CVE-2021-36934 PoC — Microsoft Windows 访问控制错误漏洞

Description

Windows Elevation of Privilege Vulnerability (SeriousSAM)

介绍

[CVE described on MSRC](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934).
[Remediated](https://www.dataprise.com/resources/blog/microsoft-windows-10-vss-vulnerability-defense-digest) using ECM (aka SCCM) Config Items:

- See the remediation and Discovery scripts in repo.
- Config Item does a boolean `$false` check for compliance.

# Remediation

In production, we found the need to remediate purge copies other than `ClientAccessible` ones; we've seen `Backup` and `DataVolumeRollback` types that couldn't be *deleted*.
Unfortunately, `vssadmin` cleary states that "only shadow copies that have the `ClientAccessible` type can be deleted."
In order to purge them anyway, we needed to shrink the size of the storage down to the smallest amount allowed (320MB); this will cause Windows to purge the *oversized* shadow copy.
We then bring it back to a normal/unbounded size.

文件快照

备注