Post #3815945
2026-07-14 19:11 UTC
@jerry@infosec.exchange @kallisti@infosec.exchange @cR0w@infosec.exchange I would have at least appreciated a writeup explaining why this was worth hyping.
Like... explain the kill chain here please?
Replies (2)
-
@kallisti@infosec.exchange 2026-07-14 19:19
@Epic_Null@infosec.exchange @jerry@infosec.exchange @cR0w@infosec.exchange One idea I have is LPE. Have a non-admin user mount a localadmins user hive and place an implant in Software\Microsoft\Windows\CurrentVersion\Run
-
@cR0w@infosec.exchange 2026-07-14 19:22
@Epic_Null@infosec.exchange @jerry@infosec.exchange @kallisti@infosec.exchange Blog post didn't help: https://blog.projectnightcrawler.dev/posts/2026-07-14-legacyhive-public-disclosure/ But my understanding is that there is a way to load and modify another user's registry hive. The PoC requires another user's creds but apparently it's doable without that.