d4yon/cve-2021-36934-hivenightmare-labEducational lab demonstrating CVE-2021-36934 (HiveNightmare) - Windows LPE via shadow copy ACL misconfiguration.
Reproduce and analyze the HiveNightmare vulnerability in a controlled lab environment.
CVE-2021-36934, nicknamed "SeriousSAM" or "HiveNightmare", is a local privilege escalation (LPE) vulnerability affecting Windows 10 from version 1809 onwards, initial versions of Windows 11, as well as Windows Server 2019 and 2022. It allows a standard user to duplicate and access protected system files containing sensitive data, such as local password hashes. The core issue lies in misconfigured Access Control Lists (ACLs), granting read permissions to all users on sensitive system files (notably the SAM, SYSTEM, and SECURITY hives). While these files remain locked during normal operation, their backup copies (via shadow copies/restore points) inherit the same misconfigured permissions and become accessible and exploitable by any system user.
Exploiting the vulnerability requires two prerequisites: (1) System Protection enabled and (2) an existing restore point. These elements are often present by default on Windows 10/11 machines. The implementation relies on extracting copies of the SAM, SYSTEM, and SECURITY files from shadow copies (restore points). These files, normally locked during system execution, become accessible via their snapshot copies which inherit the same ACLs as the originals.
From an unprivileged user account, exploitation can be achieved via public scripts, the most well-known being hivenightmare.exe, written in C. The three recovered files have complementary roles. SAM contains the hashes of local account passwords (encrypted), SECURITY stores additional LSA secrets (cached credentials, service passwords, also encrypted), and SYSTEM provides the decryption key (BootKey). For strict local privilege escalation, only SAM and SYSTEM are necessary to extract NTLM hashes. Once these files are obtained, tools like secretsdump.py or mimikatz can decrypt the hashes and perform pass-the-hash attacks, or gain full administrator access via psexec.py.
The exploit implementation relies on extracting Windows hives (SAM, SYSTEM, SECURITY) from shadow copies/restore points, then using the extracted hashes to obtain SYSTEM access via secretsdump.py and psexec.py.
Tested platform: Windows 10, build 1903 (December 2020 update).
1. Context: Windows Version We are using a Windows 10 version (1903, Dec. 2020 update) that contains the vulnerability under study.
2. Permissions on Sensitive Files We observe that NTFS permissions on the SAM, SYSTEM, and SECURITY hives allow local users to have Read access, inherited here from the config folder.
3. Running hivenightmare from a Local User Without Restore Point When launching hivenightmare.exe from a local account without restore points/shadow copies, the tool fails because it cannot find any restore points to exploit.
4. Enabling System Protection and Creating a Restore Point
To create the necessary conditions for hive extraction, we enable System Protection then manually create a restore point. Once the restore point exists, hivenightmare will be able to access copies of the sensitive files.
5. Extracting Sensitive Hives After creating the restore point, hivenightmare.exe is launched again and successfully extracts the SAM, SYSTEM, and SECURITY files from the shadow copy. There are many other scripts (C#, Go, PowerShell,...). Regardless of the technology used, all scripts target the same path:
\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy[i]\Windows\System32\config\[SENSITIVE FILE]
6. Analysis on Kali: Retrieving Hashes with secretsdump.py The extracted files are transferred to the Kali machine. We use secretsdump.py (Impacket) to list accounts and retrieve hashes in plaintext.
7. Privilege Escalation: Hash Reuse via psexec.py With the extracted hash, we use psexec.py to authenticate and open a session with SYSTEM privileges, granting full control of the machine.
Microsoft's official fix (KB5004605, July 2021) restores appropriate ACLs on the affected files. However, several complementary measures are recommended. First, manually verify permissions on C:\Windows\System32\config to ensure that only SYSTEM and administrators have full access. Second, delete old shadow copies created before applying the patch, as they retain the vulnerable permissions. For operational reasons (risk of data loss, user impact), automatic deletion of old restore points was not included in the distributed patch. Finally, monitor unusual access to shadow copies through system event logs.
Here we demonstrate how to mitigate the vulnerability through manual ACL correction and deletion of previous shadow copies.
1. Manual ACL Correction This command breaks inheritance on the C:\Windows\System32\config folder.
2. Verification After ACL Correction The existence of the restore point created before the correction still allows extracting hives from the associated shadow copy.
3. Shadow Copy Deletion
4. Final Validation After deleting old shadow copies, hive extraction fails and the vulnerability is no longer exploitable from a local account.
CVE-2021-36934 demonstrates how a simple ACL misconfiguration can completely compromise Windows system security. The vulnerability exploits a security feature (restore points) turned into an attack vector, allowing an unprivileged and potentially malicious user to gain full administrator access. In conclusion, CVE-2021-36934 highlights the necessity of regularly auditing system permissions and monitoring access to sensitive files, even in their backup copies.
For educational purposes only. Do not use on systems without authorization.