Credits where its due

[Salah-Code-Lab]

There was some misinformation here and i sincerely apoligize i really didn't mean to
as i said MSN, well played

[zuhayrkhalid]

Hey MSN, Credit where it's due the setup is clever. Object directory symlinks, oplock synchronization, offline hive editing with offreg.dll but here is the thing in practice it isn't good because you mounted a hive a MOUNT there is a difference between MOUNTING and being able to READ AND WRITE, and that is not the only part. The Registry In General doesn't contain sensitive info (apart from Network passwords, saved networks and the password in the SAM hive which is hashed) so unless you can read them your attack chain ended anyway now you did say that its able to work on any hive and you could mount any hive "the original PoC did not require additional user credential and was not limited to usrclass.dat hive, any hive could be loaded using this vulnerability" but at the end of the day you cannot write to, HKLM, HKCR (you can write to your own config without admin just to be clear), etc etc you can read them so what ? you know my Wi-Fi password while i am in Asia and you are in europe ? what is the point ? Read my Hashed Password ? so What ? reading a Password login is meaningless without physical access anyway (mind you some passwords may differ from login to say Gmail login but it could be abused theoretically) you can mount and read but you cannot write you cannot persist but i am open to being wrong if there is anything i missed just tell me because Mounting a hive doesn't make it an active hive, basically a temporary mount that isn't going to append You mount it as HKCR\MyMount (HKLM or HKCU) You write to HKCR\MyMount\Software\Microsoft\Windows NT\CurrentVersion\Winlogon You unmount it The live HKLM or HKCU is untouched The file on disk is untouched then what is the point ? unless it is your neighbor next door (well free Wi-Fi if you could get the password that isn't hashed) then i don't see any potential from this even if you could mount HKLM or the SAM hive when you said "The PoC was stripped down as an attempt to prevent public exploitation" there is no potential for public Exploitation

i was actually going to work on a patch for it in RegFilter but then i realized thankfully because that would had required some kind of parsing and other IRQL issues thank god

"The Registry in general doesn't contain sensitive info" => LSA secrets under HKLM\SECURITY\Policy\Secrets are recoverable plaintext (service accounts, machine account), plus DCC2 cached creds and Winlogon\DefaultPassword for autologon. secretsdump exists for a reason.

[Salah-Code-Lab]

Hey MSN, Credit where it's due the setup is clever. Object directory symlinks, oplock synchronization, offline hive editing with offreg.dll but here is the thing in practice it isn't good because you mounted a hive a MOUNT there is a difference between MOUNTING and being able to READ AND WRITE, and that is not the only part. The Registry In General doesn't contain sensitive info (apart from Network passwords, saved networks and the password in the SAM hive which is hashed) so unless you can read them your attack chain ended anyway now you did say that its able to work on any hive and you could mount any hive "the original PoC did not require additional user credential and was not limited to usrclass.dat hive, any hive could be loaded using this vulnerability" but at the end of the day you cannot write to, HKLM, HKCR (you can write to your own config without admin just to be clear), etc etc you can read them so what ? you know my Wi-Fi password while i am in Asia and you are in europe ? what is the point ? Read my Hashed Password ? so What ? reading a Password login is meaningless without physical access anyway (mind you some passwords may differ from login to say Gmail login but it could be abused theoretically) you can mount and read but you cannot write you cannot persist but i am open to being wrong if there is anything i missed just tell me because Mounting a hive doesn't make it an active hive, basically a temporary mount that isn't going to append You mount it as HKCR\MyMount (HKLM or HKCU) You write to HKCR\MyMount\Software\Microsoft\Windows NT\CurrentVersion\Winlogon You unmount it The live HKLM or HKCU is untouched The file on disk is untouched then what is the point ? unless it is your neighbor next door (well free Wi-Fi if you could get the password that isn't hashed) then i don't see any potential from this even if you could mount HKLM or the SAM hive when you said "The PoC was stripped down as an attempt to prevent public exploitation" there is no potential for public Exploitation

i was actually going to work on a patch for it in RegFilter but then i realized thankfully because that would had required some kind of parsing and other IRQL issues thank god

"The Registry in general doesn't contain sensitive info" => LSA secrets under HKLM\SECURITY\Policy\Secrets are recoverable plaintext (service accounts, machine account), plus DCC2 cached creds and Winlogon\DefaultPassword for autologon. secretsdump exists for a reason.

You're right that the registry contains sensitive data related to LSA, cached creds, autologon passwords.
But accessing these requires admin RIGHTS to read the SAM/SECURITY hives.
The PoC claims running with User or standard tokens.
Even if you could mount SAM as standard user, you'd only have a read-only snapshot with no write path back to the live system.
oh and also copying the file to a another directory (requires admin)
Secretsdump is Sensitive, but it's a post-ex tool for compromised systems.
The PoC's claim is about elevation, not exfiltration.
Reading secrets after you're admin is valid but irrelevant to the claimed "vulnerability"

Oh and a another thing which is
lets assume it ran as admin as a scenario
then what is the point of the hassle if you can access everything directly
so stay within the USER / STANDARD context.

[zuhayrkhalid]

Hey MSN, Credit where it's due the setup is clever. Object directory symlinks, oplock synchronization, offline hive editing with offreg.dll but here is the thing in practice it isn't good because you mounted a hive a MOUNT there is a difference between MOUNTING and being able to READ AND WRITE, and that is not the only part. The Registry In General doesn't contain sensitive info (apart from Network passwords, saved networks and the password in the SAM hive which is hashed) so unless you can read them your attack chain ended anyway now you did say that its able to work on any hive and you could mount any hive "the original PoC did not require additional user credential and was not limited to usrclass.dat hive, any hive could be loaded using this vulnerability" but at the end of the day you cannot write to, HKLM, HKCR (you can write to your own config without admin just to be clear), etc etc you can read them so what ? you know my Wi-Fi password while i am in Asia and you are in europe ? what is the point ? Read my Hashed Password ? so What ? reading a Password login is meaningless without physical access anyway (mind you some passwords may differ from login to say Gmail login but it could be abused theoretically) you can mount and read but you cannot write you cannot persist but i am open to being wrong if there is anything i missed just tell me because Mounting a hive doesn't make it an active hive, basically a temporary mount that isn't going to append You mount it as HKCR\MyMount (HKLM or HKCU) You write to HKCR\MyMount\Software\Microsoft\Windows NT\CurrentVersion\Winlogon You unmount it The live HKLM or HKCU is untouched The file on disk is untouched then what is the point ? unless it is your neighbor next door (well free Wi-Fi if you could get the password that isn't hashed) then i don't see any potential from this even if you could mount HKLM or the SAM hive when you said "The PoC was stripped down as an attempt to prevent public exploitation" there is no potential for public Exploitation

i was actually going to work on a patch for it in RegFilter but then i realized thankfully because that would had required some kind of parsing and other IRQL issues thank god

"The Registry in general doesn't contain sensitive info" => LSA secrets under HKLM\SECURITY\Policy\Secrets are recoverable plaintext (service accounts, machine account), plus DCC2 cached creds and Winlogon\DefaultPassword for autologon. secretsdump exists for a reason.

You're right that the registry contains sensitive data related to LSA, cached creds, autologon passwords. But accessing these requires admin RIGHTS to read the SAM/SECURITY hives. The PoC claims running with User or standard tokens. Even if you could mount SAM as standard user, you'd only have a read-only snapshot with no write path back to the live system. oh and also copying the file to a another directory (requires admin) Secretsdump is Sensitive, but it's a post-ex tool for compromised systems. The PoC's claim is about elevation, not exfiltration. Reading secrets after you're admin is valid but irrelevant to the claimed "vulnerability"

Oh and a another thing which is lets assume it ran as admin as a scenario then what is the point of the hassle if you can access everything directly so stay within the USER / STANDARD context.

You definitely understand the internal working of this exploit better than me, do you believe it could be weaponized to work like the following - https://github.com/GossiTheDog/HiveNightmare ? As they both have similar capabilities. And HiveNightmare was officially patched as a privesc vulnerability.

[Salah-Code-Lab]

Hey MSN, Credit where it's due the setup is clever. Object directory symlinks, oplock synchronization, offline hive editing with offreg.dll but here is the thing in practice it isn't good because you mounted a hive a MOUNT there is a difference between MOUNTING and being able to READ AND WRITE, and that is not the only part. The Registry In General doesn't contain sensitive info (apart from Network passwords, saved networks and the password in the SAM hive which is hashed) so unless you can read them your attack chain ended anyway now you did say that its able to work on any hive and you could mount any hive "the original PoC did not require additional user credential and was not limited to usrclass.dat hive, any hive could be loaded using this vulnerability" but at the end of the day you cannot write to, HKLM, HKCR (you can write to your own config without admin just to be clear), etc etc you can read them so what ? you know my Wi-Fi password while i am in Asia and you are in europe ? what is the point ? Read my Hashed Password ? so What ? reading a Password login is meaningless without physical access anyway (mind you some passwords may differ from login to say Gmail login but it could be abused theoretically) you can mount and read but you cannot write you cannot persist but i am open to being wrong if there is anything i missed just tell me because Mounting a hive doesn't make it an active hive, basically a temporary mount that isn't going to append You mount it as HKCR\MyMount (HKLM or HKCU) You write to HKCR\MyMount\Software\Microsoft\Windows NT\CurrentVersion\Winlogon You unmount it The live HKLM or HKCU is untouched The file on disk is untouched then what is the point ? unless it is your neighbor next door (well free Wi-Fi if you could get the password that isn't hashed) then i don't see any potential from this even if you could mount HKLM or the SAM hive when you said "The PoC was stripped down as an attempt to prevent public exploitation" there is no potential for public Exploitation

i was actually going to work on a patch for it in RegFilter but then i realized thankfully because that would had required some kind of parsing and other IRQL issues thank god

"The Registry in general doesn't contain sensitive info" => LSA secrets under HKLM\SECURITY\Policy\Secrets are recoverable plaintext (service accounts, machine account), plus DCC2 cached creds and Winlogon\DefaultPassword for autologon. secretsdump exists for a reason.

You're right that the registry contains sensitive data related to LSA, cached creds, autologon passwords. But accessing these requires admin RIGHTS to read the SAM/SECURITY hives. The PoC claims running with User or standard tokens. Even if you could mount SAM as standard user, you'd only have a read-only snapshot with no write path back to the live system. oh and also copying the file to a another directory (requires admin) Secretsdump is Sensitive, but it's a post-ex tool for compromised systems. The PoC's claim is about elevation, not exfiltration. Reading secrets after you're admin is valid but irrelevant to the claimed "vulnerability"
Oh and a another thing which is lets assume it ran as admin as a scenario then what is the point of the hassle if you can access everything directly so stay within the USER / STANDARD context.

You definitely understand the internal working of this exploit better than me, do you believe it could be weaponized to work like the following - https://github.com/GossiTheDog/HiveNightmare ? As they both have similar capabilities. And HiveNightmare was officially patched as a privesc vulnerability.

Hey man i just wanted to say after researching i was wrong on some points which were
the exploit actually appends the write it isn't just a mount
it is capable of appending writes to disk
it cannot apply them so Sys32\config files
but It can append them in HKCU
for HKCU it can append writes to specifically
HKCU\Software\Classes\CLSID
then force a reboot to load a .exe as admin on next reboot
it can achieve Admin rights it doesn't need to write to HKLM
so i will take down the first opening and i will close this issue because the exploit exists and it worked for me consistently
sorry for spreading misinformation
and MSN, Well played

And just one thing the driver i made can counter this through parsing and other stuff
but mainly blocking writes to that key CLSID quick and dirty a cheap fix but i am pretty sure there are other methods
like:
HKCU\Software\Microsoft\Command Processor
HKCU\Environment (can be changed to C:\Users\Public;%PATH%)
HKCU\Software\Microsoft\Windows\CurrentVersion\Terminal Server\InitialProgram
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
if you noticed all of them can be blocked with my driver and that way Some paths for the LPE through HKCU are dead
notice how i said some ? because there may be more that i don't know of
either way my Registry Filter can be utilized to counter this threat / vuln
and do not be mistaken this is a Mitigation not the patch or whatever
also there is a vulnerability in RegFilter itself against this
because it abuses a System thread with the caller SID of S-1-5-18
which i return success for it can bypass me since it relies on it
i will attempt to fix this starting now...

so i confirm this is NOT a registry issue it may seem like it
but it is rather both
Filesystem and Registry
a mix with both
Filesysytem being able to obtain a Oplock to ntusers.dat or users.dat or whatever
and
being able to mount the hive in
HKCR\USERS\*\
the second path can be blocked and i may work on it now
but The Oplock one is out of scope which requires a filesystem driver
may be easier done than said yeah i flipped it and i know and i mean it
because i can reuse BCDGuard and reshape it to Handle Oplocks for USERS
and deny the OpLocks to get obtained there the question is
are they operationally critical ?
and no they are not they are for caching and providing better performance in loading
good blanket blocks can be done here for system callers but not for kernel callers
if anyone has any other ideas i would like to hear them

HiveOplock.sys had been made stability is preserved the blocks are right and precise under specific paths (Where Ntuser.dat and usrclass.dat are) and doesn't block any backup paths
no instability across reboots
no Loss of performance
blocks oplocks completely
Now at this layer LegacyHive Fails completely but further testing with verifier.exe is remaining to ensure total stability
HiveOplock.sys is stable at flags of
0x209BB for verifier.exe
no bugchecks were found all attempts to gather oplocks had failed
the driver is now Published and ready
in less 16 (i had discovered that you published this 16 hours ago) hours your exploit had been terminated or better stated as Mitigated terminated is when Microsoft fixes it

Exploit status: Mitigated unless proven other wise