Post by @wdormann@infosec.exchange

So NightmareEclipse has released a new tool called LegacyHive

Either I don't know what it's supposed to do, or it doesn't work.

While the tool is running, there is a new pair of 1003 registry keys loaded into HKEY_USERS. But it's not possible to view its contents. 🤷‍♂️

Regedit attempting to open a 1003 registry key loaded by LegacyHive
Access is denied — Regedit attempting to open a 1003 registry key loaded by LegacyHive Access is denied

Project NightCrawler

LegacyHive

N/A

Mr. Bitterness

@wdormann@infosec.exchange 5 hours ago

OK, so despite the repo being hand-wavy in how you use it, I also didn't try very hard to figure it out. The gist is:

1) Run LegacyHive.exe with another user's credentials, which can be a non-admin user, and the final argument is e.g. an admin user's account name
2) Run regedit.exe as the another user from step 1)
3) At this point you have the Classes registry hive of that admin user loaded in a way where another user (who is not an admin) can access it.

Screenshot of PoC executing, regedit ran as "other" user, and the classes reg hive is showing contents of the admin user's classes reg hive.

Mr. Bitterness

@wdormann@infosec.exchange 5 hours ago

What can you do with this?

Well, the ability of a non-admin user to be able to modify the classes registry hive of an admin user is a pretty powerful primitive.

For example, as a novelty, we can associate .txt files to open with calc.exe

Clever attackers or people who want to accomplish something will easily be able to figure out how to do things that are more interesting and/or don't even require user interaction.