CVE-2021-36934 – HiveNightmare

Fortify Security Team
Jul 27, 2021

Summary

The default configuration in Microsoft Windows 10 v1809 and newer includes an elevation of privilege vulnerability, because of overly permissive Access Control Lists (ACLs) in the Security Accounts Manager (SAM) database, as well as multiple other system files. Upon successful exploitation, an attacker can run arbitrary code with SYSTEM privileges, leading to installation of programs; viewing, changing, or deleting data, or the creation of new accounts with full user rights. Attackers must have the ability to execute code on a victim system to exploit this vulnerability.

At this time, mitigation includes restricting access to Windows configuration files, then deleting VSS shadow copies, as detailed below.

Applies To

  • Windows 10 Version 21H1: 32-bit, x64, and ARM641
  • Windows 10 Version 2004: 32-bit
  • Windows 10 Version 1909: 32-bit, x64, and ARM641
  • Windows 10 Version 1809: 32-bit, x64, and ARM641
  • Windows Server Core 2019
  • Windows Server 2019

How do I see if I’m impacted?

You can run the following from cmd.exe to check the permissions on various hives:

Command Prompt: icacls %windir%\system32\config\SAM
PowerShell: icacls $env:windir\System32\config\SAM

If impacted, the expected output would be as follows:

C:\Users\andrew>icacls C:\Windows\System32\config\SAM
C:\Windows\System32\config\SAM BUILTIN\Administrators:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Users:(I)(RX)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)

Successfully processed 1 files; Failed processing 0 files

A vulnerable system will report an output indicating the hive is read accessible (RX): BUILTIN\Users:(I)(RX)

What are the current mitigation steps?

Restrict access to the contents of %windir%\system32\config

  1. Open Command Prompt or Windows PowerShell as an administrator.
  2. Run this command in either:
    • Command Prompt:
      icacls %windir%\system32\config\*.* /inheritance:e
    • PowerShell:
      icacls $env:windir\system32\config\. /inheritance:e

Delete Volume Shadow Copy Service (VSS) shadow copies

Note: This step is a modified version of the Microsoft MSRC article’s guidance.

In order to implement Microsoft’s workaround with our recommended policy settings, use the following PowerShell .PS1 script. This can be run locally on your systems or remotely via Real Time Response.

Get-WmiObject Win32_Shadowcopy | ForEach-Object {
Write-Host “Deleting VSS ” $_.ID.ToLower()
$cmd = “delete shadows /shadow=” + $_.ID.ToLower() + ” /quiet”
Start-Process -FilePath $env:SystemRoot\system32\vssadmin.exe -ArgumentList $cmd -Wait
}

Once you have deleted the VSS shadow copies and restore points, create a new System Restore point if desired.

Impact of workaround: Deleting shadow copies could impact restore operations, including the ability to restore data with third-party backup applications.

Note: You must restrict access and delete shadow copies to prevent exploitation of this vulnerability.

Proof of Concept

Available here or run this command from a non-admin PowerShell prompt:

foreach($i in @(“SYSTEM”,”SAM”)){[System.IO.File]::Copy(\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\$i, “$i”)};

Recent Posts

IOCs Associated with Ranzy Locker Ransomware

The FBI first identified Ranzy Locker ransomware in late 2020 when the variant began to target victims in the United States. Unknown cyber criminals using Ranzy Locker ransomware had compromised more than 30 US businesses as of July 2021. The victims include the...

Conti Ransomware

While Conti is considered a ransomware-as-a-service (RaaS) model ransomware variant, there is variation in its structure that differentiates it from a typical affiliate model. It is likely that Conti developers pay the deployer's of the ransomware a wage rather than a...

CVE-2021-1675 and CVE-2021-34527 – PrintNightmare

Fortify 24x7 is tracking various public weaponized exploits for a remote code execution vulnerability affecting the Windows Print Spooler service (spoolsv.exe): CVE-2021-1675 and an out of band patch for CVE-2021-34527, also known as PrintNightmare. The vulnerability...

Kaseya IOC

Indicators of Compromise agent.crt encoded dropper 2093c195b6c1fd6ab9e1110c13096c5fe130b75a84a27748007ae52d9e951643 agent.exe dropper d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e Payloads...

Increase in PYSA Ransomware Targeting Education Institutions

FBI reporting has indicated a recent increase in PYSA ransomware targeting education institutions in 12 US states and the United Kingdom. PYSA, also known as Mespinoza, is a malware capable of exfiltrating data and encrypting users’ critical files and data stored on...

Microsoft IOC Detection Tool for Exchange Server vulnerabilities

Microsoft has released the EOMT.ps1 tool that can automate portions of both the detection and patching process and help your organization check for indicators of compromise (IOCs) by running the Microsoft IOC Detection Tool for Exchange Server Vulnerabilities. In...

Trickbot Hash List

f2874391df65d47da6e5b72c904fd8d91c85232382dad677bb074767e51ffd85 879e8fc3f83f3444f12ca1f98389a1f5ee8c90deb713e33b35456ade8261ee91 7b7c58829aa5ead726e159c20def670e430b67d4cb995df00bc619edcde246c8 d07a963a14b759050f21fe96335876ff2bddd7c4a301c6625a6dba55c634310b...