A flaw in all versions of Windows 10 and Server 2019 released since November 2018 leaves the Security Account Manager file which contains all the hashed credentials for the PC, open for any user to read.

Microsoft has issued a security advisory to track their investigations, but no permanent solution has been released – although a mitigation is available which is detailed below.  The flaw, dubbed SeriousSAM, was introduced in the Windows 10 release 1809, released back in November 2018 and also affects the matching versions of Windows Server 2019.

The Security Account Manager (SAM) file contains copies of hashed credentials previously used on the PC – which includes the original Windows installation password and the keys used to secure all the private keys on the computer stored under the windows Data Protection API.  Ultimately, this will allow a silver ticket attack or pass the hash attack to be performed against the Windows domain.

This vulnerability is a change in the default security of the SAM file, giving all members of the BUILTINUsers read access to the security database. In normal operation, however, the contents of the SAM file cannot be accessed due to the way the it is locked by the running Operating System. But, if VSS shadow copies are enabled on the computer, the backup of the SAM file in the shadow copy can be read by any user and the credentials extracted.  VSS shadow copies can be automatically created simply by running Windows Update or installing an MSI package on the computer.

To check if a system is vulnerable to SeriousSAM, two steps need to be followed – first to confirm if any VSS shadow copies exist and then to check the read permissions on those shadow copies.

To check if any VSS shadow copies exist, issue the following command from an admin privileged command prompt:

vssadmin list shadows

If any are listed, check their security by issuing the following command from a non-admin command prompt:

icacls %windir%system32configsam

If an Access is Denied response is given, the SAM file is secure – else it is vulnerable.

To secure the SAM file, follow the instructions provided by Microsoft in their security advisory which involves re-securing and deleting the VSS shadow copies as a temporary mitigation.