POC详情： 548ed57e0640a8d2938fd9a45bf3e59d84fa9aa4

来源
https://github.com/VertigoRay/CVE-2021-36934
关联漏洞
标题： Microsoft Windows 访问控制错误漏洞 (CVE-2021-36934)
描述：Microsoft Windows是美国微软（Microsoft）公司的一种桌面操作系统。 Microsoft Windows 存在访问控制错误漏洞，该漏洞源于系统对多个系统文件的访问控制列表过于宽松，因此存在特权提升漏洞。成功利用此漏洞的攻击者可以使用SYSTEM权限运行任意代码。
描述
Windows Elevation of Privilege Vulnerability (SeriousSAM)
介绍
[CVE described on MSRC](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934).
[Remediated](https://www.dataprise.com/resources/blog/microsoft-windows-10-vss-vulnerability-defense-digest) using ECM (aka SCCM) Config Items:

- See the remediation and Discovery scripts in repo.
- Config Item does a boolean `$false` check for compliance.

# Remediation

In production, we found the need to remediate purge copies other than `ClientAccessible` ones; we've seen `Backup` and `DataVolumeRollback` types that couldn't be *deleted*.
Unfortunately, `vssadmin` cleary states that "only shadow copies that have the `ClientAccessible` type can be deleted."
In order to purge them anyway, we needed to shrink the size of the storage down to the smallest amount allowed (320MB); this will cause Windows to purge the *oversized* shadow copy.
We then bring it back to a normal/unbounded size.
文件快照

 [4.0K]  /data/pocs/548ed57e0640a8d2938fd9a45bf3e59d84fa9aa4
├── [ 409]  Discovery.ps1
├── [ 895]  README.md
└── [ 868]  Remediation.ps1

0 directories, 3 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。