HiveNightmare Exploitation

Introduction

CVE-2021-36934?also known as SeriousSAM and HiveNightmare vulnerability was discovered by Jonas Lykkegaard in July 2021. Due to an ACL misconfiguration in Windows 10 post-build 1809 and Windows 11, non-admin users are granted read access to the holy trio of SAM, SYSTEM and SECURITY files under?%windir%\system32\config?directory. For this to be true, however, system protection has to be turned on and a volume shadow copy has to be created. The name ‘HiveNightmare’ is derived from a common name ‘hives’ which refers to the files that have registry data stored.

Table of Content

• System protection and creating restore points
• Exploitation Method 1: HiveNightmare.exe (C++ exploit)
• Exploitation Method 2: serioussam.ps1 (Powershell exploit)
• Exploitation Method 3: hive.exe (Go exploit)
• Privilege Escalation
• Conclusion and Mitigation

To read the full article, check the post here