CVE-2021-36934 PoC — Windows Elevation of Privilege Vulnerability

Source

https://github.com/websecnl/CVE-2021-36934

Associated Vulnerability

Title:Windows Elevation of Privilege Vulnerability (CVE-2021-36934)
Description:An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker must have the ability to execute code on a victim system to exploit this vulnerability. After installing this security update, you must manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. Simply installing this security update will not fully mitigate this vulnerability. See <a href="https://support.microsoft.com/topic/1ceaa637-aaa3-4b58-a48b-baf72a2fa9e7">KB5005357- Delete Volume Shadow Copies</a>.

Description

SeriousSAM Auto Exploiter

Readme

# CVE-2021-36934
SeriousSAM Auto Exploiter

# Requirements
- HiveNightmare , executable or a DLL equivelant of it (the DLL equivelant would require some code modifications in order to run it through rundll32, this could be useful when you run into applocker environments.)
- dump.exe m  which is a pyinstaller compiled secretsdump.py so its pretty large since it contains all modules and python itself into it. (Reason you dont need this as a DLL because you can also invoke this server side along with the hashcat API if you want, that would actually be way more effective and stealthy)
- hashcat API , this is a PHP API I made to pass hashes into which can crack most hashes within 5-10 seconds, this is way more efficient than NTLM rainbow tables. 
You can see the code here: https://github.com/websecnl/hashcat-php-API


This project is not yet finished but suite yourself and make something cool from it, just do it for Educational and Research purposes and not for the purpose to do harm to others!

File Snapshot


 [4.0K]  /data/pocs/1bc6e4232d64e8e35bcf070fd5760aefbb3eea18
├── [ 19M]  dump.exe
├── [1005]  README.md
└── [1.4K]  workinprogress.py

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!