\u201cIf I can set up the system so that it runs my code when the admin user logs in,\u201d the attacker has de facto administrator privileges, Will Dormann, a senior principal vulnerability analyst at Tharros Labs, said in an interview. \u201cI don\u2019t need to be an admin myself.\u201d<\/p>\n
In a post<\/a>, he said that \u201cthe ability of a non-admin user to be able to modify the classes registry hive of an admin user is a pretty powerful primitive. Clever attackers or people who want to accomplish something will easily be able to figure out how to do things that are more interesting and\/or don\u2019t even require user interaction.\u201d<\/p>\n Dormann said that the exploit could possibly be chained to a separate one that gives direct access to an administrative account.<\/p>\n As explained in a post<\/a> by a different analyst: \u201cWhen a new user is logging on, Windows needs to load the user\u2019s class hive. Since the user isn\u2019t logged on before logging on (tautology, I know), it can\u2019t be loaded in the context of the user. So it is loaded in the context of NT AUTHORITY\\SYSTEM. LegacyHive abuses this.\u201d<\/p>\n In an emailed statement, Microsoft said it\u2019s aware of the vulnerability report and is investigating. The company also noted its preference that vulnerability reporters follow a coordinated disclosure<\/a> policy.<\/p>\n