CVE-2021-36934
published 2021-07-22CVE-2021-36934: An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security…
PriorityP185high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-02-24
Exploited in the wild
EPSS
67.25%
99.2th percentile
An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
An attacker must have the ability to execute code on a victim system to exploit this vulnerability.
After installing this security update, you must manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. Simply installing this security update will not fully mitigate this vulnerability. See KB5005357- Delete Volume Shadow Copies.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1809 | < 10.0.17763.2114 | 10.0.17763.2114 |
| microsoft | windows_10_1909 | < 10.0.18363.1734 | 10.0.18363.1734 |
| microsoft | windows_10_2004 | < 10.0.19041.1165 | 10.0.19041.1165 |
| microsoft | windows_10_20h2 | < 10.0.19042.1165 | 10.0.19042.1165 |
| microsoft | windows_10_21h1 | < 10.0.19043.1165 | 10.0.19043.1165 |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.2114 | 10.0.17763.2114 |
| microsoft | windows_10_version_1909 | >= 10.0.0 < 10.0.18363.1734 | 10.0.18363.1734 |
| microsoft | windows_10_version_2004 | >= 10.0.0 < 10.0.19041.1165 | 10.0.19041.1165 |
| microsoft | windows_10_version_20h2 | >= 10.0.0 < 10.0.19042.1165 | 10.0.19042.1165 |
| microsoft | windows_10_version_21h1 | >= 10.0.0 < 10.0.19043.1165 | 10.0.19043.1165 |
| msrc | windows_10_version_1809_for_32-bit_systems | — | — |
| msrc | windows_10_version_1809_for_arm64-based_systems | — | — |
| msrc | windows_10_version_1809_for_x64-based_systems | — | — |
| msrc | windows_10_version_1909_for_32-bit_systems | — | — |
| msrc | windows_10_version_1909_for_arm64-based_systems | — | — |
| msrc | windows_10_version_1909_for_x64-based_systems | — | — |
| msrc | windows_10_version_2004_for_32-bit_systems | — | — |
| msrc | windows_10_version_2004_for_arm64-based_systems | — | — |
| msrc | windows_10_version_2004_for_x64-based_systems | — | — |
| msrc | windows_10_version_20h2_for_32-bit_systems | — | — |
| msrc | windows_10_version_20h2_for_arm64-based_systems | — | — |
| msrc | windows_10_version_20h2_for_x64-based_systems | — | — |
| msrc | windows_10_version_21h1_for_32-bit_systems | — | — |
| msrc | windows_10_version_21h1_for_arm64-based_systems | — | — |
| msrc | windows_10_version_21h1_for_x64-based_systems | — | — |
Detection & IOCsextracted from sources · hover to see the quote
sigma↗
.*?HarddiskVolumeShadowCopy[0-9]+\Windows\System32\config\SAM.*?
sigma↗
.*?cmd.*?mklink.*?HarddiskVolumeShadowCopy.*?
- →Monitor for any process reading files under HarddiskVolumeShadowCopy paths targeting Windows\System32\config\SAM — this is the primary exploitation pattern for CVE-2021-36934. ↗
- →Detect symbolic link creation referencing HarddiskVolumeShadowCopy via cmd mklink, PowerShell, or fsutil.exe — used to access locked hive files from shadow copies. ↗
- →Alert on execution of 'vssadmin list shadows' by non-administrative or unexpected processes, as attackers use this to enumerate available Volume Shadow Copies before extracting SAM/SYSTEM hives. ↗
- →Detect use of CERTUTIL to dump SAM database contents to the TEMP folder — a key post-exploitation step in HiveNightmare attacks. ↗
- →Check ACL permissions on C:\Windows\System32\config\SAM; if BUILTIN\Users has RX (Read+Execute) access, the system is vulnerable and may already be targeted. ↗
- →Map detections to MITRE ATT&CK T1003.002 (Credential Dumping: SAM), T1552.001 (Credentials in Files), T1218 (Signed Binary Proxy Execution), T1202 (Indirect Command Execution), and T1012 (Query Registry) for CVE-2021-36934 activity. ↗
- →Post-exploitation Metasploit module targets SAM and SYSTEM hive extraction via Volume Shadow Copy; once dumped to store_loot, hashes can be cracked with secretsdump.py. ↗
- ·Exploitation requires Volume Shadow Copies to be present on the target system; if no VSS snapshots exist, the primary attack path is blocked. ↗
- ·Installing the Microsoft security update alone is insufficient — shadow copies of system files including the SAM database must also be manually deleted to fully mitigate the vulnerability. ↗
- ·Exploitation requires the attacker to already have code execution on the victim system; this is a local privilege escalation, not a remote unauthenticated attack. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
vulncheck7.8HIGH
cisa7.8HIGH
vendor_msrc7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Microsoft Windows SAM Local Privilege Escalation Vulnerability
cisa·2022-02-10·CVSS 7.8
CVE-2021-36934 [HIGH] CWE-1220 Microsoft Windows SAM Local Privilege Escalation Vulnerability
Vulnerability: Microsoft Windows SAM Local Privilege Escalation Vulnerability
Affected: Microsoft Windows
If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2021-36934
Remediation Due Date: 2022-02-24
Microsoft
Windows Elevation of Privilege Vulnerability
vendor_msrc·2021-07-13·CVSS 7.8
CVE-2021-36934 [HIGH] Windows Elevation of Privilege Vulnerability
Windows Elevation of Privilege Vulnerability
Description: An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
An attacker must have the ability to execute code on a victim system to exploit this vulnerability.
After installing this security update, you must manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. Simply installing this security update will not fully mitigate this
VulnCheck
Microsoft Windows SAM Local Privilege Escalation Vulnerability
vulncheck·2021·CVSS 7.8
CVE-2021-36934 [HIGH] CWE-1220 Microsoft Windows SAM Local Privilege Escalation Vulnerability
Microsoft Windows SAM Local Privilege Escalation Vulnerability
If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.
Affected: Microsoft Windows
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.welivesecurity.com/wp-content/uploads/2022/02/eset_threat_report_t32021.pdf; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://asec.ahnlab.com/en/38156/; https://www.group-ib.com/resources/research-hub/sidewinder-apt/; https://redalert.nshc.net/2024/03/19/activity-of-hacking-group-targeted-financial-industry-in-2023-kor/; https://redalert.nshc.net/2024/04/12/activity-of-hacking-group-targeted-fi
No detection rules found.
Metasploit
Windows SAM secrets leak - HiveNightmare
metasploit
Windows SAM secrets leak - HiveNightmare
Windows SAM secrets leak - HiveNightmare
Due to mismanagement of SAM and SYSTEM hives in Windows 10, it is possible for an unprivileged user to read those files. But, as they are locked while Windows is running we are not able to read them directly. The trick is to take advantage of Volume Shadow Copy, which is generally enabled, to finally have a read access. Once SAM and SYSTEM files are successfully dumped and stored in `store_loot`, you can dump the hashes with some external scripts like secretsdump.py
Nuclei
MOVEit Transfer - SQL Injection
nuclei·CVSS 9.1
CVE-2023-36934 [CRITICAL] MOVEit Transfer - SQL Injection
MOVEit Transfer - SQL Injection
In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.
Template:
id: CVE-2023-36934
info:
name: MOVEit Transfer - SQL Injection
author: rootxharsh,iamnoooob,pdresearch
severity: critical
description: |
In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (1
Qualys
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
blogs_qualys·2022-02-23
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
#### Table of Contents
- Situation
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISA Vulnerabilities Using Qualys VMDR
- CISA Exploited RTI
- Detailed Operational Dashboard
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
CISA released a directive in November 2021, recommending urgent and prioritized remediation of actively exploited vulnerabilities. Both government agencies and corporations should heed this advice. This blog outlines how Qualys Vulnerability Management, Detection & Response can be used by any organization to respond to this directive efficiently and effectively.
## Situation
Last November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directiv
Securelist
IT threat evolution in Q3 2021. PC statistics
blogs_securelist·2021-11-26
IT threat evolution in Q3 2021. PC statistics
Table of Contents
Quarterly figures
Financial threats
Financial threat statistics
Ransomware programs
Quarterly trends and highlights
Attack on Kaseya and the REvil story
The arrival of BlackMatter: DarkSide restored?
Q3 closures
Exploitation of vulnerabilities and new attack methods
Number of new ransomware modifications
Number of users attacked by ransomware Trojans
Geography of ransomware attacks
Top 10 most common families of ransomware Trojans
Miners
Number of new miner modifications
Number of users attacked by miners
Geography of miner attacks
Vulnerable applications used by cybercriminals during cyberattacks
Quarter highlights
Statistics
Attacks on macOS
Geography of threats for macOS
IoT attacks
IoT threat statistics
Attacks via web resources
Countries tha
Securelist
IT threat evolution in Q3 2021. PC statistics
blogs_securelist·2021-11-26
IT threat evolution in Q3 2021. PC statistics
Table of Contents
- Quarterly figures
- Financial threats
- Ransomware programs
- Number of users attacked by ransomware Trojans
- Geography of ransomware attacks
- Top 10 most common families of ransomware Trojans
- Miners
- Vulnerable applications used by cybercriminals during cyberattacks
- Attacks on macOS
- IoT attacks
- Attacks via web resources
- Local threats
Authors
- AMR
- IT threat evolution Q3 2021
- IT threat evolution in Q3 2021. PC statistics
- IT threat evolution in Q3 2021. Mobile statistics
These statistics are based on detection verdicts of Kaspersky products received from users who consented to providing statistical data.
## Quarterly figures
According to Kaspersky Security Network, in Q3 2021:
- Kaspersky solutions blocked 1,098,968,315 attacks from online reso
Sentinelone
HiveNightmare | Protecting Windows 10 Security Account Manager Against CVE-2021-36934
blogs_sentinelone·2021-08-05·CVSS 7.8
CVE-2021-36934 [HIGH] HiveNightmare | Protecting Windows 10 Security Account Manager Against CVE-2021-36934
It has been a tough few weeks for many enterprise security teams fighting a series of severe bugs in Microsoft Windows 10. Shortly after being ‘all hands on deck’ dealing with the remote code execution (RCE) vulnerability dubbed PrintNightmare, IT admins and security teams were plunged into another unexpected crisis thanks to the emergence of the unrelated but familiar sounding ‘HiveNightmare’ bug, aka SeriousSAM.
More formerly tracked as CVE-2021-36934, HiveNightmare is a local privilege escalation (LPE) that allows any standard user to achieve SYSTEM privileges, with all the security headaches that that entails: the ability to install malware, delete data, create new user accounts and pretty much conduct any other malicious behavior so desired.
Although HiveNightmare requires an attack
Sentinelone
HiveNightmare | Protecting Windows 10 Security Account Manager Against CVE-2021-36934
blogs_sentinelone·2021-08-05·CVSS 7.8
CVE-2021-36934 [HIGH] HiveNightmare | Protecting Windows 10 Security Account Manager Against CVE-2021-36934
It has been a tough few weeks for many enterprise security teams fighting a series of severe bugs in Microsoft Windows 10. Shortly after being ‘all hands on deck’ dealing with the remote code execution (RCE) vulnerability dubbed PrintNightmare , IT admins and security teams were plunged into another unexpected crisis thanks to the emergence of the unrelated but familiar sounding ‘HiveNightmare’ bug, aka SeriousSAM.
More formerly tracked as CVE-2021-36934 , HiveNightmare is a local privilege escalation (LPE) that allows any standard user to achieve SYSTEM privileges, with all the security headaches that that entails: the ability to install malware, delete data, create new user accounts and pretty much conduct any other malicious behavior so desired.
Although HiveNightmare requires an atta
Sentinelone
CVE-2021-3122 | How We Caught a Threat Actor Exploiting NCR POS Zero Day
blogs_sentinelone·2021-07-22·CVSS 9.8
CVE-2021-3122 [CRITICAL] CVE-2021-3122 | How We Caught a Threat Actor Exploiting NCR POS Zero Day
A guest post by Kyle Pagelow from Tetra Defense
In this post, we describe how our Incident Response team discovered and thwarted a threat actor stealing credit card data by exploiting a zero day RCE (remote code execution) vulnerability in NCR’s Aloha Point of Sale software, widely used in the catering and restaurant industries.
Our investigation led us to discover and report CVE-2021-3122 . While Tetra Defense successfully defended the client’s business, removing the threat actor’s access from the client’s network and mitigating the entire infection chain, a large number of other potential victims are readily discoverable, many of whom could be actively exploited today.
According to the vendor , CVE-2021-3122 is a client misconfiguration, and it appears that it is up to each client usi
Threat Intel
APT29 (APT29, IRON RITUAL, IRON HEMLOCK)
threat_intel
APT29 (APT29, IRON RITUAL, IRON HEMLOCK)
# Threat Actor Profile: APT29
ATT&CK ID: G0016
Also known as: APT29, IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo, NOBELIUM, UNC2452, YTTRIUM, The Dukes, Cozy Bear, CozyDuke, SolarStorm, Blue Kitsune, UNC3524, Midnight Blizzard
Suspected origin: Russia
## Overview
APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).(Citation: White House Imposing Costs RU Gov April 2021)(Citation: UK Gov Malign RIS Activity April 2021) They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.(Citation: F-Secure The Dukes)(Citation: GRIZZLY STEPPE JAR)(Citation: Crowdstrike DN
http://packetstormsecurity.com/files/164006/HiveNightmare-AKA-SeriousSAM.htmlhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36934http://packetstormsecurity.com/files/164006/HiveNightmare-AKA-SeriousSAM.htmlhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36934https://www.kb.cert.org/vuls/id/506989https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36934
2021-07-22
Published
2022-02-10
Added to CISA KEV
Exploited in the wild