LegacyHive Windows Zero-Day Lets Attackers Hijack Administrator Registry Hives

A newly disclosed local privilege escalation technique allows non-administrator Windows users to tamper with an administrator’s registry hive, opening the door to code execution at the administrator’s next login. Security researcher Will Dormann detailed the flaw after examining a proof-of-concept tool called LegacyHive, released by developer NightmareEclipse on a self-hosted Git instance. LegacyHive exploits inconsistent […] The post LegacyHive Windows Zero-Day Lets Attackers Hijack Administrator Registry Hives appeared first on Cyber Security News.

A newly disclosed local privilege escalation technique allows non-administrator Windows users to tamper with an administrator’s registry hive, opening the door to code execution at the administrator’s next login. Security researcher Will Dormann detailed the flaw after examining a proof-of-concept tool called LegacyHive, released by developer NightmareEclipse on a self-hosted Git instance. LegacyHive exploits inconsistent access-control enforcement in how Windows loads a user’s usrClass.dat file, the registry hive backing HKEY_CURRENT_USER\Classes, which stores file associations and COM object registrations. LegacyHive Windows Zero-Day The attack chain runs in three steps. An attacker runs LegacyHive.exe under the credentials of any non-admin user, passing an administrator’s account name as the final argument. The attacker then launches regedit.exe under that same non-admin identity. At this point, the administrator’s Classes hive appears loaded under HKEY_USERS, now accessible to a user who should not have permission to interact with it. Dormann’s Process Monitor analysis revealed the root cause. When LegacyHive first attempts to access the admin’s usrClass.dat while impersonating the non-admin user, Windows correctly returns an ACCESS DENIED error. However, the User Profile Service (ProfSvc) retries the operation using NT AUTHORITY\SYSTEM privileges, and this second attempt succeeds. The registry hive then remains accessible to the original non-admin user, effectively granting unauthorized access through a SYSTEM-level fallback. Once write access to the admin’s Classes hive is achieved, the attack surface expands significantly. Dormann demonstrated a simple proof-of-concept by modifying the .txt file association to launch Calculator instead of Notepad, showing how registry manipulation can alter expected system behavior. More advanced exploitation involves overwriting COM object registrations that are triggered during user login. Because these COM objects execute within the context of the logged-in user, an attacker can achieve automatic code execution with administrator privileges when the targeted admin logs in. This method requires no further interaction beyond a routine login, making it both reliable and stealthy. Security researcher James Forshaw highlighted that similar behavior has been observed before. In earlier Project Zero reports, he demonstrated how SYSTEM-level Classes keys could be hijacked for arbitrary code execution and file creation, suggesting that this impersonation behavior may stem from long-standing design issues within Windows. These include RoguePlanet, which targeted Microsoft Defender to obtain SYSTEM privileges, and BlueHammer, a widely discussed exploit impacting core Windows mechanisms. Additional disclosures such as RedSun further demonstrated Defender-related privilege escalation paths, while YellowKey and GreenPlasma exposed weaknesses in BitLocker that could allow access to protected drives. Dormann characterized the issue as a legitimate local privilege escalation vector, emphasizing that a low-privileged user can interfere with or hijack an administrator’s environment. This is particularly concerning in shared or multi-user systems where such access boundaries are critical. Because the malicious activity occurs within the administrator’s own session, it can appear to be normal behavior, complicating detection efforts for security teams relying on behavioral analysis. At the time of writing, Microsoft has not assigned a CVE or released a patch addressing the underlying issue in the User Profile Service. Until a fix is available, organizations are advised to limit local access for untrusted users and monitor for suspicious modifications to registry hives, especially those associated with administrator profiles and COM object registrations. Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOCs The post LegacyHive Windows Zero-Day Lets Attackers Hijack Administrator Registry Hives appeared first on Cyber Security News.