This repository contains a proof-of-concept for a Windows User Profile Service elevation-of-privilege vulnerability that loads an arbitrary hive into the current user's classes root.

Stars

275

7-day growth

No data

Forks

77

Open issues

3

License

MIT

Last updated

2026-07-14

AI repository intelligence
FR-AI / ANALYSIS

Why it is worth attention

It demonstrates a Windows privilege escalation that works on all supported desktop and server installations with the July 2026 patch, highlighting a persistent security flaw.

Who it is for

  • Security researchers studying Windows internals
  • Penetration testers assessing Windows environments
  • Windows system administrators hardening systems
  • Exploit developers analyzing privilege escalation techniques

Use cases

  • Testing privilege escalation defenses in a lab environment
  • Understanding the impact of arbitrary hive loading on Windows security
  • Evaluating the effectiveness of July 2026 patches against this vulnerability

Strengths

  • Fully functional on all supported Windows versions with July 2026 patch
  • Provides a concrete PoC that demonstrates the core exploitation technique
  • Clearly explains the requirement for additional credentials and the stripped-down nature

Considerations

  • Requires two additional user credentials (a standard user and a target user)
  • The PoC is stripped down and limited to loading usrclass.dat, not arbitrary hives
  • May be patched after July 2026, reducing its long-term utility

README quick start

LegacyHive : Windows user profile service arbitrary hive load elevation of privileges vulnerability

The PoC requires another standard user credentials and a third username (which can be an administrator account), if the PoC is successful, it will end up mounting the target user hive in current user classes root.

The PoC was stripped down as an attempt to prevent public exploitation, the original PoC did not require additional user credential and was not limited to usrclass.dat hive, any hive could be loaded using this vulnerability but you would need some brain cells to make the PoC do it.

The PoC is fully functional in all currently supported desktop and server installation with July 2026 patch.

Description

N/A

Related repositories

Similar projects matched by category, topics, and programming language.

alecjacobson
Featured
alecjacobson GitHub avatar

alpha-wrap

A CGAL-free, MIT-licensed reimplementation of the Alpha Wrapping algorithm that takes a defective triangle soup and produces a watertight, manifold, outward-oriented mesh with controllable level of detail and tightness.

C++
5
hypervising
Featured
hypervising GitHub avatar

gta-enhanced-audio-queue-poc

A proof-of-concept tool that patches a synchronous three-slot audio queue in GTA V Enhanced, boosting frame rates from ~260 to ~499 FPS by removing coarse wait delays.

Design & Creative
3
ammaarreshi
ammaarreshi GitHub avatar

Generals-Mac-iOS-iPad

This repository ports Command & Conquer Generals: Zero Hour to run natively on Apple Silicon Macs, iPhones, and iPads without emulation, adding touch controls and modern rendering.

C++
1,523