3 ms·
LegacyHive: Windows user profile service arbitrary hive load elevation of priv
- marak830 3mo agoNightCrawler released another window's vuln. From what I can understand of it: * Read the target user's NTUSER.DAT hive into memory as a backup. * Open the hive offline using the Offline Registry (offreg) API. * Modify HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData to point at \\.\GlobalRoot\BaseNamedObjects\Restricted. * Save the modified hive and replace the original NTUSER.DAT. * Copy the user's UsrClass.dat into the temporary working directory. * Acquire a batch oplock on the copied UsrClass.dat to synchronize execution with profile loading. * Start a suspended process using CreateProcessWithLogonW(..., LOGON_WITH_PROFILE, ...), triggering the User Profile Service to load the profile. * Wait for the oplock to break when Windows attempts to access UsrClass.dat https://blog.projectnightcrawler.dev/posts/2026-07-14-legacyhive-public-disclosure/ https://blog.projectnightcrawler.dev/posts/2026-07-14-legacy... update: formatting :s