Kallisti on Nostr: Findings so far: It's rather trivial to point LegacyHive at other hives, e.g. using ...

Findings so far:
It's rather trivial to point LegacyHive at other hives, e.g. using symlinks.

The process that loads UsrClass.dat doesn't bypass Kernel locks, however (this is very much expected and would be a brand new vulnerability if it weren't the case), and so direct access to SAM/SECURITY/SYSTEM is not possible.

I was thinking maybe some WillNotFix stuff from M$ could come in handy, but no such luck so far. Currently out of ideas, gonna sleep on it.