LegacyHive

Le chercheur anonyme opérant sous le pseudonyme Nightmare Eclipse a publié un exploit d’élévation de privilèges... Le PoC est disponible publiquement sur GitHub.

атакующему заранее понадобится получить локальный доступ, узнать учетные данные обычного пользователя, а также имя учетной записи, которая может принадлежать администратору

a non-admin can modify an admin’s classes registry hive and hijack how that account launches applications or COM objects.

LegacyHive abuses this process by modifying the hive offline, redirecting Local AppData into an attacker-controlled NT Object Manager namespace. When the helper account signs in and the modified hive is loaded, applications follow the redirected path, enabling access to resources associated with the target account.

Using native low-level functions such as NtCreateDirectoryObjectEx and NtCreateSymbolicLinkObject, the exploit constructs a hidden directory hierarchy and symbolic links designed to redirect critical file path resolutions later in the execution flow.

атакующему заранее понадобится получить локальный доступ, узнать учетные данные обычного пользователя, а также имя учетной записи, которая может принадлежать администратору

Next, the attacker modifies the helper account’s ntuser.dat registry hive while it is offline using Microsoft’s native Registry Offline API. This modification alters the Local AppData environment path so that it points directly into the attacker-controlled Object Manager namespace rather than the user’s authentic profile directory.

With the timing mechanism in place, LegacyHive launches a process as the target user using CreateProcessWithLogonW. The goal is not execution; it is forcing Windows to perform a normal profile load using the LOGON_WITH_PROFILE flag.

successful exploitation would allow non-admin users to modify the classes registry hive and gain automatic code execution when the admin account logs into a compromised system.

an attacker can overwrite COM objects or shell extensions that load automatically when the administrator logs in, turning the hijacked hive into a persistence and code-execution mechanism that runs with admin privileges during a normal sign-in.

turning the hijacked hive into a persistence and code-execution mechanism that runs with admin privileges during a normal sign-in.

The attack is staged by a low-privileged user using helper account credentials. Exploitation succeeds only after the helper account authenticates and Windows loads the attacker-modified user profile hive.

атакующему заранее понадобится получить локальный доступ, узнать учетные данные обычного пользователя, а также имя учетной записи, которая может принадлежать администратору

The researcher claims the original exploit did not require additional user credentials and could coerce ProfSvc (and even achieve kernel-level impersonation as NT AUTHORITY\SYSTEM) to load any hive

The attacker triggers a full profile load using CreateProcessWithLogonW configured with the LOGON_WITH_PROFILE flag. This forces Windows to load the tampered hive and activate the redirected paths under the secondary account’s context.

With the timing mechanism in place, LegacyHive launches a process as the target user using CreateProcessWithLogonW. The goal is not execution; it is forcing Windows to perform a normal profile load using the LOGON_WITH_PROFILE flag.

successful exploitation would allow non-admin users to modify the classes registry hive and gain automatic code execution when the admin account logs into a compromised system.

an attacker can overwrite COM objects or shell extensions that load automatically when the administrator logs in, turning the hijacked hive into a persistence and code-execution mechanism that runs with admin privileges during a normal sign-in.

turning the hijacked hive into a persistence and code-execution mechanism that runs with admin privileges during a normal sign-in.

The GitHub repository describes LegacyHive as a “Windows user profile service arbitrary hive load elevation of privileges vulnerability.”

Temporary staging files are cleaned up immediately afterward, but the persistent registry alterations and Object Manager symbolic links remain active.

атакующему заранее понадобится получить локальный доступ, узнать учетные данные обычного пользователя, а также имя учетной записи, которая может принадлежать администратору

The researcher claims the original exploit did not require additional user credentials and could coerce ProfSvc (and even achieve kernel-level impersonation as NT AUTHORITY\SYSTEM) to load any hive

The attacker triggers a full profile load using CreateProcessWithLogonW configured with the LOGON_WITH_PROFILE flag. This forces Windows to load the tampered hive and activate the redirected paths under the secondary account’s context.

a non-admin can modify an admin’s classes registry hive and hijack how that account launches applications or COM objects.

LegacyHive abuses this process by modifying the hive offline, redirecting Local AppData into an attacker-controlled NT Object Manager namespace. When the helper account signs in and the modified hive is loaded, applications follow the redirected path, enabling access to resources associated with the target account.

Using native low-level functions such as NtCreateDirectoryObjectEx and NtCreateSymbolicLinkObject, the exploit constructs a hidden directory hierarchy and symbolic links designed to redirect critical file path resolutions later in the execution flow.

Next, the attacker modifies the helper account’s ntuser.dat registry hive while it is offline using Microsoft’s native Registry Offline API. This modification alters the Local AppData environment path so that it points directly into the attacker-controlled Object Manager namespace rather than the user’s authentic profile directory.

The exploit begins by creating a custom directory hierarchy inside the Windows NT Object Manager — a low-level namespace beneath the Win32 API that most applications never interact with. Under: \BaseNamedObjects\Restricted\<UUID> LegacyHive creates a hidden structure that will later be used to redirect Windows path resolution.