* Read the target user's NTUSER.DAT hive into memory as a backup.
* Open the hive offline using the Offline Registry (offreg) API.
* Modify HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData to point at \\.\GlobalRoot\BaseNamedObjects\Restricted.
* Save the modified hive and replace the original NTUSER.DAT.
* Copy the user's UsrClass.dat into the temporary working directory.
* Acquire a batch oplock on the copied UsrClass.dat to synchronize execution with profile loading.
* Start a suspended process using CreateProcessWithLogonW(..., LOGON_WITH_PROFILE, ...), triggering the User Profile Service to load the profile.
* Wait for the oplock to break when Windows attempts to access UsrClass.dat
NightCrawler released another window's vuln.
From what I can understand of it:
* Read the target user's NTUSER.DAT hive into memory as a backup.
* Open the hive offline using the Offline Registry (offreg) API.
* Modify HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData to point at \\.\GlobalRoot\BaseNamedObjects\Restricted.
* Save the modified hive and replace the original NTUSER.DAT.
* Copy the user's UsrClass.dat into the temporary working directory.
* Acquire a batch oplock on the copied UsrClass.dat to synchronize execution with profile loading.
* Start a suspended process using CreateProcessWithLogonW(..., LOGON_WITH_PROFILE, ...), triggering the User Profile Service to load the profile.
* Wait for the oplock to break when Windows attempts to access UsrClass.dat
https://blog.projectnightcrawler.dev/posts/2026-07-14-legacy...
update: formatting :s