Researcher Releases Windows Zero-Day PoC Post-Patch Tuesday

Security researcher Chaotic Eclipse, also known as Nightmare-Eclipse, released a new proof-of-concept (PoC) exploit named LegacyHive on November 14, 2023. This exploit targets a Windows User Profile Service arbitrary hive load elevation of privileges vulnerability. The Windows User Profile Service (ProfSvc) is a critical system component responsible for managing user accounts and their associated environments.

The release of LegacyHive occurred just hours after Microsoft's November 2023 Patch Tuesday, a regular event where the company addresses security vulnerabilities. The PoC demonstrates how an attacker could exploit this specific flaw to gain elevated privileges on a vulnerable Windows system. According to the researcher's advisory, the exploit requires specific conditions to be met on the target system to function.

While the exact details of the vulnerability and the exploit's mechanics were not fully disclosed in the initial announcement to prevent immediate widespread abuse, the researcher indicated that the PoC is functional. This timing suggests a potential cat-and-mouse game between security researchers and software vendors, where vulnerabilities are disclosed and patched, only for new ones to be discovered or exploited shortly thereafter. Users are advised to ensure their Windows systems are updated with the latest security patches released by Microsoft to mitigate risks associated with such vulnerabilities.