{"vulnerability": "cve-2021-3693", "sightings": [{"uuid": "38080ec0-cf6d-47c5-8b94-895468815454", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-06-14T21:10:04.000000Z"}, {"uuid": "851d3c6b-28d3-4c86-825e-36b4187eb869", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971251", "content": "", "creation_timestamp": "2024-12-24T20:26:31.439751Z"}, {"uuid": "e4709297-cbc8-40b9-be16-b99f26746f40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "b52efb78-c48d-44d0-bbf4-1a9e59f268d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:39.000000Z"}, {"uuid": "f3600ea7-ddcc-4104-89ab-193c28605ef6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:31.000000Z"}, {"uuid": "86d43adb-6755-4945-b244-c88739bcc95e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:00:59.000000Z"}, {"uuid": "69581deb-e67f-4bc6-84a5-1b5bc21f0240", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/gather/credentials/windows_sam_hivenightmare.rb", "content": "", "creation_timestamp": "2021-07-29T17:01:27.000000Z"}, {"uuid": "445c4101-c21e-4bbd-a0c2-e9246221bfa0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://gist.github.com/garagon/85a72cafb243e1a793677270ca7fad6d", "content": "", "creation_timestamp": "2026-02-17T13:27:58.000000Z"}, {"uuid": "e09e656f-1670-4235-a81d-12b12986599a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://gist.github.com/josephb4224/1d49fcfaa37fb1523b5451314f37b669", "content": "", "creation_timestamp": "2026-03-16T13:31:31.000000Z"}, {"uuid": "fee96c7f-71eb-4060-9589-8102134d4bae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-36936", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=628", "content": "", "creation_timestamp": "2021-08-11T04:00:00.000000Z"}, {"uuid": "7ec6f8fa-bcfc-44e7-b361-7cfaadd9cb5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-36934", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/980bf297-4b65-4417-93e5-bb8927280add", "content": "", "creation_timestamp": "2026-02-02T12:28:23.834300Z"}, {"uuid": "e99bcbd4-0454-4f06-b66a-186509f6b382", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/74", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aExploit\n\u63cf\u8ff0\uff1aPure Nim implementation for exploiting CVE-2021-36934, the SeriousSAM local privilege escalation\nURL\uff1ahttps://github.com/HuskyHacks/ShadowSteal", "creation_timestamp": "2021-07-25T16:00:35.000000Z"}, {"uuid": "0b49ad32-1073-48f5-9570-80a3b87af870", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/76", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aPure Nim implementation for exploiting CVE-2021-36934, the SeriousSAM local privilege escalation\nURL\uff1ahttps://github.com/jmaddington/Serious-Sam---CVE-2021-36934-Mitigation-for-Datto-RMM", "creation_timestamp": "2021-07-25T18:05:33.000000Z"}, {"uuid": "1d2c9947-405d-42f9-a7fe-2ddd19985cbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/73", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aC# PoC for CVE-2021-36934/HiveNightmare/SeriousSAM\nURL\uff1ahttps://github.com/cube0x0/CVE-2021-36934", "creation_timestamp": "2021-07-25T15:44:25.000000Z"}, {"uuid": "247f90db-3254-4952-bee4-b0af1cd60ba4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/173", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-36934 PowerShell Fix\nURL\uff1ahttps://github.com/tda90/CVE-2021-36934", "creation_timestamp": "2021-07-29T06:50:25.000000Z"}, {"uuid": "85eaaefc-9cc0-46ea-ad9e-7d5a0e342ed4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/189", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-36934 HiveNightmare vulnerability checker and workaround\nURL\uff1ahttps://github.com/irissentinel/CVE-2021-36934", "creation_timestamp": "2021-07-29T20:38:38.000000Z"}, {"uuid": "47fd5fda-eb40-4a63-b7cf-587e64ece8ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36931", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/466", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aPoC for exploiting CVE-2021-36928 : Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-36931.\nURL\uff1ahttps://github.com/AlAIAL90/CVE-2021-0114", "creation_timestamp": "2021-09-01T16:45:54.000000Z"}, {"uuid": "029fd587-3ce4-4d41-8024-fed5a2cfa3c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/470", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aPoC for exploiting CVE-2021-36934 : Windows Elevation of Privilege Vulnerability\nURL\uff1ahttps://github.com/AlAIAL90/CVE-2021-36934", "creation_timestamp": "2021-09-02T00:51:19.000000Z"}, {"uuid": "7aaf3873-0974-4ba7-bb56-b57b43bab9ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/1343", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aPure Nim implementation for exploiting CVE-2021-36934, the SeriousSAM local privilege escalation\nURL\uff1ahttps://github.com/HuskyHacks/ShadowSteal", "creation_timestamp": "2022-01-16T02:04:17.000000Z"}, {"uuid": "f4ce16cb-8307-4062-b2d5-30f54b34f8b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/CyberGovIL/1301", "content": "Com7910 | \u05e4\u05d2\u05d9\u05e2\u05d5\u05ea \u05d1\u05d4\u05d2\u05e0\u05d4 \u05e2\u05dc \u05e7\u05d1\u05e6\u05d9 \u05de\u05e2\u05e8\u05db\u05ea \u05e8\u05d2\u05d9\u05e9\u05d9\u05dd \u05e2\u05dc\u05d5\u05dc\u05d4 \u05dc\u05d0\u05e4\u05e9\u05e8 \u05d4\u05e2\u05dc\u05d0\u05ea \u05d4\u05e8\u05e9\u05d0\u05d5\u05ea \u05dc\u05e8\u05de\u05ea SYSTEM\n\n\u05dc\u05d0\u05d7\u05e8\u05d5\u05e0\u05d4 \u05e4\u05e8\u05e1\u05de\u05d4 \u05d7\u05d1\u05e8\u05ea \u05de\u05d9\u05e7\u05e8\u05d5\u05e1\u05d5\u05e4\u05d8 \u05d4\u05ea\u05e8\u05e2\u05d4 \u05d1\u05e0\u05d5\u05d2\u05e2 \u05dc\u05e4\u05d2\u05d9\u05e2\u05d5\u05ea \u05d4\u05e7\u05d9\u05d9\u05de\u05ea \u05d1\u05de\u05e2\u05e8\u05db\u05d5\u05ea \u05d4\u05e4\u05e2\u05dc\u05d4 \u05de\u05ea\u05d5\u05e6\u05e8\u05ea\u05d4.\n\n\u05d4\u05e4\u05d2\u05d9\u05e2\u05d5\u05ea \u05e2\u05dc\u05d5\u05dc\u05d4 \u05dc\u05d0\u05e4\u05e9\u05e8 \u05dc\u05ea\u05d5\u05e7\u05e3 \u05d4\u05e2\u05dc\u05d0\u05ea \u05d4\u05e8\u05e9\u05d0\u05d5\u05ea \u05dc\u05e8\u05de\u05ea SYSTEM.\n\n\u05de\u05e7\u05d5\u05e8 \u05d4\u05e4\u05d2\u05d9\u05e2\u05d5\u05ea \u05d1\u05d4\u05e8\u05e9\u05d0\u05d5\u05ea \u05e8\u05d7\u05d1\u05d5\u05ea \u05de\u05d3\u05d9 \u05e9\u05e0\u05d9\u05ea\u05e0\u05d5 \u05dc\u05e7\u05d1\u05e6\u05d9\u05dd \u05e8\u05d2\u05d9\u05e9\u05d9\u05dd, \u05db\u05d5\u05dc\u05dc \u05d4\u05e7\u05d1\u05e6\u05d9\u05dd \u05d4\u05de\u05db\u05d9\u05dc\u05d9\u05dd \u05d0\u05ea \u05d4-Security Accounts Manager (SAM).\n\n\u05d4\u05e4\u05d2\u05d9\u05e2\u05d5\u05ea \u05e7\u05d9\u05d1\u05dc\u05d4 \u05d0\u05ea \u05d4\u05de\u05d6\u05d4\u05d4 CVE-2021-36934.\n\n\u05e0\u05d9\u05ea\u05df \u05dc\u05e0\u05e6\u05dc \u05d0\u05ea \u05d4\u05e4\u05d2\u05d9\u05e2\u05d5\u05ea \u05d0\u05dd \u05d4\u05ea\u05d5\u05e7\u05e3 \u05d9\u05db\u05d5\u05dc \u05dc\u05d4\u05e8\u05d9\u05e5 \u05e7\u05d5\u05d3 \u05e2\u05dc \u05d4\u05e2\u05de\u05d3\u05d4 \u05d4\u05de\u05d5\u05ea\u05e7\u05e4\u05ea.\n\n\u05d2\u05e8\u05e1\u05d0\u05d5\u05ea \u05e4\u05d2\u05d9\u05e2\u05d5\u05ea:\n\u05e0\u05db\u05d5\u05df \u05dc\u05ea\u05d0\u05e8\u05d9\u05da \u05d4\u05ea\u05e8\u05e2\u05d4 \u05d6\u05d5 \u05d9\u05d3\u05d5\u05e2 \u05db\u05d9 \u05db\u05dc \u05de\u05e2\u05e8\u05db\u05d5\u05ea \u05d4\u05d4\u05e4\u05e2\u05dc\u05d4 \u05d4\u05d7\u05dc \u05de-Windows 10 version 1809 (\u05db\u05d5\u05dc\u05dc), \u05e4\u05d2\u05d9\u05e2\u05d5\u05ea.\n\n\u05d4\u05d7\u05d1\u05e8\u05d4 \u05e2\u05d3\u05d9\u05d9\u05df \u05d1\u05d5\u05d3\u05e7\u05ea \u05e4\u05d2\u05d9\u05e2\u05d5\u05ea\u05df \u05e9\u05dc \u05de\u05e2\u05e8\u05db\u05d5\u05ea \u05d4\u05e4\u05e2\u05dc\u05d4 \u05d9\u05e9\u05e0\u05d5\u05ea \u05d9\u05d5\u05ea\u05e8.\n\n\u05d3\u05e8\u05db\u05d9 \u05d4\u05ea\u05de\u05d5\u05d3\u05d3\u05d5\u05ea:\n\u05db\u05de\u05e2\u05e7\u05e3 \u05d1\u05dc\u05d1\u05d3, \u05e2\u05d3 \u05dc\u05e4\u05e8\u05e1\u05d5\u05dd \u05e2\u05d3\u05db\u05d5\u05df, \u05de\u05de\u05dc\u05d9\u05e6\u05d4 \u05d4\u05d7\u05d1\u05e8\u05d4 \u05dc\u05d4\u05d2\u05d1\u05d9\u05dc \u05d2\u05d9\u05e9\u05d4 \u05dc\u05ea\u05d5\u05db\u05df \u05e9\u05dc \u05d4\u05e1\u05e4\u05e8\u05d9\u05d4 %windir%\\system32\\config, \u05d1\u05d0\u05de\u05e6\u05e2\u05d5\u05ea \u05d4\u05e4\u05e7\u05d5\u05d3\u05d4:\n\nicacls %windir%\\system32\\config\\*.* /inheritance:e\n\n\u05d9\u05e9 \u05dc\u05d4\u05e8\u05d9\u05e5 \u05d0\u05ea \u05d4\u05e4\u05e7\u05d5\u05d3\u05d4 \u05ea\u05d7\u05ea \u05d4\u05e8\u05e9\u05d0\u05d5\u05ea \u05de\u05e0\u05d4\u05dc\u05df (Administrator).\n\n\u05d1\u05e0\u05d5\u05e1\u05e3, \u05d4\u05de\u05e2\u05e7\u05e3 \u05de\u05d7\u05d9\u05d9\u05d1 \u05de\u05d7\u05d9\u05e7\u05ea \u05d4-Volume Shadow Copy Service (VSS) shadow copies, \u05d1\u05d0\u05de\u05e6\u05e2\u05d5\u05ea \u05de\u05d7\u05d9\u05e7\u05d4 \u05e9\u05dc \u05db\u05dc \u05d4- System Restore points\u05d5\u05d4- Shadow volumes \u05e9\u05d4\u05d9\u05d5 \u05e7\u05d9\u05d9\u05de\u05d9\u05dd \u05d1\u05e2\u05de\u05d3\u05d4/\u05e9\u05e8\u05ea \u05d8\u05e8\u05dd \u05d4\u05d2\u05d1\u05dc\u05ea \u05d4\u05d2\u05d9\u05e9\u05d4 \u05dc\u05e1\u05e4\u05e8\u05d9\u05d4 \u05d4\u05e0\"\u05dc.\n\n\u05dc\u05d0\u05d7\u05e8 \u05d4\u05de\u05d7\u05d9\u05e7\u05d4 \u05e0\u05d9\u05ea\u05df \u05dc\u05d9\u05e6\u05d5\u05e8 System Restore point \u05d7\u05d3\u05e9.\n\n\u05e0\u05d3\u05e8\u05e9 \u05dc\u05d1\u05e6\u05e2 \u05d0\u05ea 2 \u05d4\u05e4\u05e2\u05d5\u05dc\u05d5\u05ea \u05e2\u05dc \u05de\u05e0\u05ea \u05e9\u05d4\u05d4\u05d2\u05e0\u05d4 \u05e9\u05dc \u05d4\u05de\u05e2\u05e7\u05e3 \u05de\u05e4\u05e0\u05d9 \u05e4\u05d2\u05d9\u05e2\u05d5\u05ea \u05d6\u05d5 \u05ea\u05d4\u05d9\u05d4 \u05de\u05dc\u05d0\u05d4.\n\n\u05ea\u05e9\u05d5\u05de\u05ea \u05dc\u05d1 \u05db\u05d9 \u05e4\u05e2\u05d5\u05dc\u05ea \u05d4\u05de\u05d7\u05d9\u05e7\u05d4 \u05e2\u05dc\u05d5\u05dc\u05d4 \u05dc\u05e9\u05d1\u05e9 \u05e4\u05e2\u05d5\u05dc\u05d5\u05ea \u05e9\u05d7\u05d6\u05d5\u05e8, \u05db\u05d5\u05dc\u05dc \u05e9\u05d7\u05d6\u05d5\u05e8 \u05d1\u05d0\u05de\u05e6\u05e2\u05d5\u05ea \u05ea\u05d5\u05db\u05e0\u05d5\u05ea \u05e6\u05d3 \u05d2', \u05e2\u05d3 \u05dc\u05d9\u05e6\u05d9\u05e8\u05ea System Restore Point \u05e2\u05d3\u05db\u05e0\u05d9.\n\n\u05de\u05e7\u05d5\u05e8\u05d5\u05ea:\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934", "creation_timestamp": "2021-07-21T14:22:34.000000Z"}, {"uuid": "2cf0848e-545f-4778-9e50-d159ac0a22ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/65", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aPoC for CVE-2021-36934 Aka HiveNightmare/SeriousSAM written in python3\nURL\uff1ahttps://github.com/Sp00p64/PyNightmare", "creation_timestamp": "2021-07-25T04:38:42.000000Z"}, {"uuid": "433d1268-563c-4984-b317-99ebe71fe30c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/239", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aSeriousSAM Auto Exploiter\nURL\uff1ahttps://github.com/websecnl/CVE-2021-36934", "creation_timestamp": "2021-08-01T19:58:00.000000Z"}, {"uuid": "e7fb6e79-2316-4f16-b452-e0f1bd4f0e00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "Telegram/e_NHlWYILInJ8zbDCKp7-kCjwOvHBXhrEoq4o-3KE0_WAd8", "content": "", "creation_timestamp": "2025-06-09T09:00:05.000000Z"}, {"uuid": "83d811e9-ba70-4f2e-bc4a-ce3d9fcdf089", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "https://t.me/is_n3ws/45", "content": "WINDOWS LPE \"HiveNightmare\" or \"SeriousSAM\"\nCVE-2021-36934\nThe problem is aggravated by the fact the 'shadow copy' of the system drive where these files can be found is created when someone performs a Windows Update if that drive is larger than 128GB (!). So, even if your version of Windows 10 wasn't initially impacted, it could be after updating.\n\n1) Check permissions:\nicacls.exe C:\\Windows\\System32\\config\\SAM\n\n2) Check shadow copies, restore points\n[System.IO.File]::Exists('\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\System32\\config\\SAM')\n[System.IO.File]::Exists('\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy2\\Windows\\System32\\config\\SAM')\n[System.IO.File]::Exists('\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy3\\Windows\\System32\\config\\SAM')\n... and so on\n\n3) Copy SAM and SYSTEM files from shadow copy:\n[System.IO.File]::Copy('\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\System32\\config\\SAM', 'C:\\Temp\\SAM')\n[System.IO.File]::Copy('\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\System32\\config\\SYSTEM', 'C:\\Temp\\SYSTEM')", "creation_timestamp": "2021-07-21T15:18:22.000000Z"}, {"uuid": "d5bf1054-3128-4781-95f0-cc561dd70634", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/devukraine/178", "content": "\u0423 Windows 10 \u0442\u0430 11 \u0437\u043d\u0430\u0439\u0448\u043b\u0438 0-day \u0443\u0440\u0430\u0437\u043b\u0438\u0432\u0456\u0441\u0442\u044c, \u0449\u043e \u0434\u043e\u0437\u0432\u043e\u043b\u044f\u0454 \u043f\u0456\u0434\u0432\u0438\u0449\u0438\u0442\u0438 \u043f\u0440\u0430\u0432\u0430 \u043a\u043e\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430.\n\u041f\u0440\u043e\u0441\u0442\u0456\u0448\u0435 \u043a\u0430\u0436\u0443\u0447\u0438, \u0432 \u0447\u0435\u0440\u0433\u043e\u0432\u0438\u0439 \u0440\u0430\u0437 \u0431\u0443\u0434\u044c-\u044f\u043a\u0430 \u043b\u044e\u0434\u0438\u043d\u0430 \u0437 \u043f\u043e\u0442\u0440\u0456\u0431\u043d\u0438\u043c\u0438 \u0437\u043d\u0430\u043d\u043d\u044f\u043c\u0438 \u043c\u043e\u0436\u0435 \u043d\u0430\u0437\u0432\u0430\u0442\u0438\u0441\u044f \u0430\u0434\u043c\u0456\u043d\u0456\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u043c \u0442\u0430 \u043e\u0442\u0440\u0438\u043c\u0430\u0442\u0438 \u043f\u043e\u0432\u043d\u0438\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u043a\u043e\u043c\u043f'\u044e\u0442\u0435\u0440\u043e\u043c.\nJonas Lykkegaard \u043f\u043e\u0432\u0456\u0434\u043e\u043c\u0438\u0432 \u043f\u0440\u043e \u0437\u043d\u0430\u0439\u0434\u0435\u043d\u0443 \u043d\u0438\u043c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0432 \u0442\u0432\u0456\u0442\u0442\u0435\u0440\u0456 \u0442\u0430 \u0437\u0430\u0440\u0430\u0437 Microsoft \u0432\u0456\u0434\u0441\u0442\u0435\u0436\u0443\u0454 \u0457\u0457 \u043f\u0456\u0434 \u043d\u043e\u043c\u0435\u0440\u043e\u043c CVE-2021-36934. \u041d\u0430\u0440\u0430\u0437\u0456  \u043e\u0444\u0456\u0446\u0456\u0439\u043d\u043e\u0433\u043e \u043f\u0430\u0442\u0447\u0430 \u043d\u0435 \u0431\u0443\u043b\u043e \u0432\u0438\u043f\u0443\u0449\u0435\u043d\u043e\u0457.\n\u0421\u0430\u0439\u0442 BeepingComputer \u043f\u0440\u043e\u043f\u043e\u043d\u0443\u0454 \u0442\u0438\u043c\u0447\u0430\u0441\u043e\u0432\u0435 \u0432\u0438\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044f \u043f\u043e\u043a\u0438 \u043e\u0447\u0456\u043a\u0443\u0454\u0442\u044c\u0441\u044f \u043f\u0430\u0442\u0447 \u0432\u0456\u0434 Microsoft.", "creation_timestamp": "2021-07-21T12:05:02.000000Z"}, {"uuid": "ab17e704-ea95-484d-b7cc-8233e6fd9c5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/pt_soft/243", "content": "\ud83d\uddbc\ufe0f Moriarty v1.1\n\n\u0427\u0435\u043a\u0435\u0440 CVEs \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 C# \u0434\u043b\u044f \u041e\u0421 \ud83c\udfe0 Windows\n\n\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\nWindows 10 (Versions: 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004, 20H2, 21H1, 21H2, 22H1, 22H2)\nWindows 11 (Versions: 21H2, 22H1, 22H2, 23H1)\nWindows Server 2016, 2019, 2022\n\n\u0421\u043f\u0438\u0441\u043e\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (35):\nMS10-015\nMS10-092\nMS13-053\nMS13-081\nMS14-058\nMS15-051\nMS15-078\nMS16-016\nMS16-032\nMS16-034\nMS16-135\nCVE-2017-7199\nCVE-2019-0836\nCVE-2019-0836\nCVE-2019-1064\nCVE-2019-1130\nCVE-2019-1253\nCVE-2019-1315\nCVE-2019-1385\nCVE-2019-1388\nCVE-2019-1405\nCVE-2020-0668\nCVE-2020-0683\nCVE-2020-0796\nCVE-2020-1013\nCVE-2020-1013\nCVE-2021-26855\nCVE-2021-26857\nCVE-2021-26858\nCVE-2021-27065\nCVE-2021-44228\nCVE-2021-36934\nCVE-2022-40140\nCVE-2022-22965\nCVE-2023-36664\n\n\ud83d\udc49 \u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0422\u0430\u043a\u0436\u0435 \u0431\u043e\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u043f\u043e CVE\n\n!poc CVE-2019-1064\n\n\ud83d\udcbb Home\n\n\u0414\u043b\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f Visual Studio \u0438 .NET Framework 4.8 Developer Pack\n\n#moriarty #checker #csharp\n\n\u2708\ufe0f // Pentest HaT \ud83c\udfa9", "creation_timestamp": "2024-03-15T08:58:02.000000Z"}, {"uuid": "0f04b971-4cad-4211-969a-de04e5952ae1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "https://t.me/pt_soft/270", "content": "\ud83d\uddbc\ufe0f \ud83d\udd04 Moriarty v1.2\n\n\u0427\u0435\u043a\u0435\u0440 CVEs \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 C# \u0434\u043b\u044f \u041e\u0421 \ud83c\udfe0 Windows\n\n\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\nWindows 10 (Versions: 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004, 20H2, 21H1, 21H2, 22H1, 22H2)\nWindows 11 (Versions: 21H2, 22H1, 22H2, 23H1)\nWindows Server 2016, 2019, 2022\n\n\u0421\u043f\u0438\u0441\u043e\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (35):\nMS10-015\nMS10-092\nMS13-053\nMS13-081\nMS14-058\nMS15-051\nMS15-078\nMS16-016\nMS16-032\nMS16-034\nMS16-135\nCVE-2017-7199\nCVE-2019-0836\nCVE-2019-0836\nCVE-2019-1064\nCVE-2019-1130\nCVE-2019-1253\nCVE-2019-1315\nCVE-2019-1385\nCVE-2019-1388\nCVE-2019-1405\nCVE-2020-0668\nCVE-2020-0683\nCVE-2020-0796\nCVE-2020-1013\nCVE-2020-1013\nCVE-2021-26855\nCVE-2021-26857\nCVE-2021-26858\nCVE-2021-27065\nCVE-2021-44228\nCVE-2021-36934\nCVE-2022-40140\nCVE-2022-22965\nCVE-2023-36664\n\n1.2 added:\n2023-23397\n2022-34718\n\n\ud83d\udc49 \u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0422\u0430\u043a\u0436\u0435 \u0431\u043e\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u043f\u043e CVE\n\n!poc CVE-2019-1064\n\n\ud83d\udcbb Home\n\n\u0414\u043b\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f Visual Studio \u0438 .NET Framework 4.8 Developer Pack\n\n#moriarty #checker #csharp\n\n\u2708\ufe0f // Pentest HaT \ud83c\udfa9", "creation_timestamp": "2024-05-03T09:04:40.000000Z"}, {"uuid": "8de4b9b9-950a-4a26-acbe-5e610dc1fa1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/arpsyndicate/1207", "content": "#ExploitObserverAlert\n\nCVE-2021-36934\n\nDESCRIPTION: Exploit Observer has 105 entries related to CVE-2021-36934. Windows Elevation of Privilege Vulnerability\n\nFIRST-EPSS: 0.000870000\nNVD-IS: 5.9\nNVD-ES: 1.8", "creation_timestamp": "2023-12-04T12:42:12.000000Z"}, {"uuid": "81c6da53-7a84-4c16-900a-d7342abff1b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3693", "type": "seen", "source": "https://t.me/arpsyndicate/2043", "content": "#ExploitObserverAlert\n\nCVE-2021-3693\n\nDESCRIPTION: Exploit Observer has 4 entries related to CVE-2021-3693. LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.\n\nFIRST-EPSS: 0.018710000\nNVD-IS: 6.0\nNVD-ES: 2.8", "creation_timestamp": "2023-12-20T15:42:43.000000Z"}, {"uuid": "789b8c4b-9547-4ff2-a861-e71e7afb1523", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/arpsyndicate/865", "content": "#ExploitObserverAlert\n\nCVE-2021-36934\n\nDESCRIPTION: Exploit Observer has 105 entries related to CVE-2021-36934. Windows Elevation of Privilege Vulnerability\n\nFIRST-EPSS: 0.000870000\nNVD-IS: 5.9\nNVD-ES: 1.8", "creation_timestamp": "2023-12-02T00:32:50.000000Z"}, {"uuid": "ed5431c5-9e5d-4cc4-92ad-0f1747ad0e69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/arpsyndicate/197", "content": "#ExploitObserverAlert\n\nCVE-2021-36934\n\nDESCRIPTION: Exploit Observer has 100 entries related to CVE-2021-36934. Windows Elevation of Privilege Vulnerability\n\nFIRST-EPSS: 0.000870000\nNVD-IS: 5.9\nNVD-ES: 1.8", "creation_timestamp": "2023-11-17T04:16:49.000000Z"}, {"uuid": "be92e9d4-4cd9-422d-996d-0d20366c6f51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/arpsyndicate/56", "content": "#ExploitObserverAlert\n\nCVE-2021-36934\n\nDESCRIPTION: Exploit Observer has 100 entries related to CVE-2021-36934. Windows Elevation of Privilege Vulnerability\n\nFIRST-EPSS: 0.000870000\nNVD-IS: 5.9\nNVD-ES: 1.8", "creation_timestamp": "2023-11-10T21:22:26.000000Z"}, {"uuid": "31b4018b-0a65-495d-9287-554d4abf04e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/186", "content": "Latest Vulnerabilities and Exploits\n\nCVE-2021-3449 OpenSSL denial-of-service exploit\nhttps://github.com/terorie/cve-2021-3449\n\nProxyToken\nhttps://github.com/bhdresh/CVE-2021-33766-ProxyToken\n\nCVES Xstream-1.4.17\nhttps://github.com/zwjjustdoit/Xstream-1.4.17\n\nCVE-2021-36934/HiveNightmare/SeriousSAM\nhttps://github.com/cube0x0/CVE-2021-36934\n\nHow to exploit a vulnerable windows driver Exploit for AsrDrv104 sys\nhttps://github.com/stong/CVE-2020-15368\n\nCVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel\nhttps://github.com/0vercl0k/CVE-2021-32537\n\nCVE-2021-28476 a guest-to-host \"Hyper-V Remote Code Execution Vulnerability\" in vmswitch sys\nhttps://github.com/0vercl0k/CVE-2021-28476\n\nCVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit\nhttps://github.com/klezVirus/CVE-2021-40444\n\nExploit Accsess network clients by sending packets in wirless TP-LINK and preparing for a mitm attack\nhttps://github.com/lhashashinl/CVE-2021-37152\n\nProof on Concept Exploit for CVE-2021-38647 (OMIGOD)\nhttps://github.com/horizon3ai/CVE-2021-38647\n\nProof of Concept Exploit for vCenter CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\nProof-of-Concept (PoC) script to exploit Pulse Secure CVE-2021-22893\nhttps://github.com/ZephrFish/CVE-2021-22893\n\nCVE-2021-33766 (ProxyToken)\nhttps://github.com/demossl/CVE-2021-33766-ProxyToken\n\nCVE-2021-2456\nhttps://github.com/peterjson31337/CVE-2021-2456\n\nCVE-2021-38647 POC for RCE\nhttps://github.com/midoxnet/CVE-2021-38647\n\nCVE-2021-26084 (PoC) | Confluence Server Webwork OGNL injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\nhttps://github.com/r0ckysec/CVE-2021-26084_Confluence\nhttps://github.com/march0s1as/CVE-2021-26084\n\n\nCVE-2021-21551 Dell Driver EoP\nhttps://github.com/ihack4falafel/Dell-Driver-EoP-CVE-2021-21551\n\nA basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)\nhttps://github.com/lntrx/CVE-2021-28663\n\nCVE-2021-40353 openSIS 8.0 SQL Injection\nhttps://github.com/5qu1n7/CVE-2021-40353\n\nCVE-2021-28476 Ubuntu 20.04\nhttps://github.com/sh4m2hwz/CVE-2021-28476-tools-env\n\nmy exp for chrome V8 CVE-2021-30551\nhttps://github.com/xmzyshypnc/CVE-2021-30551\n\nPOC of CVE-2021-2394\nhttps://github.com/lz2y/CVE-2021-2394\n\nWordPress Backup Guard Authenticated Remote Code Execution Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb\n\nExploit code for CVE-2021-33909,Just a dump of removed\nhttps://github.com/bbinfosec43/CVE-2021-33909", "creation_timestamp": "2021-09-18T23:06:09.000000Z"}, {"uuid": "62f2bfcd-ee9b-47ab-bae6-171622cb5043", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "Telegram/WHiW20ApMXZ6BNOO7aAQifpQOu6FZHwCyZuwN2MThusKzg", "content": "", "creation_timestamp": "2021-07-26T17:02:12.000000Z"}, {"uuid": "b5608479-6047-4abe-b381-6ea7b21bea20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "Telegram/wHakPuUc8uo4HVHNEvHyeJkjvrNOaId4E2Z8Zq2TcNfY2g", "content": "", "creation_timestamp": "2021-07-22T16:26:20.000000Z"}, {"uuid": "3e2382d8-ef35-43af-a80d-bde74728720a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/true_secator/1934", "content": "Microsoft \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u043e\u0448\u0438\u0431\u043a\u0438 CVE-2021-36934, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u043a\u0430\u043a SeriousSAM, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 Windows 10, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0435 \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 2,5 \u0433\u043e\u0434\u0430.\n\n\u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0442\u0430\u043b\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435, \u043a\u043e\u0433\u0434\u0430 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Windows 11 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c Jonas Lyk \u043e\u0431\u0440\u0430\u0442\u0438\u043b \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 SAM, SECURITY \u0438 SYSTEM \u0431\u044b\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0432 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u044b\u0445 \u043a\u043e\u043f\u0438\u044f\u0445, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 Shadow Volume Copy.\n\n\u041e\u0448\u0438\u0431\u043a\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0431\u0430\u0437\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0430 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u043e \u0432\u0441\u0435\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 Windows 10,\u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 v 1809. \u0414\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0443 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 Security Account Manager \u0434\u0430\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u043a\u0440\u0430\u0441\u0442\u044c \u0445\u0435\u0448\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0430\u0440\u043e\u043b\u0438, \u0432\u0437\u043b\u043e\u043c\u0430\u0442\u044c \u0445\u044d\u0448\u0438 \u0432 \u0430\u0432\u0442\u043e\u043d\u043e\u043c\u043d\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435 \u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438. \u0414\u0440\u0443\u0433\u0438\u0435 \u0444\u0430\u0439\u043b\u044b \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438, \u0445\u0440\u0430\u043d\u044f\u0449\u0438\u0435\u0441\u044f \u0432 \u043f\u0430\u043f\u043a\u0430\u0445 SYSTEM \u0438 SECURITY, \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0433\u0443\u0442 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043a\u043b\u044e\u0447\u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f DPAPI \u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0435 \u0434\u043b\u044f \u043f\u0440\u0438\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432 \u043a Active Directory. \u041f\u043e \u0438\u0442\u043e\u0433\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u043a\u043e\u0434 \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438. \n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0432\u0441\u044e \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u044c \u0432 Microsoft \u0441\u043a\u0435\u043f\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0442\u043d\u0435\u0441\u043b\u0438\u0441\u044c \u043a CVE, \u043e\u0442\u043c\u0435\u0442\u0438\u0432, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0434\u043e\u043b\u0436\u0435\u043d \u043f\u0440\u0435\u0436\u0434\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0432 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0447\u0442\u043e\u0431\u044b \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e. \n\n\u0422\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435, \u0434\u043b\u044f \u043a\u0443\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u043e\u043d\u0438 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0442 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c\u0443 % windir% \\ system32 \\ config \u0438 \u0443\u0434\u0430\u043b\u0438\u0442\u044c \u0432\u0441\u0435 \u0442\u043e\u0447\u043a\u0438 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0442\u0435\u043d\u0435\u0432\u044b\u0435 \u0442\u043e\u043c\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0438 \u0434\u043e \u0432\u0432\u043e\u0434\u0438\u043c\u043e\u0433\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430.", "creation_timestamp": "2021-07-22T14:21:30.000000Z"}, {"uuid": "df66c9c2-7d29-4a7b-8e70-411b05b22575", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36936", "type": "seen", "source": "https://t.me/true_secator/1993", "content": "\u200b\u200b\u00ab\u0418\u043c\u043f\u0435\u0440\u0438\u044f \u043d\u0430\u043d\u043e\u0441\u0438\u0442 \u043e\u0442\u0432\u0435\u0442\u043d\u044b\u0439 \u0443\u0434\u0430\u0440\u00bb - \u0442\u0430\u043a \u043c\u044b \u043e\u0431\u043e\u0437\u043d\u0430\u0447\u0438\u043c, \u043f\u043e\u0436\u0430\u043b\u0443\u0439, \u044d\u043f\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043f\u0430\u0442\u0447 \u043e\u0442 Microsoft, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0432 \u043e\u0431\u0449\u0435\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 44 CVE, \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 7 - \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435, 3 - zeroday, 37 - \u0432\u0430\u0436\u043d\u044b\u0435, 13 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430, 8 - \u043a\u0430\u0441\u0430\u044e\u0442\u0441\u044f \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0430 \u0433\u043b\u0430\u0432\u043d\u043e\u0435 - \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u043a\u0430\u043a \u0431\u044b \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f PrintNightmare \u0438 PetitPotam.\n\n\u0412 \u043e\u0431\u0449\u0435\u043c, \u0431\u0430\u0433\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 NET Core, Visual Studio, ASP.NET Core, Azure, \u0426\u0435\u043d\u0442\u0440 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f Windows,  \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043f\u0435\u0447\u0430\u0442\u0438 Windows, Windows Media, \u0417\u0430\u0449\u0438\u0442\u043d\u0438\u043a Windows, \u043a\u043b\u0438\u0435\u043d\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u0441\u0442\u043e\u043b\u0430, Microsoft Dynamics, Microsoft Edge, Microsoft Office, Microsoft Office SharePoint \u0438 \u0434\u0440.\n\n\u041a \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u043e\u0448\u0438\u0431\u043a\u0430\u043c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u043e\u0442\u043d\u043e\u0441\u044f\u0442\u0441\u044f:\n \u2022 CVE-2021-36948: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435\u043c  \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 Windows Update Medic;\n \u2022 CVE-2021-36942: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043c\u0435\u043d\u044b Windows LSA;\n \u2022 CVE-2021-36936: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438  \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043f\u0435\u0447\u0430\u0442\u0438 Windows.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0438\u0437 \u043d\u0438\u0445, \u0441\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0434\u0430\u043d\u043d\u044b\u043c Microsoft, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0432 \u0440\u0435\u0430\u043b\u0435 \u043b\u0438\u0448\u044c CVE-2021-36948, \u043e\u0434\u043d\u0430\u043a\u043e \u043a\u0435\u043c \u0438 \u043a\u0430\u043a \u0438\u0441\u0442\u043e\u0440\u0438\u044f \u0443\u043c\u0430\u043b\u0447\u0438\u0432\u0430\u0435\u0442. \u041c\u044b \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u043c, \u0447\u0442\u043e \u0437\u0430 \u043d\u0435\u0439 \u043c\u043e\u0436\u0435\u0442 \u0441\u043a\u0440\u044b\u0432\u0430\u0442\u044c\u0441\u044f \u043d\u043e\u044f\u0431\u0440\u044c\u0441\u043a\u0430\u044f 2020-\u0433\u043e\u0434\u0430 CVE-2020-17070, \u0430 \u0440\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u0432\u043e\u0435\u043e\u0431\u0440\u0430\u0437\u043d\u044b\u043c \u0444\u043e\u043a\u0443\u0441\u043e\u043c \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432.\n\n\u041d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 \u0436\u0435 \u0441\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0438\u0445 \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0443\u0434\u0435\u043b\u0438\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 CVE-2021-26424, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043a\u0430\u0441\u0430\u0435\u0442\u0441\u044f Windows TCP/IP Remote Code Execution \u0432 \u0432\u0435\u0441\u044c\u043c\u0430 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 Windows 7\u201310 \u0438 Windows Server 2008\u20132019. \u041e\u0448\u0438\u0431\u043a\u0430, \u0441 \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0434\u043e\u043b\u0435\u0439 \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0441\u0442\u0438, \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0432 \u0432\u0438\u0434\u0443 \u0435\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438, \u043a\u0430\u043a \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 CVE-2020-16898, \u044d\u043a\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0432\u0448\u0430\u044f\u0441\u044f \u0432\u0434\u043e\u043b\u044c \u0438 \u043f\u043e\u043f\u0435\u0440\u0435\u043a \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443.\n\n\u0410\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u043e\u0435 \u0437\u0430\u043c\u0435\u0447\u0430\u043d\u0438\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u0438 \u043a CVE-2021-26432, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043f\u0430\u0442\u0447 \u0434\u043b\u044f \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 NFS ONCRPC XDR \u0441\u043b\u0443\u0436\u0431 Windows, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f  \u043e\u0448\u0438\u0431\u043a\u0438 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043d\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438, \u043d\u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c.\n\n\u041c\u043e\u0436\u043d\u043e \u043e\u0442\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c\u0441\u044f \u043e\u0442 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432 NETSH \u0432 \u0432\u043e\u043f\u0440\u043e\u0441\u0435 \u043f\u0440\u043e\u0442\u0438\u0432\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0430\u0442\u0430\u043a\u0430\u043c PetitPotam, \u043f\u0430\u0442\u0447 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u0432\u0435\u043a\u0442\u043e\u0440 \u044d\u0442\u043e\u0439 \u0430\u0442\u0430\u043a\u0438, \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044f \u0432\u044b\u0437\u043e\u0432\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 API OpenEncryptedFileRawA \u0438 OpenEncryptedFileRawW \u0447\u0435\u0440\u0435\u0437 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 LSARPC. \u041d\u043e \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0441 \u044d\u0442\u0438\u043c \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u044e EFS API OpenEncryptedFileRaw (A / W) \u0432 Windows 7 \u0438 Windows Server 2008, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0443 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u043d\u043e\u0432\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438. \u0412\u0441\u0435 \u0434\u043b\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432, \u043a\u0430\u043a \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c PrintNightmare \u0442\u0430\u043a\u0436\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0432\u0432\u043e\u0434\u0430 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043f\u0440\u0430\u0432 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u0430 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0423\u043a\u0430\u0437\u0430\u0442\u044c \u0438 \u043d\u0430\u043f\u0435\u0447\u0430\u0442\u0430\u0442\u044c.\n\n\u0412\u0441\u0435 \u0431\u044b \u043d\u0438\u0447\u0435\u0433\u043e, \u043d\u043e!\n\n\u041a \u0441\u043e\u0436\u0430\u043b\u0435\u043d\u0438\u044e, \u0432\u0441\u043a\u043e\u0440\u0435 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a Microsoft \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043d\u0435\u0431\u0435\u0437\u044b\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \nBenjamin Delpy \u0437\u0430\u0431\u043e\u043c\u0431\u0438\u043b, \u0447\u0442\u043e \u0435\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u043f\u0435\u0447\u0430\u0442\u0438 PoC, \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c Still SYSTEM from standard user\u2026\n\n\u041f\u043e\u0445\u043e\u0436\u0435, \u043e\u0442\u0432\u0435\u0442\u043d\u044b\u0439 \u00ab\u0443\u0434\u0430\u0440 \u0438\u043c\u043f\u0435\u0440\u0438\u0438\u00bb \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043e\u0442\u0440\u0435\u043a\u043e\u0448\u0435\u0442\u0438\u043b, \u0432 \u043e\u0431\u0440\u0430\u0442\u043d\u0443\u044e \u0441\u0442\u043e\u0440\u043e\u043d\u0443. \u042d\u0445, \u0430 \u043c\u044b \u0442\u0430\u043a \u043d\u0430\u0434\u0435\u044f\u043b\u0438\u0441\u044c.", "creation_timestamp": "2021-08-11T18:46:50.000000Z"}, {"uuid": "250c3bb5-40b6-4a2a-9f89-00c220f5696f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36930", "type": "seen", "source": "https://t.me/cibsecurity/28252", "content": "\u203c CVE-2021-36930 \u203c\n\nMicrosoft Edge (Chromium-based) Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-26436.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-03T02:36:30.000000Z"}, {"uuid": "32c29c3b-1963-451f-9e0b-069fa7ce64e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36931", "type": "seen", "source": "https://t.me/cibsecurity/27913", "content": "\u203c CVE-2021-36928 \u203c\n\nMicrosoft Edge (Chromium-based) Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-36931.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-26T22:27:34.000000Z"}, {"uuid": "aefeedef-5dd9-4c5a-8ce0-02b651ea8b69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36938", "type": "seen", "source": "https://t.me/cibsecurity/27250", "content": "\u203c CVE-2021-36938 \u203c\n\nWindows Cryptographic Primitives Library Information Disclosure Vulnerability\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-12T22:39:55.000000Z"}, {"uuid": "8cd33be3-66ae-470a-9803-0a6186a02959", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/788", "content": "CVE-2021-36934 Windows\u6b0a\u9650\u63d0\u5347\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2021-36934_Windows%E6%AC%8A%E9%99%90%E6%8F%90%E5%8D%87%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-09-21T04:42:03.000000Z"}, {"uuid": "a1dc783d-a91c-4b8a-9869-ae7ad035d96e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/thehackernews/1386", "content": "New Windows and Linux Flaws Give Attackers Highest System Privileges (SYSTEM / root):\n\n1 \u2014 Microsoft has tagged this new vulnerability CVE-2021-36934, marking it as the 3rd publicly disclosed unpatched Windows bug this month.\n\n2 \u2014 Dubbed \"Sequoia,\" the Linux flaw (CVE-2021-33909) affects all kernel versions from 2014, including default installations of Ubuntu, Debian, Fedora and RHEL.\n\nhttps://thehackernews.com/2021/07/new-windows-and-linux-flaws-give.html", "creation_timestamp": "2021-07-21T08:58:01.000000Z"}, {"uuid": "54154fe1-3f79-4dae-b8b9-407b0716be24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3891", "content": "#Offensive_security\nPure Nim implementation for exploiting CVE-2021-36934, the SeriousSAM Local Privilege Escalation\nhttps://github.com/HuskyHacks/ShadowSteal\n]-> PoC:\nhttps://github.com/cube0x0/CVE-2021-36934", "creation_timestamp": "2021-07-28T08:28:03.000000Z"}, {"uuid": "6fa27e80-20fa-4678-b135-f5133b1df950", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4016", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (July 1-31)\nCVE-2021-1675 - Windows Print Spooler EoP\nhttps://t.me/cybersecuritytechnologies/3723\nCVE-2021-34527 - Windows Print Spooler RCE\nhttps://t.me/cybersecuritytechnologies/3750\nCVE-2021-36934 - Windows SeriousSAM EoP\nhttps://t.me/cybersecuritytechnologies/3891\nCVE-2021-33909 - Sequoia - A LPE Vulnerability in Linux\u2019s Filesystem Layer\nhttps://t.me/cybersecuritytechnologies/3884\nCVE-2021-22555 - Heap out-of-bounds write vuln in Linux Netfilter\nhttps://t.me/cybersecuritytechnologies/3841\nCVE-2021-30807 - OOBR in AppleCLCD/IOMobileFrameBuffer\nhttps://t.me/cybersecuritytechnologies/3930\nCVE-2020-27020 - Vulnerability in Kaspersky Password Manager\nhttps://donjon.ledger.com/kaspersky-password-manager\nCVE-2021-35211 - SolarWinds Serv-U Managed File Transfer Vuln\nhttps://t.me/CyberSecurityTechnologies/4714\nCVE-2021-34481 - Windows Print Spooler EoP\nhttps://mobile.twitter.com/gentilkiwi/status/1416429860566847490\nCVE-2021-3438 - Printer\u2019s Drivers Vulnerability\nhttps://t.me/cybersecuritytechnologies/3969", "creation_timestamp": "2024-01-18T03:22:33.000000Z"}, {"uuid": "f7aa1434-25cd-4d41-9dda-7a8ac9ee0865", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4205", "content": "#Whitepaper\n\"HiveNightmare aka SeriousSAM\", 2021.\n// It details an overview of CVE-2021-36934 and provides exploitation details", "creation_timestamp": "2021-09-02T11:05:07.000000Z"}, {"uuid": "984cd438-49c1-47f8-aebe-0019be254a7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "https://t.me/cyber0iq/19", "content": "Latest Vulnerabilities and Exploits\n\nCVE-2021-3449 OpenSSL denial-of-service exploit\nhttps://github.com/terorie/cve-2021-3449\n\nProxyToken\nhttps://github.com/bhdresh/CVE-2021-33766-ProxyToken\n\nCVES Xstream-1.4.17\nhttps://github.com/zwjjustdoit/Xstream-1.4.17\n\nCVE-2021-36934/HiveNightmare/SeriousSAM\nhttps://github.com/cube0x0/CVE-2021-36934\n\nHow to exploit a vulnerable windows driver Exploit for AsrDrv104 sys\nhttps://github.com/stong/CVE-2020-15368\n\nCVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel\nhttps://github.com/0vercl0k/CVE-2021-32537\n\nCVE-2021-28476 a guest-to-host \"Hyper-V Remote Code Execution Vulnerability\" in vmswitch sys\nhttps://github.com/0vercl0k/CVE-2021-28476\n\nCVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit\nhttps://github.com/klezVirus/CVE-2021-40444\n\nExploit Accsess network clients by sending packets in wirless TP-LINK and preparing for a mitm attack\nhttps://github.com/lhashashinl/CVE-2021-37152\n\nProof on Concept Exploit for CVE-2021-38647 (OMIGOD)\nhttps://github.com/horizon3ai/CVE-2021-38647\n\nProof of Concept Exploit for vCenter CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\nProof-of-Concept (PoC) script to exploit Pulse Secure CVE-2021-22893\nhttps://github.com/ZephrFish/CVE-2021-22893\n\nCVE-2021-33766 (ProxyToken)\nhttps://github.com/demossl/CVE-2021-33766-ProxyToken\n\nCVE-2021-2456\nhttps://github.com/peterjson31337/CVE-2021-2456\n\nCVE-2021-38647 POC for RCE\nhttps://github.com/midoxnet/CVE-2021-38647\n\nCVE-2021-26084 (PoC) | Confluence Server Webwork OGNL injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\nhttps://github.com/r0ckysec/CVE-2021-26084_Confluence\nhttps://github.com/march0s1as/CVE-2021-26084\n\n\nCVE-2021-21551 Dell Driver EoP\nhttps://github.com/ihack4falafel/Dell-Driver-EoP-CVE-2021-21551\n\nA basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)\nhttps://github.com/lntrx/CVE-2021-28663\n\nCVE-2021-40353 openSIS 8.0 SQL Injection\nhttps://github.com/5qu1n7/CVE-2021-40353\n\nCVE-2021-28476 Ubuntu 20.04\nhttps://github.com/sh4m2hwz/CVE-2021-28476-tools-env\n\nmy exp for chrome V8 CVE-2021-30551\nhttps://github.com/xmzyshypnc/CVE-2021-30551\n\nPOC of CVE-2021-2394\nhttps://github.com/lz2y/CVE-2021-2394\n\nWordPress Backup Guard Authenticated Remote Code Execution Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb\n\nExploit code for CVE-2021-33909,Just a dump of removed\nhttps://github.com/bbinfosec43/CVE-2021-33909", "creation_timestamp": "2021-09-25T02:15:23.000000Z"}, {"uuid": "d113c224-e490-49e9-afe9-e81d8a96db3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "https://t.me/cyber0iq/18", "content": "Latest Vulnerabilities and Exploits\n\nCVE-2021-3449 OpenSSL denial-of-service exploit\nhttps://github.com/terorie/cve-2021-3449\n\nProxyToken\nhttps://github.com/bhdresh/CVE-2021-33766-ProxyToken\n\nCVES Xstream-1.4.17\nhttps://github.com/zwjjustdoit/Xstream-1.4.17\n\nCVE-2021-36934/HiveNightmare/SeriousSAM\nhttps://github.com/cube0x0/CVE-2021-36934\n\nHow to exploit a vulnerable windows driver Exploit for AsrDrv104 sys\nhttps://github.com/stong/CVE-2020-15368\n\nCVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel\nhttps://github.com/0vercl0k/CVE-2021-32537\n\nCVE-2021-28476 a guest-to-host \"Hyper-V Remote Code Execution Vulnerability\" in vmswitch sys\nhttps://github.com/0vercl0k/CVE-2021-28476\n\nCVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit\nhttps://github.com/klezVirus/CVE-2021-40444\n\nExploit Accsess network clients by sending packets in wirless TP-LINK and preparing for a mitm attack\nhttps://github.com/lhashashinl/CVE-2021-37152\n\nProof on Concept Exploit for CVE-2021-38647 (OMIGOD)\nhttps://github.com/horizon3ai/CVE-2021-38647\n\nProof of Concept Exploit for vCenter CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\nProof-of-Concept (PoC) script to exploit Pulse Secure CVE-2021-22893\nhttps://github.com/ZephrFish/CVE-2021-22893\n\nCVE-2021-33766 (ProxyToken)\nhttps://github.com/demossl/CVE-2021-33766-ProxyToken\n\nCVE-2021-2456\nhttps://github.com/peterjson31337/CVE-2021-2456\n\nCVE-2021-38647 POC for RCE\nhttps://github.com/midoxnet/CVE-2021-38647\n\nCVE-2021-26084 (PoC) | Confluence Server Webwork OGNL injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\nhttps://github.com/r0ckysec/CVE-2021-26084_Confluence\nhttps://github.com/march0s1as/CVE-2021-26084\n\n\nCVE-2021-21551 Dell Driver EoP\nhttps://github.com/ihack4falafel/Dell-Driver-EoP-CVE-2021-21551\n\nA basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)\nhttps://github.com/lntrx/CVE-2021-28663\n\nCVE-2021-40353 openSIS 8.0 SQL Injection\nhttps://github.com/5qu1n7/CVE-2021-40353\n\nCVE-2021-28476 Ubuntu 20.04\nhttps://github.com/sh4m2hwz/CVE-2021-28476-tools-env\n\nmy exp for chrome V8 CVE-2021-30551\nhttps://github.com/xmzyshypnc/CVE-2021-30551\n\nPOC of CVE-2021-2394\nhttps://github.com/lz2y/CVE-2021-2394\n\nWordPress Backup Guard Authenticated Remote Code Execution Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb\n\nExploit code for CVE-2021-33909,Just a dump of removed\nhttps://github.com/bbinfosec43/CVE-2021-33909", "creation_timestamp": "2021-09-25T02:14:31.000000Z"}, {"uuid": "77047f80-aa70-44cf-b96e-a67da5066314", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/wh_lab/59", "content": "\ud83d\uddbc\ufe0f \ud83d\udd04 Moriarty v1.2\n\n\u0427\u0435\u043a\u0435\u0440 CVEs \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 C# \u0434\u043b\u044f \u041e\u0421 \ud83c\udfe0 Windows\n\n\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\nWindows 10 (Versions: 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004, 20H2, 21H1, 21H2, 22H1, 22H2)\nWindows 11 (Versions: 21H2, 22H1, 22H2, 23H1)\nWindows Server 2016, 2019, 2022\n\n\u0421\u043f\u0438\u0441\u043e\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (35):\n\nMS10-015\nMS10-092\nMS13-053\nMS13-081\nMS14-058\nMS15-051\nMS15-078\nMS16-016\nMS16-032\nMS16-034\nMS16-135\nCVE-2017-7199\nCVE-2019-0836\nCVE-2019-0836\nCVE-2019-1064\nCVE-2019-1130\nCVE-2019-1253\nCVE-2019-1315\nCVE-2019-1385\nCVE-2019-1388\nCVE-2019-1405\nCVE-2020-0668\nCVE-2020-0683\nCVE-2020-0796\nCVE-2020-1013\nCVE-2020-1013\nCVE-2021-26855\nCVE-2021-26857\nCVE-2021-26858\nCVE-2021-27065\nCVE-2021-44228\nCVE-2021-36934\nCVE-2022-40140\nCVE-2022-22965\nCVE-2023-36664\n\n1.2 added:\n2023-23397\n2022-34718\n\n\ud83d\udc49 \u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0422\u0430\u043a\u0436\u0435 \u0431\u043e\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u043f\u043e CVE\n\n!poc CVE-2019-1064\n\n\ud83d\udcbb Home\n\n\u0414\u043b\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f Visual Studio \u0438 .NET Framework 4.8 Developer Pack\n\n#moriarty #checker #csharp\n\n\u2708\ufe0f Whitehat Lab", "creation_timestamp": "2026-08-04T13:00:24.194799Z"}, {"uuid": "98d86212-b107-4873-b26f-346cf2ad2b2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/wh_lab/59", "content": "\ud83d\uddbc\ufe0f \ud83d\udd04 Moriarty v1.2\n\n\u0427\u0435\u043a\u0435\u0440 CVEs \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 C# \u0434\u043b\u044f \u041e\u0421 \ud83c\udfe0 Windows\n\n\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\nWindows 10 (Versions: 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004, 20H2, 21H1, 21H2, 22H1, 22H2)\nWindows 11 (Versions: 21H2, 22H1, 22H2, 23H1)\nWindows Server 2016, 2019, 2022\n\n\u0421\u043f\u0438\u0441\u043e\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (35):\n\nMS10-015\nMS10-092\nMS13-053\nMS13-081\nMS14-058\nMS15-051\nMS15-078\nMS16-016\nMS16-032\nMS16-034\nMS16-135\nCVE-2017-7199\nCVE-2019-0836\nCVE-2019-0836\nCVE-2019-1064\nCVE-2019-1130\nCVE-2019-1253\nCVE-2019-1315\nCVE-2019-1385\nCVE-2019-1388\nCVE-2019-1405\nCVE-2020-0668\nCVE-2020-0683\nCVE-2020-0796\nCVE-2020-1013\nCVE-2020-1013\nCVE-2021-26855\nCVE-2021-26857\nCVE-2021-26858\nCVE-2021-27065\nCVE-2021-44228\nCVE-2021-36934\nCVE-2022-40140\nCVE-2022-22965\nCVE-2023-36664\n\n1.2 added:\n2023-23397\n2022-34718\n\n\ud83d\udc49 \u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0422\u0430\u043a\u0436\u0435 \u0431\u043e\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u043f\u043e CVE\n\n!poc CVE-2019-1064\n\n\ud83d\udcbb Home\n\n\u0414\u043b\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f Visual Studio \u0438 .NET Framework 4.8 Developer Pack\n\n#moriarty #checker #csharp\n\n\u2708\ufe0f Whitehat Lab", "creation_timestamp": "2026-08-05T00:00:40.448408Z"}, {"uuid": "4e2d0ea2-f182-4137-a409-d5058ffb2c80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/onelab1337/725", "content": "CVE-2021-36934 POC | Hive nightmare\n\nhttps://youtu.be/NojR0HQETgE\n\nCVE-2021-1675 PoC | Print Nightmare part 1\n\nhttps://youtu.be/m0LQvf07fjA\n\nCVE-2021-34481 PoC | Print nightmare part 2\n\nhttps://youtu.be/lulJ6i7Fusc\n\nWindows graphics privileged escalation | CVE-2021-26868 poc\n\nhttps://youtu.be/un_3xC2DX3U\n\nJuly PoC for windows..\n\nFor more videos\nhttps://www.youtube.com/c/rapidsafeguard\n\nShare with your infosec friends\n\n#redteam #rapidsafeguard", "creation_timestamp": "2026-08-09T05:02:33.680752Z"}, {"uuid": "5ba56d44-bcb7-479d-b7ad-af7195a82028", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "Telegram/bmbtMV3kDPfh5WrAdXEmt6HVLjLyiZ70G2Nfd-UcUIdAsgs", "content": "", "creation_timestamp": "2026-08-12T17:00:04.633801Z"}, {"uuid": "b732246c-b418-44e7-b7dc-bcc3ade6bfe3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "https://t.me/wh_lab/59", "content": "\ud83d\uddbc\ufe0f \ud83d\udd04 Moriarty v1.2\n\n\u0427\u0435\u043a\u0435\u0440 CVEs \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 C# \u0434\u043b\u044f \u041e\u0421 \ud83c\udfe0 Windows\n\n\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\nWindows 10 (Versions: 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004, 20H2, 21H1, 21H2, 22H1, 22H2)\nWindows 11 (Versions: 21H2, 22H1, 22H2, 23H1)\nWindows Server 2016, 2019, 2022\n\n\u0421\u043f\u0438\u0441\u043e\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (35):\n\nMS10-015\nMS10-092\nMS13-053\nMS13-081\nMS14-058\nMS15-051\nMS15-078\nMS16-016\nMS16-032\nMS16-034\nMS16-135\nCVE-2017-7199\nCVE-2019-0836\nCVE-2019-0836\nCVE-2019-1064\nCVE-2019-1130\nCVE-2019-1253\nCVE-2019-1315\nCVE-2019-1385\nCVE-2019-1388\nCVE-2019-1405\nCVE-2020-0668\nCVE-2020-0683\nCVE-2020-0796\nCVE-2020-1013\nCVE-2020-1013\nCVE-2021-26855\nCVE-2021-26857\nCVE-2021-26858\nCVE-2021-27065\nCVE-2021-44228\nCVE-2021-36934\nCVE-2022-40140\nCVE-2022-22965\nCVE-2023-36664\n\n1.2 added:\n2023-23397\n2022-34718\n\n\ud83d\udc49 \u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0422\u0430\u043a\u0436\u0435 \u0431\u043e\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u043f\u043e CVE\n\n!poc CVE-2019-1064\n\n\ud83d\udcbb Home\n\n\u0414\u043b\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f Visual Studio \u0438 .NET Framework 4.8 Developer Pack\n\n#moriarty #checker #csharp\n\n\u2708\ufe0f Whitehat Lab", "creation_timestamp": "2026-08-06T00:00:43.210959Z"}, {"uuid": "01406bce-480f-43f1-ab66-5d3a81cf9999", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "https://t.me/onelab1337/725", "content": "CVE-2021-36934 POC | Hive nightmare\n\nhttps://youtu.be/NojR0HQETgE\n\nCVE-2021-1675 PoC | Print Nightmare part 1\n\nhttps://youtu.be/m0LQvf07fjA\n\nCVE-2021-34481 PoC | Print nightmare part 2\n\nhttps://youtu.be/lulJ6i7Fusc\n\nWindows graphics privileged escalation | CVE-2021-26868 poc\n\nhttps://youtu.be/un_3xC2DX3U\n\nJuly PoC for windows..\n\nFor more videos\nhttps://www.youtube.com/c/rapidsafeguard\n\nShare with your infosec friends\n\n#redteam #rapidsafeguard", "creation_timestamp": "2026-08-10T00:00:10.273603Z"}, {"uuid": "651ca351-e888-4bc4-913c-f5987de3d1df", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1f8865a4-d1ff-4eba-b66e-4529e51b8346", "content": "", "creation_timestamp": "2026-06-19T12:47:38.942441Z"}, {"uuid": "701cecc0-d7d1-4bee-a3bb-aecddd1c3e40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "published-proof-of-concept", "source": "Telegram/bmbtMV3kDPfh5WrAdXEmt6HVLjLyiZ70G2Nfd-UcUIdAsgs", "content": "", "creation_timestamp": "2026-08-13T00:00:07.960417Z"}, {"uuid": "dc8e95ea-06e5-4c0f-945f-4e2989bba692", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/16a888c6-c798-421b-8e31-1545ccf4b5d4", "content": "", "creation_timestamp": "2026-06-23T14:04:56.800691Z"}, {"uuid": "db3a7670-fccf-48f8-8611-ab1f1b252099", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mst3zsto572d", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2021-36934: An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple syst\u2026\nCVSS 7.8 \u00b7 EPSS 67.3% \u00b7 CISA KEV\nhttps://beta.vulnsea.com/cve/CVE-2021-36934\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-08-11T17:06:57.752179Z"}, {"uuid": "bcf280f0-ce86-46b9-a7db-5f81df7ff912", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/bin_z0ne/406", "content": "\u00ab\u041c\u0430\u043b\u0435\u043d\u044c\u043a\u0438\u0439 \u0431\u0435\u0433\u0435\u043c\u043e\u0442 \u0438 \u0431\u043e\u043b\u044c\u0448\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b\u00bb \u2014 \u043d\u0435\u0442, \u044d\u0442\u043e \u043d\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0438\u0430\u043b\u0430, \u0430 \u043f\u043e\u0434\u0432\u043e\u0434\u043a\u0430 \u043a \u0448\u0435\u0441\u0442\u043e\u0439 \u043f\u043e\u0434\u0431\u043e\u0440\u043a\u0435 \u043d\u043e\u0432\u043e\u0441\u0442\u0435\u0439 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u043e\u0442 \u043d\u0430\u0448\u0435\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u044b. \u041f\u043e\u0435\u0445\u0430\u043b\u0438\ud83d\udd25\n\nHiveNightmare \u2014 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0439 \u043a\u0438\u0431\u0435\u0440\u043a\u043e\u0448\u043c\u0430\u0440 \n\n\u0412 Windows 10 \u0438 11 \u043d\u0430\u0448\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Hivenightmare, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430. \u0420\u0435\u0447\u044c \u043e CVE-2021-36934, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043b\u0435\u0437\u0442\u044c \u0432 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0431\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u0440\u0435\u0435\u0441\u0442\u0440\u0430, \u0447\u0442\u043e\u0431\u044b \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \n\n\u0418 \u0435\u0449\u0435 \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043e \u0431\u0440\u0435\u0448\u0430\u0445 \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Windows\n\nPetitPotam (\u043c\u0430\u043b\u0435\u043d\u044c\u043a\u0438\u0439 \u0431\u0435\u0433\u0435\u043c\u043e\u0442) \u2014 \u0435\u0449\u0435 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Windows, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0438\u0437 \u0424\u0440\u0430\u043d\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044f PetitPotam, \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0434\u043e\u043c\u0435\u043d\u0430\u043c\u0438 Windows, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0433\u0440\u0443\u043f\u043f\u043e\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u044b \u043d\u0430 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0445 \u0442\u043e\u0447\u043a\u0430\u0445.\n\nRCE \u0432 Microsoft SharePoint\n\n\u0420\u0435\u0447\u044c \u043e CVE-2021-28474. \u041f\u0440\u0438 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0430\u0442\u0430\u043a\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0441\u0430\u0439\u0442\u0430 \u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 SharePoint. \n\n\u0423\u043a\u0440\u0430\u0434\u0438 \u043d\u043e\u0443\u0442 \u2014 \u043f\u043e\u043b\u0443\u0447\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0442\u0438\n\n\u041e\u0442\u0432\u043b\u0435\u0447\u0435\u043c\u0441\u044f \u043e\u0442 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Microsoft. \u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0438\u0437 Dolos Group \u043f\u0440\u043e\u0432\u0435\u043b\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442: \u043e\u043d\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u043d\u043e\u0443\u0442 \u0441\u0432\u043e\u0435\u0433\u043e \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u0430 \u0441\u043e \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u043c\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0441 \u0435\u0433\u043e \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u0443\u0442\u044c \u0432 \u0441\u0435\u0442\u044c. \u042d\u0442\u043e \u043e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0432\u043f\u043e\u043b\u043d\u0435 \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u0434\u0430\u0436\u0435 \u0441 \u0443\u0447\u0435\u0442\u043e\u043c \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u043e\u0441\u044c \u043c\u0435\u0442\u043e\u0434\u043e\u043c \u0447\u0435\u0440\u043d\u043e\u0433\u043e \u044f\u0449\u0438\u043a\u0430.\n\n\u0425\u0430\u043a\u0435\u0440, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0441\u0438\u0445\u0430\u043d\u0443\u043b\n\n\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043e \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0439 \u043a\u0438\u0431\u0435\u0440\u0430\u0432\u0430\u043d\u0442\u044e\u0440\u0435: \u0445\u0430\u043a\u0435\u0440 \u0432\u0437\u043b\u043e\u043c\u0430\u043b \u0431\u043b\u043e\u043a\u0447\u0435\u0439\u043d-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 Poly Network \u0438 \u043f\u043e\u0445\u0438\u0442\u0438\u043b \u043a\u0440\u0438\u043f\u0442\u0443 \u043d\u0430 600 \u043c\u043b\u043d \u0434\u043e\u043b\u043b. \u041e\u0434\u043d\u0430\u043a\u043e \u043e\u043d \u043d\u0430\u0447\u0430\u043b \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0442\u044c \u0443\u043a\u0440\u0430\u0434\u0435\u043d\u043d\u043e\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043e\u0442\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043e\u0442 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f \u0432 500 \u0442\u044b\u0441. \u0434\u043e\u043b\u043b. \u0413\u043e\u0432\u043e\u0440\u0438\u0442, \u0447\u0442\u043e \u0441\u0434\u0435\u043b\u0430\u043b \u044d\u0442\u043e \u0438\u0437 \u0441\u043f\u043e\u0440\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u0430.\n\n#threatzonenews", "creation_timestamp": "2026-07-25T03:00:03.697715Z"}, {"uuid": "803b670f-a3f6-4cfd-91e6-8b2eba52e06b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/bin_z0ne/406", "content": "\u00ab\u041c\u0430\u043b\u0435\u043d\u044c\u043a\u0438\u0439 \u0431\u0435\u0433\u0435\u043c\u043e\u0442 \u0438 \u0431\u043e\u043b\u044c\u0448\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b\u00bb \u2014 \u043d\u0435\u0442, \u044d\u0442\u043e \u043d\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0438\u0430\u043b\u0430, \u0430 \u043f\u043e\u0434\u0432\u043e\u0434\u043a\u0430 \u043a \u0448\u0435\u0441\u0442\u043e\u0439 \u043f\u043e\u0434\u0431\u043e\u0440\u043a\u0435 \u043d\u043e\u0432\u043e\u0441\u0442\u0435\u0439 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u043e\u0442 \u043d\u0430\u0448\u0435\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u044b. \u041f\u043e\u0435\u0445\u0430\u043b\u0438\ud83d\udd25\n\nHiveNightmare \u2014 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0439 \u043a\u0438\u0431\u0435\u0440\u043a\u043e\u0448\u043c\u0430\u0440 \n\n\u0412 Windows 10 \u0438 11 \u043d\u0430\u0448\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Hivenightmare, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430. \u0420\u0435\u0447\u044c \u043e CVE-2021-36934, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043b\u0435\u0437\u0442\u044c \u0432 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0431\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u0440\u0435\u0435\u0441\u0442\u0440\u0430, \u0447\u0442\u043e\u0431\u044b \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \n\n\u0418 \u0435\u0449\u0435 \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043e \u0431\u0440\u0435\u0448\u0430\u0445 \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Windows\n\nPetitPotam (\u043c\u0430\u043b\u0435\u043d\u044c\u043a\u0438\u0439 \u0431\u0435\u0433\u0435\u043c\u043e\u0442) \u2014 \u0435\u0449\u0435 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Windows, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0438\u0437 \u0424\u0440\u0430\u043d\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044f PetitPotam, \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0434\u043e\u043c\u0435\u043d\u0430\u043c\u0438 Windows, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0433\u0440\u0443\u043f\u043f\u043e\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u044b \u043d\u0430 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0445 \u0442\u043e\u0447\u043a\u0430\u0445.\n\nRCE \u0432 Microsoft SharePoint\n\n\u0420\u0435\u0447\u044c \u043e CVE-2021-28474. \u041f\u0440\u0438 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0430\u0442\u0430\u043a\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0441\u0430\u0439\u0442\u0430 \u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 SharePoint. \n\n\u0423\u043a\u0440\u0430\u0434\u0438 \u043d\u043e\u0443\u0442 \u2014 \u043f\u043e\u043b\u0443\u0447\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0442\u0438\n\n\u041e\u0442\u0432\u043b\u0435\u0447\u0435\u043c\u0441\u044f \u043e\u0442 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Microsoft. \u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0438\u0437 Dolos Group \u043f\u0440\u043e\u0432\u0435\u043b\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442: \u043e\u043d\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u043d\u043e\u0443\u0442 \u0441\u0432\u043e\u0435\u0433\u043e \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u0430 \u0441\u043e \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u043c\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0441 \u0435\u0433\u043e \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u0443\u0442\u044c \u0432 \u0441\u0435\u0442\u044c. \u042d\u0442\u043e \u043e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0432\u043f\u043e\u043b\u043d\u0435 \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u0434\u0430\u0436\u0435 \u0441 \u0443\u0447\u0435\u0442\u043e\u043c \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u043e\u0441\u044c \u043c\u0435\u0442\u043e\u0434\u043e\u043c \u0447\u0435\u0440\u043d\u043e\u0433\u043e \u044f\u0449\u0438\u043a\u0430.\n\n\u0425\u0430\u043a\u0435\u0440, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0441\u0438\u0445\u0430\u043d\u0443\u043b\n\n\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043e \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0439 \u043a\u0438\u0431\u0435\u0440\u0430\u0432\u0430\u043d\u0442\u044e\u0440\u0435: \u0445\u0430\u043a\u0435\u0440 \u0432\u0437\u043b\u043e\u043c\u0430\u043b \u0431\u043b\u043e\u043a\u0447\u0435\u0439\u043d-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 Poly Network \u0438 \u043f\u043e\u0445\u0438\u0442\u0438\u043b \u043a\u0440\u0438\u043f\u0442\u0443 \u043d\u0430 600 \u043c\u043b\u043d \u0434\u043e\u043b\u043b. \u041e\u0434\u043d\u0430\u043a\u043e \u043e\u043d \u043d\u0430\u0447\u0430\u043b \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0442\u044c \u0443\u043a\u0440\u0430\u0434\u0435\u043d\u043d\u043e\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043e\u0442\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043e\u0442 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f \u0432 500 \u0442\u044b\u0441. \u0434\u043e\u043b\u043b. \u0413\u043e\u0432\u043e\u0440\u0438\u0442, \u0447\u0442\u043e \u0441\u0434\u0435\u043b\u0430\u043b \u044d\u0442\u043e \u0438\u0437 \u0441\u043f\u043e\u0440\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u0430.\n\n#threatzonenews", "creation_timestamp": "2026-07-26T00:00:47.219652Z"}, {"uuid": "f4cab44e-a506-4fe2-acc6-103905565750", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/cissp/5363", "content": "Vulnerability Remediation Resources\nThe table below provides links to remediation sources for the top 10 exploited vulnerabilities\n  CVE-2021-44228\n  https://logging.apache.org/log4j/2.x/security.html\n \n CVE-2021-22005\nhttps://www.vmware.com/security/advisories/VMSA-2021-0020.html\n\n  CVE-2021-34527\n  https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34527\n \n  CVE-2021-1675\n  https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675\n  \n   CVE-2021-27065\n   https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-27065\n   \n CVE-2021-36934\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-36934\n  \n  CVE-2021-40444\n  https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40444\n  \nCVE-2021-26855\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26855\n \n  CVE-2021-22205\n   https://gitlab.com/gitlab-org/gitlab/-/issues/327121\n  \n  CVE-2021-21551\n https://www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-up-date-for-dell-driver-insufficient-access-control-vulnerability", "creation_timestamp": "2026-09-01T17:00:32.459257Z"}, {"uuid": "0db2bd44-020b-49c5-9e3d-228dc95c6621", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/cissp/5362", "content": "CVE-2021-44228 (Log4Shell): Apache Log4j2 - Remote Code Execution (RCE)\n\nCVE-2021-22005: VMware vCenter Server - Arbitrary File Upload\n\nCVE-2021-34527 (PrintNightmare): Windows Print Spooler - RCE\n\nCVE-2021-1675 (PrintNightmare): Windows Print Spooler - Elevation of Privilege\n\nCVE-2021-27065 (ProxyLogon): Microsoft Exchange Server - RCE\n\nCVE-2021-36934: Windows - Elevation of Privilege \n\nCVE-2021-40444: Microsoft MSHTML - RCE\n\nCVE-2021-26855 (ProxyLogon): Microsoft Exchange Server - RCE\n\nCVE-2021-22205: GitLab CE/EE - Remote Code Execution\n\nCVE-2021-21551: Dell - Insufficient Access Control", "creation_timestamp": "2026-09-01T17:00:32.979898Z"}, {"uuid": "38eddb5b-87d4-4dd9-8472-e174871880ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/cissp/5560", "content": "Introduction\nSystem protection and creating restore points\n  CVE-2021-36934 also known as SeriousSAM and HiveNightmare vulnerability was discovered by Jonas Lykkegaard in July 2021. Due to an ACL misconfiguration in Windows 10 post-build 1809 and Windows 11, non-admin users are granted read access to the holy trio of SAM, SYSTEM, and SECURITY files under %windir%\\system32\\config directory. For this to be true, however, system protection has to be turned on and a volume shadow copy has to be created. The name \u2018HiveNightmare\u2019 is derived from a common name \u2018hives\u2019 which refers to the files that have registry data stored.", "creation_timestamp": "2026-09-01T17:00:30.904413Z"}, {"uuid": "a7652562-a493-4814-a0ce-7653a0a9bf82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/cissp/3867", "content": "Malware analysis\n1. Some URL shortener services distribute Android malware\nhttps://www.welivesecurity.com/2021/07/20/url-shortener-services-android-malware-banking-sms-trojans\n2. Async RAT\nhttps://blog.bushidotoken.net/2021/07/attack-campaign-analysis-and.html\n3. Formbook Info Stealer:\nFrom a simple keylogger to a top prevalent malware\nhttps://research.checkpoint.com/2021/top-prevalent-malware-with-a-thousand-campaigns-migrates-to-macos\n4. IcedID and Cobalt Strike vs Antivirus\nhttps://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus\n\nOffensive security\nPure Nim implementation for exploiting CVE-2021-36934, the SeriousSAM Local Privilege Escalation\nhttps://github.com/HuskyHacks/ShadowSteal\n\nBlue Team Techniques\nAnalysis of HSTS Caches of Different Browsers\nhttps://insinuator.net/2021/05/analysis-of-hsts-caches-of-different-browsers\n]-> Forensic HSTS Analyzer:\nhttps://github.com/ernw/forensic-hsts-analyzer", "creation_timestamp": "2026-09-01T17:00:45.576539Z"}, {"uuid": "f1422ec1-678f-48cc-ba5a-8c1407b2a362", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/cissp/4257", "content": "Whitepaper\n\"HiveNightmare aka SeriousSAM\", 2021.\n// It details an overview of CVE-2021-36934 and provides exploitation details", "creation_timestamp": "2026-09-01T17:00:41.610254Z"}, {"uuid": "671c59a5-9e31-4b60-9116-aa2e7f89e0aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/cissp/3916", "content": "The malware started as a simple keylogger over five years ago (later became known as XLoader in February 2020,) and now can steal data from machines running macOS or Windows. XLoader is offered for purchase on multiple forums from prices ranging from $69 (USD) to $139 depending on the site and additional malware features. Formbook/XLoader is capable of keylogging, stealing credentials from web browsers, taking screenshots, and downloading and executing additional files per communication from a command and control server.\nAnalyst Comment: Information stealing is a common and prevalent threat facing individuals and organizations around the world. Education on frequently-used delivery methods such as malspam and phishing emails can help prevent infection. In addition, maintain efficient log management policies to identify potentially abnormal network activity.\nMITRE ATT&CK: [MITRE ATT&CK] Third-party Software - T1072\nTags: Info stealer, Formbook, XLoader, Windows, macOS\nWindows Elevation of Privilege Vulnerability\n(published: July 20, 2021)\nA new Windows 10 vulnerability, assigned CVE-2021-36934 and referred to as HiveNightmare/SeriousSAM, has been found to affect all Windows 10 versions beginning with build 1809. The issue arises from non-admin users being granted read access to any file in the %windir%\\system32\\config directory that can allow for local privilege escalation. If a virtual shadow copy [service] (VSS), which is a Microsoft Windows feature that can create backups or snapshots of files or volumes, of the system is available, a non-admin user can abuse these files for malicious activity.\nAnalyst Comment: Microsoft has issued workarounds for CVE-2021-36934, specifically, to run a command \u201cicacls %windir%\\system32\\config\\*.* /inheritance:e\u201d to delete VSS shadow copies. However, deleting shadow copies could negatively impact restoring operations for Microsoft and third-party services. Microsoft stated, \u201cYou must restrict access and delete shadow copies to prevent exploitation of this vulnerability.\u201d\nTags: Vulnerability, Windows 10, CVE-2021-36934, Privilege escalation\nNew Attacks on Kubernetes via Misconfigured Argo Workflow\n(published: July 20, 2021)\nA new attack vector has been discovered targeting Kubernetes (K8s) clusters through misconfigured Argo Workflows instances, according to Intezer researchers. Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes, according to its documentation. One misconfigured Argo Workflows cluster was found to running a kannix/monero cryptocurrency miner.\nAnalyst Comment: As any system that stores potentially sensitive information, cloud containers need to be configured properly to avoid threat actors from targeting them. Ensure that environments have security policies in place, such as the principle of least privilege, to ensure that permissions are only granted to those on a need-access basis.\nMITRE ATT&CK: [MITRE ATT&CK] Valid Accounts - T1078 | [MITRE ATT&CK] Resource Hijacking - T1496\nTags: Misconfigured, Cryptomining\nDebugging MosaicLoader, One Step at a Time\n(published: July 20, 2021)\nBitdefender researchers have reported their findings on a new malware family dubbed MosaicLoader. The malware was discovered when researchers noticed \u201cprocesses that add local exclusions in Windows Defender for specific file names (prun.exe, appsetup.exe, etc.), that all reside in the same folder, called \\PublicGaming\\.\u201d The malware is delivered through archives masquerading as cracked software installers. That threat actors are then purchasing Google search engine results to boost their malicious archives\u2019 visibility and potential delivery. MosaicLoader can deliver any other kind of malware and utilizes a unique obfuscation technique that shuffles code chunks creating a mosaic-like structure.\nAnalyst Comment: Cracked software is a well-known and common delivery method for malicious payloads or first-stage infections.", "creation_timestamp": "2026-09-01T17:00:45.125166Z"}, {"uuid": "4fa8e27a-c7b2-485c-8e2c-b665e05b0852", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36936", "type": "seen", "source": "https://t.me/hacking_Attack/19794", "content": "Black Hat Ethical Hacking\nActively Exploited Windows Zero-Day Gets a Patch\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Actively Exploited Windows Zero-Day Gets a PatchPost Views: 60 \nReading Time: 2 Minutes\nMicrosoft has patched 51 security vulnerabilities in its scheduled August Patch Tuesday update, including seven critical bugs, two issues that were publicly disclosed but unpatched until now, and one that\u2019s listed as a zero-day that has been exploited in the wild.\nMicrosoft\u2019s August 2021 Patch Tuesday addressed a smaller set of bugs than usual, including more Print Spooler problems, a zero-day and seven critical vulnerabilities.\nOf note, there are 17 elevation-of-privilege (EoP) vulnerabilities, 13 remote code-execution (RCE) issues, eight information-disclosure flaws and two denial-of-service (DoS) bugs.\n\nThe update also includes patches for three more Print Spooler bugs, familiar from the PrintNightmare saga.\n\n\u201cFortunately, it was a lighter month than usual,\u201d said Eric Feldman, senior product marketing manager at Automox, in a Patch Tuesday analysis\u00a0from the vendor. \u201cThis represents a 56 percent reduction in overall vulnerabilities from July, and 33 percent fewer vulnerabilities on average for each month so far this year. We have also seen a similar reduction in critical vulnerabilities this month, with 30 percent less compared to the monthly average.\u201d Windows Critical Security VulnerabilitiesThe seven critical bugs addressed in August\u00a0are as follows:\n\n* CVE-2021-26424 \u2013 Windows TCP/IP RCE Vulnerability\n* CVE-2021-26432 \u2013 Windows Services for NFS ONCRPC XDR Driver RCE Vulnerability\n* CVE-2021-34480 \u2013 Scripting Engine Memory Corruption Vulnerability\n* CVE-2021-34530 \u2013 Windows Graphics Component RCE Vulnerability\n* CVE-2021-34534 \u2013 Windows MSHTML Platform RCE Vulnerability\n* CVE-2021-34535 \u2013 Remote Desktop Client RCE Vulnerability\n* CVE-2021-36936 \u2013 Windows Print Spooler RCE Vulnerability\nSee Also: Auth Bypass Bug Exploited, Affecting Millions of Routers The bug tracked as CVE-2021-26424\u00a0exists in the TCP/IP protocol stack identified in Windows 7 and newer Microsoft operating systems, including servers.\n\n\u201cDespite its CVSS rating of 9.9, this may prove to be a trivial bug, but it\u2019s still fascinating,\u201d said Dustin Childs of Trend Micro\u2019s Zero Day Initiative (ZDI) in his Tuesday analysis. \u201cAn attacker on a guest Hyper-V OS could execute code on the host Hyper-V server by sending a specially crafted IPv6 ping. This keeps it out of the wormable category. Still, a successful attack would allow the guest OS to completely take over the Hyper-V host. While not wormable, it\u2019s still cool to see new bugs in new scenarios being found in protocols that have been around for years.\u201d\n\nThe next bug, CVE-2021-26432\u00a0in Windows Services, is more likely to be exploited given its low complexity status, according to Microsoft\u2019s advisory; it doesn\u2019t require privileges or user interaction to exploit, but Microsoft offered no further details.\n\n\u201cThis may fall into the \u2018wormable\u2019 category, at least between servers with NFS installed, especially since the open network computing remote procedure call (ONCRPC) consists of an External Data Representation (XDR) runtime built on the Winsock Kernel (WSK) interface,\u201d Childs said. \u201cThat certainly sounds like elevated code on a listening network service. Don\u2019t ignore this patch.\u201d\n\nAleks Haugom, product marketing manager at Automox, added, \u201cExploitation results in total loss of confidentiality across all devices managed by the same security authority. Furthermore, attackers can utilize it for denial-of-service attacks or to maliciously modify files. So far, no further details have been divulged by Mic[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:29.448562Z"}, {"uuid": "52b9d511-e69a-45d4-be5d-452565d60c1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/hacking_Attack/31296", "content": "Hacking Articles|Raj Chandel's Blog\nWindows Privilege Escaslation: HiveNightmare\n\nIntroductionCVE-2021-36934 also known as SeriousSAM and HiveNightmare vulnerability was discovered by Jonas Lykkegaard in July 2021. Due to an ACL misconfiguration in Windows 10 post build 1809 and Windows 11, non-admin users are granted read access to the holy trio of SAM, SYSTEM and SECURITY files under %windir%\\system32\\configdirectory. For this to be true, however, system protection has to be turned on and a volume shadow copy has to be created. The name \u2018HiveNightmare\u2019 is derived from a common name \u2018hives\u2019 which refers to the files that have registry data stored.Table of Contents\u00b7 System protection and creating restore pointsSystem protection and creating restore pointsThis feature is available post Windows ME and XP, and allows a user to create backups, snapshots or restore points in their windows system. Should you feel the need to restore your windows to a previous point in time, you can do so. Microsoft mentions which files, settings and configurations are backed up here.Volume Shadow Copy: Post Windows 7 and Win Server 2003, a VSS (Volume Shadow Copy Service) accompanies users in their quest to properly create backups of their servers, shared folders, and restore points on local or remote systems is NTFS or ReFS is being used. In our case, volume shadow copy refers to a local restore point created by a user.net user administrator /active:yes system and security->system->system protection and configure___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:09.556348Z"}, {"uuid": "827225d1-9dff-4744-bed5-1fb63c31d26e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/hacking_Attack/31316", "content": "Hacking Articles\nWindows Privilege Escaslation: HiveNightmare\n\nIntroduction CVE-2021-36934 also known as SeriousSAM and HiveNightmare vulnerability was discovered by Jonas Lykkegaard in July 2021. Due to an ACL misconfiguration in Windows 10\n\nThe post Windows Privilege Escaslation: HiveNightmare appeared first on Hacking Articles.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:09.602959Z"}, {"uuid": "ce790b78-4d9e-46be-872e-f7a3bd97d13e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/hacking_Attack/31348", "content": "Hacking Articles\nWindows Privilege Escalation: HiveNightmare\n\nIntroduction CVE-2021-36934 also known as SeriousSAM and HiveNightmare vulnerability was discovered by Jonas Lykkegaard in July 2021. Due to an ACL misconfiguration in Windows 10\n\nThe post Windows Privilege Escalation: HiveNightmare appeared first on Hacking Articles.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:09.645116Z"}, {"uuid": "d790a831-8d96-4f44-a145-565ff7e4436d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/hacking_Attack/22257", "content": "Exploit Collector\nHiveNightmare AKA SeriousSAM\n\nhttps://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png \nWhitepaper called HiveNightmare AKA SeriousSAM. It details an overview of CVE-2021-36934 and provides exploitation details.\n\nMD5 | c4e2761c221ef8324193337253239052\n\nDownload\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:25.938646Z"}, {"uuid": "e1adae47-383c-4b4f-994b-b4e627b3b579", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36936", "type": "seen", "source": "https://t.me/hacking_Attack/19796", "content": "\u201cThis bug is listed as publicly known, but it\u2019s not clear if this bug is a variant of PrintNightmare or a unique vulnerability all on its own. There are quite a few print-spooler bugs to keep track of. Either way, attackers can use this to execute code on affected systems. Microsoft does state low privileges are required, so that should put this in the non-wormable category, but you should still prioritize testing and deployment of this critical-rated bug.\u201d\n\nThe critical vulnerability is just one of three Print Spooler issues in the August Patch Tuesday release.\n\n\u201cThe specter of the PrintNightmare continues to haunt this patch Tuesday with three more print spooler vulnerabilities, CVE-2021-36947, CVE-2021-36936 and CVE-2021-34481,\u201d said Breen. \u201cAll three are listed as RCE over the network, requiring a low level of access, similar to PrintNightmare. Microsoft has marked these as \u2018Exploitation More Likely\u2019 which, if the previous speed of POC code being published is anything to go by, is certainly true.\u201d RCE Zero-Day in Windows Update Medic ServiceThe actively exploited bug is tracked as CVE-2021-36948\u00a0and is rated as important; it could pave the way for RCE via the Windows Update Medic Service in Windows 10 and Server 2019 and newer operating systems.\n\n\u201cUpdate Medic is a new service that allows users to repair Windows Update components from a damaged state such that the device can continue to receive updates,\u201d Automox\u2019 Jay Goodman explained. \u201cThe exploit is both low complexity and can be exploited without user interaction, making this an easy vulnerability to include in an adversary\u2019s toolbox.\u201d\n\nImmersive\u2019s Breen added, \u201cCVE-2021-36948 is a privilege-escalation vulnerability \u2013 the cornerstone of modern intrusions as they allow attackers the level of access to do things like hide their tracks and create user accounts.\u00a0 In the case of ransomware attacks, they have also been used to ensure maximum damage.\u201d\n\nThough the bug is being reported as being exploited in the wild by Microsoft, activity appears to remain limited or targeted: \u201cWe have seen no evidence of it at Kenna Security at this time,\u201d Jerry Gamblin, director of security research at Kenna Security (now part of Cisco) told Threatpost. Publicly Known Windows LSA Spoofing BugThe second publicly known bug (after the Print Spooler issue covered earlier) is tracked as CVE-2021-36942, and it\u2019s an important-rated Windows LSA (Local Security Authority) spoofing vulnerability.\n\n\u201cIt fixes a flaw that could be used to steal NTLM hashes from a domain controller or other vulnerable host,\u201d Immersive\u2019s Breen said. \u201cThese types of attacks are well known for lateral movement and privilege escalation, as has been demonstrated recently by a new exploit called PetitPotam. It is a post-intrusion exploit \u2013 further down the attack chain \u2013 but still a useful tool for attackers.\u201d\n\nChilds offered a bit of context around the bug.\n\n\u201cMicrosoft released this patch to further protect against NTLM relay attacks by issuing this update to block the LSARPC interface,\u201d he said. \u201cThis will impact some systems, notably Windows Server 2008 SP2, that use the EFS API OpenEncryptedFileRawA function. You should apply this to your Domain Controllers first and follow the additional guidance in ADV210003\u00a0and KB5005413. This has been an ongoing issue since 2009, and, likely, this isn\u2019t the last we\u2019ll hear of this persistent issue.\u201d\n\nMicrosoft\u2019s next Patch Tuesday will fall on September 14.\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/botnet-90x90.jpg Auth Bypass Bug Exploited, Affecting Millions of Routers1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/cisco-patch-90x90.png Critical Cisco Bug in VPN Routers Allows Remote Takeover2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/delete-telegram-message-e1628177080885[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:28.597933Z"}, {"uuid": "7ca74b01-cc6d-4178-8c3c-81cdeb034ca5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36936", "type": "seen", "source": "https://t.me/hacking_Attack/19795", "content": "rosoft or the security researcher (Liubenjin from Codesafe Team of Legendsec at Qi\u2019anxin Group) that discovered this vulnerability. Given the broad potential impact, its label \u2018Exploitation More Likely\u2019 and apparent secrecy, patching should be completed ASAP.\u201d\n\nMeanwhile, the memory-corruption bug (CVE-2021-34480) arises from how the scripting engine handles objects in memory, and it also allows RCE. Using a web-based attack or a malicious file, such as a malicious landing page or phishing email, attackers can use this vulnerability to take control of an affected system, install programs, view or change data, or create new user accounts with full user rights.\n\n\u201cCVE-2021-34480 should also be a priority,\u201d Kevin Breen, director of cyber-threat research at Immersive Labs, told Threatpost. \u201cIt is a low score in terms of CVSS, coming in at 6.8, but has been marked by Microsoft as \u2018Exploitation More Likely\u2019 because it is the type of attack commonly used to increase the success rate of spear phishing attacks to gain network access.\u00a0 Simple, but effective.\u201d\nSee Also: Offensive Security Tool: Mimikatz The Windows Graphic Component bug (CVE-2021-34530) allows attackers to remotely execute malicious code in the context of the current user, according to Microsoft \u2013 if they can social-engineer a target into opening a specially crafted file.\n\nAnother bug exists in the Windows MSHTML platform, also known as Trident (CVE-2021-34534). Trident is the rendering engine (mshtml.dll) used by Internet Explorer. The bug affects many Windows 10 versions (1607, 1809,1909, 2004, 20H2, 21H1) as well as Windows Server 2016 and 2019.\n\nBut while it potentially affects a large number of users, exploitation is not trivial.\n\n\u201cTo exploit, a threat actor would need to pull off a highly complex attack with user interaction \u2013 still entirely possible with the sophisticated attackers of today,\u201d said Peter Pflaster, technical product marketing manager at Automox.\n\nThe bug tracked as CVE-2021-34535\u00a0impacts the Microsoft Remote Desktop Client, Microsoft\u2019s nearly ubiquitous utility for connecting to remote PCs.\n\n\u201cWith today\u2019s highly dispersed workforce, CVE-2021-34535, an RCE vulnerability in Remote Desktop Clients, should be a priority patch,\u201d said Breen. \u201cAttackers increasingly use RDP access as the tip of the spear to gain network access, often combining it with privilege escalation to move laterally.\u00a0 These can be powerful as, depending on the method, it may allow the attacker to authenticate in the network in the same way a user would, making detection difficult.\u201d\n\nIt\u2019s not as dangerous of a bug as BlueKeep,\u00a0according to Childs, which also affected RDP.\n\n\u201cBefore you start having flashbacks to BlueKeep, this bug affects the RDP client and not the RDP server,\u201d he said. \u201cHowever, the CVSS 9.9 bug is nothing to ignore. An attacker can take over a system if they can convince an affected RDP client to connect to an RDP server they control. On Hyper-V servers, a malicious program running in a guest VM could trigger guest-to-host RCE by exploiting this vulnerability in the Hyper-V Viewer. This is the more likely scenario and the reason you should test and deploy this patch quickly.\u201d See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerWindows Print Spooler Bugs \u2013 AgainThe final critical bug is CVE-2021-36936, a Windows Print Spooler RCE bug that\u2019s listed as publicly known.\n\nPrint Spooler made headlines last month, when Microsoft patched what it thought was a minor elevation-of-privilege vulnerability in the service (CVE-2021-1675). But the listing was updated later in the week, after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE \u2013 requiring a new patch.\n\nIt also disclosed a second bug, similar to PrintNightmare (CVE-2021-34527); and a third, an EoP issue\u00a0(CVE-2021-34481).\n\n\u201cAnother month, another remote code-execution bug in the Print Spooler,\u201d said ZDI\u2019s Childs. [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:28.887344Z"}, {"uuid": "528a6032-bace-4753-91e3-6cb3c109375e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/hacking_Attack/31296", "content": "Hacking Articles|Raj Chandel's Blog\nWindows Privilege Escaslation: HiveNightmare\n\nIntroductionCVE-2021-36934 also known as SeriousSAM and HiveNightmare vulnerability was discovered by Jonas Lykkegaard in July 2021. Due to an ACL misconfiguration in Windows 10 post build 1809 and Windows 11, non-admin users are granted read access to the holy trio of SAM, SYSTEM and SECURITY files under %windir%\\system32\\configdirectory. For this to be true, however, system protection has to be turned on and a volume shadow copy has to be created. The name \u2018HiveNightmare\u2019 is derived from a common name \u2018hives\u2019 which refers to the files that have registry data stored.Table of Contents\u00b7 System protection and creating restore pointsSystem protection and creating restore pointsThis feature is available post Windows ME and XP, and allows a user to create backups, snapshots or restore points in their windows system. Should you feel the need to restore your windows to a previous point in time, you can do so. Microsoft mentions which files, settings and configurations are backed up here.Volume Shadow Copy: Post Windows 7 and Win Server 2003, a VSS (Volume Shadow Copy Service) accompanies users in their quest to properly create backups of their servers, shared folders, and restore points on local or remote systems is NTFS or ReFS is being used. In our case, volume shadow copy refers to a local restore point created by a user.net user administrator /active:yes system and security->system->system protection and configure___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:35.792773Z"}, {"uuid": "4313d1e6-4cb5-47be-b735-0d7085fc0976", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/hacking_Attack/31316", "content": "Hacking Articles\nWindows Privilege Escaslation: HiveNightmare\n\nIntroduction CVE-2021-36934 also known as SeriousSAM and HiveNightmare vulnerability was discovered by Jonas Lykkegaard in July 2021. Due to an ACL misconfiguration in Windows 10\n\nThe post Windows Privilege Escaslation: HiveNightmare appeared first on Hacking Articles.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:35.831502Z"}, {"uuid": "01967a1c-242c-4a79-82a7-b27ae065fcde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/hacking_Attack/31348", "content": "Hacking Articles\nWindows Privilege Escalation: HiveNightmare\n\nIntroduction CVE-2021-36934 also known as SeriousSAM and HiveNightmare vulnerability was discovered by Jonas Lykkegaard in July 2021. Due to an ACL misconfiguration in Windows 10\n\nThe post Windows Privilege Escalation: HiveNightmare appeared first on Hacking Articles.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:35.886813Z"}, {"uuid": "9290cc50-ea9a-411d-bd0d-41fea84be5f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36936", "type": "seen", "source": "https://t.me/hacking_Attack/19796", "content": "\u201cThis bug is listed as publicly known, but it\u2019s not clear if this bug is a variant of PrintNightmare or a unique vulnerability all on its own. There are quite a few print-spooler bugs to keep track of. Either way, attackers can use this to execute code on affected systems. Microsoft does state low privileges are required, so that should put this in the non-wormable category, but you should still prioritize testing and deployment of this critical-rated bug.\u201d\n\nThe critical vulnerability is just one of three Print Spooler issues in the August Patch Tuesday release.\n\n\u201cThe specter of the PrintNightmare continues to haunt this patch Tuesday with three more print spooler vulnerabilities, CVE-2021-36947, CVE-2021-36936 and CVE-2021-34481,\u201d said Breen. \u201cAll three are listed as RCE over the network, requiring a low level of access, similar to PrintNightmare. Microsoft has marked these as \u2018Exploitation More Likely\u2019 which, if the previous speed of POC code being published is anything to go by, is certainly true.\u201d RCE Zero-Day in Windows Update Medic ServiceThe actively exploited bug is tracked as CVE-2021-36948\u00a0and is rated as important; it could pave the way for RCE via the Windows Update Medic Service in Windows 10 and Server 2019 and newer operating systems.\n\n\u201cUpdate Medic is a new service that allows users to repair Windows Update components from a damaged state such that the device can continue to receive updates,\u201d Automox\u2019 Jay Goodman explained. \u201cThe exploit is both low complexity and can be exploited without user interaction, making this an easy vulnerability to include in an adversary\u2019s toolbox.\u201d\n\nImmersive\u2019s Breen added, \u201cCVE-2021-36948 is a privilege-escalation vulnerability \u2013 the cornerstone of modern intrusions as they allow attackers the level of access to do things like hide their tracks and create user accounts.\u00a0 In the case of ransomware attacks, they have also been used to ensure maximum damage.\u201d\n\nThough the bug is being reported as being exploited in the wild by Microsoft, activity appears to remain limited or targeted: \u201cWe have seen no evidence of it at Kenna Security at this time,\u201d Jerry Gamblin, director of security research at Kenna Security (now part of Cisco) told Threatpost. Publicly Known Windows LSA Spoofing BugThe second publicly known bug (after the Print Spooler issue covered earlier) is tracked as CVE-2021-36942, and it\u2019s an important-rated Windows LSA (Local Security Authority) spoofing vulnerability.\n\n\u201cIt fixes a flaw that could be used to steal NTLM hashes from a domain controller or other vulnerable host,\u201d Immersive\u2019s Breen said. \u201cThese types of attacks are well known for lateral movement and privilege escalation, as has been demonstrated recently by a new exploit called PetitPotam. It is a post-intrusion exploit \u2013 further down the attack chain \u2013 but still a useful tool for attackers.\u201d\n\nChilds offered a bit of context around the bug.\n\n\u201cMicrosoft released this patch to further protect against NTLM relay attacks by issuing this update to block the LSARPC interface,\u201d he said. \u201cThis will impact some systems, notably Windows Server 2008 SP2, that use the EFS API OpenEncryptedFileRawA function. You should apply this to your Domain Controllers first and follow the additional guidance in ADV210003\u00a0and KB5005413. This has been an ongoing issue since 2009, and, likely, this isn\u2019t the last we\u2019ll hear of this persistent issue.\u201d\n\nMicrosoft\u2019s next Patch Tuesday will fall on September 14.\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/botnet-90x90.jpg Auth Bypass Bug Exploited, Affecting Millions of Routers1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/cisco-patch-90x90.png Critical Cisco Bug in VPN Routers Allows Remote Takeover2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/delete-telegram-message-e1628177080885[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:02.103558Z"}, {"uuid": "8aeab42c-927f-42ed-92a9-40729ae580cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/hacking_Attack/22257", "content": "Exploit Collector\nHiveNightmare AKA SeriousSAM\n\nhttps://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png \nWhitepaper called HiveNightmare AKA SeriousSAM. It details an overview of CVE-2021-36934 and provides exploitation details.\n\nMD5 | c4e2761c221ef8324193337253239052\n\nDownload\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:02:59.461958Z"}, {"uuid": "a05317ab-056d-4397-a9b5-38b1eb9dbc10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36936", "type": "seen", "source": "https://t.me/hacking_Attack/19795", "content": "rosoft or the security researcher (Liubenjin from Codesafe Team of Legendsec at Qi\u2019anxin Group) that discovered this vulnerability. Given the broad potential impact, its label \u2018Exploitation More Likely\u2019 and apparent secrecy, patching should be completed ASAP.\u201d\n\nMeanwhile, the memory-corruption bug (CVE-2021-34480) arises from how the scripting engine handles objects in memory, and it also allows RCE. Using a web-based attack or a malicious file, such as a malicious landing page or phishing email, attackers can use this vulnerability to take control of an affected system, install programs, view or change data, or create new user accounts with full user rights.\n\n\u201cCVE-2021-34480 should also be a priority,\u201d Kevin Breen, director of cyber-threat research at Immersive Labs, told Threatpost. \u201cIt is a low score in terms of CVSS, coming in at 6.8, but has been marked by Microsoft as \u2018Exploitation More Likely\u2019 because it is the type of attack commonly used to increase the success rate of spear phishing attacks to gain network access.\u00a0 Simple, but effective.\u201d\nSee Also: Offensive Security Tool: Mimikatz The Windows Graphic Component bug (CVE-2021-34530) allows attackers to remotely execute malicious code in the context of the current user, according to Microsoft \u2013 if they can social-engineer a target into opening a specially crafted file.\n\nAnother bug exists in the Windows MSHTML platform, also known as Trident (CVE-2021-34534). Trident is the rendering engine (mshtml.dll) used by Internet Explorer. The bug affects many Windows 10 versions (1607, 1809,1909, 2004, 20H2, 21H1) as well as Windows Server 2016 and 2019.\n\nBut while it potentially affects a large number of users, exploitation is not trivial.\n\n\u201cTo exploit, a threat actor would need to pull off a highly complex attack with user interaction \u2013 still entirely possible with the sophisticated attackers of today,\u201d said Peter Pflaster, technical product marketing manager at Automox.\n\nThe bug tracked as CVE-2021-34535\u00a0impacts the Microsoft Remote Desktop Client, Microsoft\u2019s nearly ubiquitous utility for connecting to remote PCs.\n\n\u201cWith today\u2019s highly dispersed workforce, CVE-2021-34535, an RCE vulnerability in Remote Desktop Clients, should be a priority patch,\u201d said Breen. \u201cAttackers increasingly use RDP access as the tip of the spear to gain network access, often combining it with privilege escalation to move laterally.\u00a0 These can be powerful as, depending on the method, it may allow the attacker to authenticate in the network in the same way a user would, making detection difficult.\u201d\n\nIt\u2019s not as dangerous of a bug as BlueKeep,\u00a0according to Childs, which also affected RDP.\n\n\u201cBefore you start having flashbacks to BlueKeep, this bug affects the RDP client and not the RDP server,\u201d he said. \u201cHowever, the CVSS 9.9 bug is nothing to ignore. An attacker can take over a system if they can convince an affected RDP client to connect to an RDP server they control. On Hyper-V servers, a malicious program running in a guest VM could trigger guest-to-host RCE by exploiting this vulnerability in the Hyper-V Viewer. This is the more likely scenario and the reason you should test and deploy this patch quickly.\u201d See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerWindows Print Spooler Bugs \u2013 AgainThe final critical bug is CVE-2021-36936, a Windows Print Spooler RCE bug that\u2019s listed as publicly known.\n\nPrint Spooler made headlines last month, when Microsoft patched what it thought was a minor elevation-of-privilege vulnerability in the service (CVE-2021-1675). But the listing was updated later in the week, after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE \u2013 requiring a new patch.\n\nIt also disclosed a second bug, similar to PrintNightmare (CVE-2021-34527); and a third, an EoP issue\u00a0(CVE-2021-34481).\n\n\u201cAnother month, another remote code-execution bug in the Print Spooler,\u201d said ZDI\u2019s Childs. [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:02.654781Z"}, {"uuid": "b74e2810-89f0-4d50-95e5-c3b2c46f41cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36936", "type": "seen", "source": "https://t.me/hacking_Attack/19794", "content": "Black Hat Ethical Hacking\nActively Exploited Windows Zero-Day Gets a Patch\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Actively Exploited Windows Zero-Day Gets a PatchPost Views: 60 \nReading Time: 2 Minutes\nMicrosoft has patched 51 security vulnerabilities in its scheduled August Patch Tuesday update, including seven critical bugs, two issues that were publicly disclosed but unpatched until now, and one that\u2019s listed as a zero-day that has been exploited in the wild.\nMicrosoft\u2019s August 2021 Patch Tuesday addressed a smaller set of bugs than usual, including more Print Spooler problems, a zero-day and seven critical vulnerabilities.\nOf note, there are 17 elevation-of-privilege (EoP) vulnerabilities, 13 remote code-execution (RCE) issues, eight information-disclosure flaws and two denial-of-service (DoS) bugs.\n\nThe update also includes patches for three more Print Spooler bugs, familiar from the PrintNightmare saga.\n\n\u201cFortunately, it was a lighter month than usual,\u201d said Eric Feldman, senior product marketing manager at Automox, in a Patch Tuesday analysis\u00a0from the vendor. \u201cThis represents a 56 percent reduction in overall vulnerabilities from July, and 33 percent fewer vulnerabilities on average for each month so far this year. We have also seen a similar reduction in critical vulnerabilities this month, with 30 percent less compared to the monthly average.\u201d Windows Critical Security VulnerabilitiesThe seven critical bugs addressed in August\u00a0are as follows:\n\n* CVE-2021-26424 \u2013 Windows TCP/IP RCE Vulnerability\n* CVE-2021-26432 \u2013 Windows Services for NFS ONCRPC XDR Driver RCE Vulnerability\n* CVE-2021-34480 \u2013 Scripting Engine Memory Corruption Vulnerability\n* CVE-2021-34530 \u2013 Windows Graphics Component RCE Vulnerability\n* CVE-2021-34534 \u2013 Windows MSHTML Platform RCE Vulnerability\n* CVE-2021-34535 \u2013 Remote Desktop Client RCE Vulnerability\n* CVE-2021-36936 \u2013 Windows Print Spooler RCE Vulnerability\nSee Also: Auth Bypass Bug Exploited, Affecting Millions of Routers The bug tracked as CVE-2021-26424\u00a0exists in the TCP/IP protocol stack identified in Windows 7 and newer Microsoft operating systems, including servers.\n\n\u201cDespite its CVSS rating of 9.9, this may prove to be a trivial bug, but it\u2019s still fascinating,\u201d said Dustin Childs of Trend Micro\u2019s Zero Day Initiative (ZDI) in his Tuesday analysis. \u201cAn attacker on a guest Hyper-V OS could execute code on the host Hyper-V server by sending a specially crafted IPv6 ping. This keeps it out of the wormable category. Still, a successful attack would allow the guest OS to completely take over the Hyper-V host. While not wormable, it\u2019s still cool to see new bugs in new scenarios being found in protocols that have been around for years.\u201d\n\nThe next bug, CVE-2021-26432\u00a0in Windows Services, is more likely to be exploited given its low complexity status, according to Microsoft\u2019s advisory; it doesn\u2019t require privileges or user interaction to exploit, but Microsoft offered no further details.\n\n\u201cThis may fall into the \u2018wormable\u2019 category, at least between servers with NFS installed, especially since the open network computing remote procedure call (ONCRPC) consists of an External Data Representation (XDR) runtime built on the Winsock Kernel (WSK) interface,\u201d Childs said. \u201cThat certainly sounds like elevated code on a listening network service. Don\u2019t ignore this patch.\u201d\n\nAleks Haugom, product marketing manager at Automox, added, \u201cExploitation results in total loss of confidentiality across all devices managed by the same security authority. Furthermore, attackers can utilize it for denial-of-service attacks or to maliciously modify files. So far, no further details have been divulged by Mic[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:04.090187Z"}, {"uuid": "af844ec3-75cf-4548-a523-38d48216913d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/cissp/3867", "content": "Malware analysis\n1. Some URL shortener services distribute Android malware\nhttps://www.welivesecurity.com/2021/07/20/url-shortener-services-android-malware-banking-sms-trojans\n2. Async RAT\nhttps://blog.bushidotoken.net/2021/07/attack-campaign-analysis-and.html\n3. Formbook Info Stealer:\nFrom a simple keylogger to a top prevalent malware\nhttps://research.checkpoint.com/2021/top-prevalent-malware-with-a-thousand-campaigns-migrates-to-macos\n4. IcedID and Cobalt Strike vs Antivirus\nhttps://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus\n\nOffensive security\nPure Nim implementation for exploiting CVE-2021-36934, the SeriousSAM Local Privilege Escalation\nhttps://github.com/HuskyHacks/ShadowSteal\n\nBlue Team Techniques\nAnalysis of HSTS Caches of Different Browsers\nhttps://insinuator.net/2021/05/analysis-of-hsts-caches-of-different-browsers\n]-> Forensic HSTS Analyzer:\nhttps://github.com/ernw/forensic-hsts-analyzer", "creation_timestamp": "2026-09-02T01:04:32.353618Z"}, {"uuid": "cd70d1d4-1561-4052-99cf-124eeed9a654", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/cissp/5560", "content": "Introduction\nSystem protection and creating restore points\n  CVE-2021-36934 also known as SeriousSAM and HiveNightmare vulnerability was discovered by Jonas Lykkegaard in July 2021. Due to an ACL misconfiguration in Windows 10 post-build 1809 and Windows 11, non-admin users are granted read access to the holy trio of SAM, SYSTEM, and SECURITY files under %windir%\\system32\\config directory. For this to be true, however, system protection has to be turned on and a volume shadow copy has to be created. The name \u2018HiveNightmare\u2019 is derived from a common name \u2018hives\u2019 which refers to the files that have registry data stored.", "creation_timestamp": "2026-09-02T01:04:14.014413Z"}, {"uuid": "ee4dba7c-234b-42d1-89f8-406f30796bb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/cissp/5363", "content": "Vulnerability Remediation Resources\nThe table below provides links to remediation sources for the top 10 exploited vulnerabilities\n  CVE-2021-44228\n  https://logging.apache.org/log4j/2.x/security.html\n \n CVE-2021-22005\nhttps://www.vmware.com/security/advisories/VMSA-2021-0020.html\n\n  CVE-2021-34527\n  https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34527\n \n  CVE-2021-1675\n  https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675\n  \n   CVE-2021-27065\n   https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-27065\n   \n CVE-2021-36934\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-36934\n  \n  CVE-2021-40444\n  https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40444\n  \nCVE-2021-26855\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26855\n \n  CVE-2021-22205\n   https://gitlab.com/gitlab-org/gitlab/-/issues/327121\n  \n  CVE-2021-21551\n https://www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-up-date-for-dell-driver-insufficient-access-control-vulnerability", "creation_timestamp": "2026-09-02T01:04:14.607409Z"}, {"uuid": "9c9eb945-9d9c-4e2e-bfea-32e576c2d214", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/cissp/5362", "content": "CVE-2021-44228 (Log4Shell): Apache Log4j2 - Remote Code Execution (RCE)\n\nCVE-2021-22005: VMware vCenter Server - Arbitrary File Upload\n\nCVE-2021-34527 (PrintNightmare): Windows Print Spooler - RCE\n\nCVE-2021-1675 (PrintNightmare): Windows Print Spooler - Elevation of Privilege\n\nCVE-2021-27065 (ProxyLogon): Microsoft Exchange Server - RCE\n\nCVE-2021-36934: Windows - Elevation of Privilege \n\nCVE-2021-40444: Microsoft MSHTML - RCE\n\nCVE-2021-26855 (ProxyLogon): Microsoft Exchange Server - RCE\n\nCVE-2021-22205: GitLab CE/EE - Remote Code Execution\n\nCVE-2021-21551: Dell - Insufficient Access Control", "creation_timestamp": "2026-09-02T01:04:15.893748Z"}, {"uuid": "d9ac18cd-9d37-442d-b809-abb44260575f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/cissp/4257", "content": "Whitepaper\n\"HiveNightmare aka SeriousSAM\", 2021.\n// It details an overview of CVE-2021-36934 and provides exploitation details", "creation_timestamp": "2026-09-02T01:04:27.660807Z"}, {"uuid": "83ac7183-fb80-4aff-92c1-d8f7d14062a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36934", "type": "seen", "source": "https://t.me/cissp/3916", "content": "The malware started as a simple keylogger over five years ago (later became known as XLoader in February 2020,) and now can steal data from machines running macOS or Windows. XLoader is offered for purchase on multiple forums from prices ranging from $69 (USD) to $139 depending on the site and additional malware features. Formbook/XLoader is capable of keylogging, stealing credentials from web browsers, taking screenshots, and downloading and executing additional files per communication from a command and control server.\nAnalyst Comment: Information stealing is a common and prevalent threat facing individuals and organizations around the world. Education on frequently-used delivery methods such as malspam and phishing emails can help prevent infection. In addition, maintain efficient log management policies to identify potentially abnormal network activity.\nMITRE ATT&CK: [MITRE ATT&CK] Third-party Software - T1072\nTags: Info stealer, Formbook, XLoader, Windows, macOS\nWindows Elevation of Privilege Vulnerability\n(published: July 20, 2021)\nA new Windows 10 vulnerability, assigned CVE-2021-36934 and referred to as HiveNightmare/SeriousSAM, has been found to affect all Windows 10 versions beginning with build 1809. The issue arises from non-admin users being granted read access to any file in the %windir%\\system32\\config directory that can allow for local privilege escalation. If a virtual shadow copy [service] (VSS), which is a Microsoft Windows feature that can create backups or snapshots of files or volumes, of the system is available, a non-admin user can abuse these files for malicious activity.\nAnalyst Comment: Microsoft has issued workarounds for CVE-2021-36934, specifically, to run a command \u201cicacls %windir%\\system32\\config\\*.* /inheritance:e\u201d to delete VSS shadow copies. However, deleting shadow copies could negatively impact restoring operations for Microsoft and third-party services. Microsoft stated, \u201cYou must restrict access and delete shadow copies to prevent exploitation of this vulnerability.\u201d\nTags: Vulnerability, Windows 10, CVE-2021-36934, Privilege escalation\nNew Attacks on Kubernetes via Misconfigured Argo Workflow\n(published: July 20, 2021)\nA new attack vector has been discovered targeting Kubernetes (K8s) clusters through misconfigured Argo Workflows instances, according to Intezer researchers. Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes, according to its documentation. One misconfigured Argo Workflows cluster was found to running a kannix/monero cryptocurrency miner.\nAnalyst Comment: As any system that stores potentially sensitive information, cloud containers need to be configured properly to avoid threat actors from targeting them. Ensure that environments have security policies in place, such as the principle of least privilege, to ensure that permissions are only granted to those on a need-access basis.\nMITRE ATT&CK: [MITRE ATT&CK] Valid Accounts - T1078 | [MITRE ATT&CK] Resource Hijacking - T1496\nTags: Misconfigured, Cryptomining\nDebugging MosaicLoader, One Step at a Time\n(published: July 20, 2021)\nBitdefender researchers have reported their findings on a new malware family dubbed MosaicLoader. The malware was discovered when researchers noticed \u201cprocesses that add local exclusions in Windows Defender for specific file names (prun.exe, appsetup.exe, etc.), that all reside in the same folder, called \\PublicGaming\\.\u201d The malware is delivered through archives masquerading as cracked software installers. That threat actors are then purchasing Google search engine results to boost their malicious archives\u2019 visibility and potential delivery. MosaicLoader can deliver any other kind of malware and utilizes a unique obfuscation technique that shuffles code chunks creating a mosaic-like structure.\nAnalyst Comment: Cracked software is a well-known and common delivery method for malicious payloads or first-stage infections.", "creation_timestamp": "2026-09-02T01:04:31.822769Z"}]}