home.social

#legacyhive — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #legacyhive, aggregated by home.social.

fetched live
  1. The New Oil @[email protected] ·

    #Microsoft patches #LegacyHive #Windows zero-day vulnerability

    bleepingcomputer.com/news/micr

    #cybersecurity

    #microsoft #legacyhive #windows #cybersecurity
  2. Günter Born @[email protected] ·

    Inoffizieller Fix für #Windows Schwachstelle #LegacyHive

    borncity.com/blog/2026/07/22/0

    #windows #legacyhive
  3. The New Oil @[email protected] ·

    #Windows #LegacyHive zero-day flaw gets free, unofficial patches

    bleepingcomputer.com/news/secu

    #cybersecurity #Microsoft

    #windows #legacyhive #cybersecurity #microsoft
  4. :rss: 窓の杜 @[email protected] ·

    先週のセキュリティ情報まとめ ～13本の脆弱性修正ニュースを掲載／ご自分の使っているツールが対象になっていないか、ご確認を。【やじうまの杜】
    forest.watch.impress.co.jp/doc

    #forest_watch_impress #Adobe #Firefox #Google_Chrome #Windows_Update #Zoom #7_Zip #Tera_Term #LINE #nginx #LegacyHive #システム_ファイル #システム #Windows

    #forest_watch_impress #adobe #firefox #google_chrome #windows_update #zoom
  5. maniabel @[email protected] ·

    Kritische Lücke in WordPress: Sofort updaten!
    ZeroDay in Windows...
    maniabel.de
    #WordPress #wp2shell #Windows #LegacyHive #infosec #BeDiA

    #wordpress #wp2shell #windows #legacyhive #infosec #bedia
  6. Tarnkappe.info @[email protected] ·

    📬 LegacyHive: Neuer Windows-Zero-Day hebelt selbst vollständig gepatchte Systeme aus
    #Cyberangriffe #ITSicherheit #Exploit #ITSicherheit #LegacyHive #MicrosoftWindows #PrivilegeEscalation #Rechteausweitung #SYSTEMRechte #UserProfileServiceProfSvc #WindowsSicherheitslücke #WindowsZeroDay sc.tarnkappe.info/43a283

    #cyberangriffe #itsicherheit #exploit #legacyhive #microsoftwindows #privilegeescalation
  7. :rss: 窓の杜 @[email protected] ·

    Windowsに新たなゼロデイ脆弱性「LegacyHive」、最新パッチ適用済みでも悪用可能との報告／「User Profile Service」にローカル特権昇格、システム全体を乗っ取れる
    forest.watch.impress.co.jp/doc

    #forest_watch_impress #Windows #脆弱性 #LegacyHive #MSNightmare #セキュリティ

    #forest_watch_impress #windows #脆弱性 #legacyhive #msnightmare #セキュリティ
  8. Kallisti @[email protected] ·

    Maybe a bit of an explanation why it does this:

    When a new user is logging on, Windows needs to load the users class hive. Since the user isn't logged on before logging on (tautology, I know), it can't be loaded in the context of the user. So it is loaded in the context of NT AUTHORITY\SYSTEM.

    LegacyHive abuses this.

    It messes with the Windows Object Manager and instead of the actual UsrClass.dat hive points at C:\randomGUID\UsrClass.dat. then it places an oplock on that file and starts an (interactive) logon for the user whose Object Manager path has been manipulated.
    This leads Windows to try to open the file, but it can't, because of the Oplock. So the process looks at the Object Manager namespace again, finds a symlink (also manipulated by LegacyHive) and loads that instead, attaching it as the class hive for the user it is trying to create an interactive session for.
    The load succeeds because, as I mentioned earlier, Windows falls back to NT AUTHORITY\SYSTEM when it doesn't have a user context yet.

    Hope this makes at least some sense :blobcatgoogly2:

    infosec.exchange/@kallisti/116

    #LegacyHive #NightmareEclipse

    #legacyhive #nightmareeclipse