic in 'Find.cpp' and the entry point in 'VSSCopy.cpp'. The tool, when executed, enumerates all accessible Volume Shadow Copies on the system and attempts to copy the SYSTEM, SAM, and SECURITY registry hives from each shadow copy to a user-specified directory. These hives can then be analyzed offline to extract sensitive information such as password hashes. The exploit requires local access to a vulnerable Windows system. No network endpoints are involved; all actions are performed locally via file system access. The repository is structured as a standard Visual Studio C++ project, with supporting files for project configuration and a brief README describing usage and credits.Wh04m1001 · Disclosed Jul 22, 2021 · c++ · localPoC Invoke-HiveNightmareThis repository contains a PowerShell-based proof-of-concept exploit for CVE-2021-36934 (HiveNightmare), targeting Windows 10 version 1809 or newer. The main script, Invoke-HiveNightmare.ps1, allows a standard user to extract the SAM, SOFTWARE, and SYSTEM registry hives from available Volume Shadow Copies, saving them to a specified or default directory (user's Desktop). The exploit leverages excessive permissions on registry hives in certain Windows versions, enabling offline credential extraction if Volume Shadow Copies exist. The repository consists of the exploit script and a README.md providing context, usage examples, and credits. No network or remote attack vector is present; exploitation is purely local.WiredPulse · Disclosed Jul 22, 2021 · powershell · localPoC SeriousSamThis repository contains a PowerShell script (serioussam.ps1) and a README describing the HiveNightmare/SeriousSam local privilege escalation vulnerability (CVE-2021-36934) affecting certain versions of Microsoft Windows. The script checks if the SAM file in the Windows system directory is readable by non-administrative users, indicating a vulnerable system. If vulnerable, it prompts the user for the number of Volume Shadow Copies and attempts to copy the SAM and SYSTEM registry hives from each shadow copy to the current working directory. These files can then be used for offline password hash extraction, potentially leading to privilege escalation. The exploit is a proof-of-concept for local exploitation and does not provide a weaponized or automated privilege escalation payload, but rather facilitates the extraction of sensitive files for further attack steps.romarroca · Disclosed Jul 22, 2021 · powershell · localPoC PyNightmareThis repository contains a Python proof-of-concept exploit for CVE-2021-36934 (HiveNightmare/SeriousSAM), which affects Windows 10 systems with System Protection enabled. The exploit script, PyNightmare.py, attempts to copy the SYSTEM and SAM registry hive files from all available Volume Shadow Copies to the C:\temp directory. These hives contain sensitive information, such as password hashes, which can be used for privilege escalation. The exploit operates locally and requires access to the target file system. The repository consists of the main exploit script and a README file explaining the vulnerability and usage.Sp00kySkelet0n · Disclosed Jul 25, 2021 · python · localPoC CVE-2021-36934This repository provides a proof-of-concept (POC) exploit for CVE-2021-36934, a privilege escalation vulnerability in Microsoft Windows. The vulnerability allows low-privileged users to read sensitive registry hives (SAM, SECURITY, SYSTEM) from Volume Shadow Copies due to improper access control. The main exploit is implemented in C++ (CVE-2021-36934.cpp) and attempts to brute-force accessible shadow copy indices, copying the registry hives to C:\Windows\Temp if found. The repository includes Visual Studio project files for building the exploit. The README demonstrates how to use the extracted files with tools like secretsdump.py to obtain credentials. The exploit is local-only and does not provide remote access or a shell, but enables offline credential extraction by copying sensitive files to a location accessible by the attacker.0x0D1n · Disclosed Jul 26, 2021 · cpp · localPoC CVE-2021-36934This repository is an unfinished proof-of-concept exploit for CVE-2021-36934 (SeriousSAM/HiveNightmare), a privilege escalation vulnerability affecting Microsoft Windows. The main script, 'workinprogress.py', automates the process of extracting the SAM, SYSTEM, and SECURITY registry hives using an external HiveNightmare binary, then uses a compiled secretsdump utility to extract password hashes. The script then sends the extracted hash to a remote hashcat API (endpoint: https://HOST.ngrok.io/hashcat.php) for rapid cracking. The cracked administrator password is saved to a text file named after the username. The exploit requires the presence of external binaries (nightmare.exe and dump.exe) and access to a hashcat API. The README provides context and requirements, including a link to the hashcat API project. The attack vector is local, requiring code execution on a vulnerable Windows system. The repository is a work in progress and not fully automated, but demonstrates the core logic for exploiting the vulnerability and extracting credentials.websecnl · Disclosed Aug 1, 2021 · python · localPoC poc_CVE-2021-36934This repository is a proof-of-concept (POC) exploit for CVE-2021-36934, also known as HiveNightmare or SeriousSAM, which affects Microsoft Windows. The exploit leverages the Volume Shadow Copy Service (VSS) to access sensitive system files (such as the SAM, SYSTEM, and SECURITY hives) that are normally protected. The repository is structured as a Visual Studio C++ project, with the main code likely residing in 'poc_CVE-2021-36934.cpp' (not included in the provided content, but referenced in the project files). Supporting files include utility functions for file and path checking, as well as Windows and VSS-specific headers. The exploit is local-only and does not target network endpoints. Its primary purpose is to demonstrate unauthorized access to protected files via VSS, which can be used for privilege escalation. The code is a POC and does not include a weaponized or customizable payload.grishinpv · Disclosed Aug 2, 2021 · cpp · c · localPoC oxide_hiveThis repository contains a Rust-based exploit for the HiveNightmare/SeriousSAM vulnerability (CVE-2021-36934) affecting certain versions of Microsoft Windows. The exploit leverages improper access permissions on Volume Shadow Copies to read sensitive registry hives (SAM, SECURITY, SYSTEM) without administrative privileges. The main code is in 'src/main.rs', which searches through available shadow copies for the target hives and copies them to the current working directory as '.dump' files. These files can then be used with tools like 'secretsdump.py' to extract NTLM password hashes, enabling further privilege escalation. The exploit is a local privilege escalation proof-of-concept and does not require network access. The repository is structured as a simple Rust project with a single main source file, a README with usage instructions, and standard project files.chron1k · Disclosed Aug 12, 2021 · rust · localPoC CVE-2021-36934-DLL-Hijacking-DFIR-InvestigationThis repository is a compact malicious DLL proxy/sideloading implant rather than a traditional memory-corruption exploit. It contains three files: a README, a module-definition file (7z.def), and the main code file misleadingly named 7z.dll but shown here as C source. The .def file exports the same symbols a legitimate 7-Zip library would expose, allowing the DLL to masquerade as the real 7z.dll. In DllMain, the code loads the legitimate backing DLL, resolves the expected exports with GetProcAddress, and preserves host functionality. Separately, on first load it spawns a thread that executes embedded raw x64 shellcode. The shellcode contains clear WinINet-related artifacts, including the string "wininet", a realistic browser User-Agent string, a hardcoded IP address 172.16.179.139, port 6683, and a long URI-like path. This strongly indicates outbound network communication for command-and-control, staging, or payload retrieval. Because the payload is embedded and hardcoded rather than operator-configurable, the maturity is best classified as OPERATIONAL. Despite the README referencing CVE-2021-36934, the code itself is best understood as a DLL hijacking/sideloading payload used for post-compromise execution or DFIR demonstration. There is no evidence of vulnerability discovery or exploitation logic for HiveNightmare itself; instead, the repository provides a malicious 7z.dll that gains execution when loaded by a susceptible Windows application or workflow.DuyDuongDuyDuong · Disclosed Aug 15, 2026 · c · markdown · local · file · networkPoC

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationWindows 10 1809operating_system

Microsoft CorporationWindows 10 1909operating_system

Microsoft CorporationWindows 10 2004operating_system

Microsoft CorporationWindows 10 20h2operating_system

Microsoft CorporationWindows 10 21h1operating_system

External references

References

MITRE CVEcve.org · CVE-2021-36934 NVDnvd.nist.gov/vuln/detail/CVE-2021-36934 MITRE CWE · CWE-1220cwe.mitre.org Patchmsrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934 Patchportal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36934 Third Party Advisorypacketstormsecurity.com/files/164006/HiveNightmare-AKA-SeriousSAM.html Third Party Advisorykb.cert.org/vuls/id/506989 US Government Resourcecisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36934

Activity feed

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

splunk researchNews · Jun 24, 2025Detection: Detect Copy of ShadowCopy with Script Block Logging | Splunk Security ContentA Windows vulnerability commonly known as HiveNightmare that exposes SAM, SYSTEM, and SECURITY registry hives, enabling credential theft and offline password cracking.Read more ↗rapid7 blogNews · Jun 2, 2025Exploitation of Windows Installer CVE-2021-41379 | Rapid7 BlogA Microsoft zero-day vulnerability mentioned only as a comparison for patch-release timing following public exploit availability. The reference does not describe its technical mechanism.Read more ↗ahnlab asec blogNews · Aug 15, 2022Attackers Using FRP (Fast Reverse Proxy) to Attack Korean Companies - ASECA local privilege escalation vulnerability associated with the HiveNightmare proof of concept. The report identifies its exploit among the vulnerability PoC malware used during intrusions into Korean companies.Read more ↗mitre attack websiteNews · Feb 1, 2022APT29, IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo, NOBELIUM, UNC2452, YTTRIUM, The Dukes, Cozy Bear, CozyDuke, SolarStorm, Blue Kitsune, UNC3524, Midnight Blizzard, Group G0016 | MITRE ATT&CK®A privilege escalation vulnerability that APT29 exploited on compromised hosts.Read more ↗

+9 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidence5Every observed campaign linking this CVE to a named adversary.

Associated malware2Malware families riding this exploit, with evidence and IOCs.

Detection signatures1YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity6Community discussion across Reddit, Mastodon, and other social sources.