LegacyHive Reopens a Windows Privilege Hole Microsoft Closed 11 Years Ago

For weeks he promised that July 14 would shatter Microsoft’s bones. Patch Tuesday came, Microsoft closed a record 622 holes, and hours later he dropped LegacyHive, a Windows zero-day that lets a normal user break into the administrator’s account. No patch, no CVE yet, and far quieter than he promised. 🧐

If you have followed my posts this year, you know who this is. Nightmare-Eclipse, the researcher who has spent 2026 dropping working Windows exploits on Microsoft after what he says was the company taking his credit and paying him nothing for it. Microsoft did delete the account he reported bugs through. I laid out that full story when the count first hit six, so this post stays on the new bug.

Back in June he had already pulled the big July 14 release back, saying the mass drop was off and smaller ones would come instead. July 14 came, and that is what landed. No manifesto, and no taunt buried in the code the way his earlier drops carried open jabs at Microsoft. Three links to his own servers and a signature, nothing else. Far smaller than the moment he had built up.

But the bug underneath still works on a fully updated machine, and it lands on a spot few people ever think about.

LegacyHive lives in the Windows User Profile Service, the part of Windows that loads your settings the moment you sign in. Each account on a machine has a hive, a slice of the registry that holds one user’s own settings, including small but important things like which program opens which kind of file. Normally, only Windows itself is allowed to load someone else’s hive. Your account cannot reach into another account’s settings, and that wall is the point. LegacyHive walks straight through it, letting a normal user load another user’s hive, including an administrator’s, into their own space. It works on Windows 10, Windows 11, and Windows Server with the July 2026 update in place.

This is not a way into a machine. It is a way up inside one.

The attacker is already signed in as a normal user, through malware that arrived earlier or an ordinary account that was stolen. LegacyHive is the step that lifts them from that plain account toward the administrator.

Nothing here is forced open. The exploit works on timing, and on the trust that Windows puts in a file path it already checked.

The User Profile Service already runs as SYSTEM, the highest account on the machine, and loading a user’s hive when they log in is its ordinary job. The attacker has a second plain account, a helper, and its password. He starts a normal login for that helper, so the service dutifully sets out to load the helper’s hive, as SYSTEM, exactly as it is meant to. Nothing is broken to get this far.

The trap is set on the path. Before the login, the attacker rigs the helper’s own settings so that the place Windows looks for its hive is a fake route, built from symbolic links, which are signposts that quietly send one location to another. One signpost is a decoy that looks normal. A second, hidden one points at the administrator’s own profile, where the target hive sits. On the decoy he places an oplock, a lock that can freeze a file part way through loading and hold it at the exact instant he wants.

The service starts loading what it believes is the helper’s hive. It reaches the decoy, the oplock freezes it mid-step, and in that frozen moment the attacker switches the signpost so it now points at the administrator’s hive. Then he lets go. The service, still running as SYSTEM and still certain it is doing its normal job, finishes the load on the administrator’s hive and mounts it under the attacker’s account.

Here is the flaw in one sentence. Windows checks the path once, and between that check and the moment it opens the file, the attacker has quietly pointed the path at a different hive. Windows never knowingly loads the administrator’s hive for a normal user. It is fooled in the gap between looking and using.

That gap has a name, time-of-check to time-of-use, and it is the same family as his earlier RoguePlanet, which turned on the same kind of race to swap a pointer at the right instant.

And this door has been open before. In January 2015, Microsoft patched a bug in this very service, the User Profile Service, after a local user found a way to make it load another account’s hive. They fixed how it checks privileges and closed it. Eleven years on, the same kind of weakness is back in the same service, and few have said so out loud.

The version he posted is stripped down on purpose. It takes three things, a helper account, its password, and the target user:

1

LegacyHive.exe <helper account> <helper password> <target user>

On its own, that public build only reads the other user’s hive, the part that holds application data and File Explorer history. No password hashes, and no code running by itself. He says the original was stronger: it needed no extra account, and it could load any hive, not just this one. He cut it back, he says, so it could not be dropped straight into an attack.

What he released is better understood as a building block than a finished attack. But that block sits in a dangerous place.

That same hive holds an administrator’s file associations, the small entries that tell Windows which program to launch for a given file. Whoever can write to them decides what runs. The harmless demo people passed around was making text files open in the calculator. Funny, and completely safe. The dangerous version is the same move aimed differently: overwrite the handler for a file type the administrator uses, and the next time they open that kind of file, your command runs with their rights. That is how a quiet read of someone’s settings turns into a foothold that can survive a reboot and take the machine.

There is no patch and no CVE, so the usual advice to update does nothing here. What helps is older and smaller.

• → Keep the line between normal and administrator accounts tight, because this bug lives right on that line.
• → Watch for a normal account touching another user’s profile files, or a folder with a random name showing up at the root of the C drive.
• → Lean on behaviour, not known-bad files. The exploit tidies up after itself and puts the original hive back, so a machine that looks clean is not proof that nothing happened.

One thing to keep straight. He is anonymous, and his name has never been confirmed. The timing, and the old jabs at Microsoft, are a message, not a fingerprint. Who did this is the hardest thing to prove in security. What can be checked is how the code behaves, and this code behaves exactly as described.

Climbing from a normal account to full control, and abusing the trusted parts of Windows that defenders rarely watch, is the core of penetration testing. It is what I teach in my ethical hacking course, Windows privilege escalation step by step, from your first day with zero experience to thinking like an attacker.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

LegacyHive PoC | Microsoft MS15-003