Add PowerShell implementation of LegacyHive exploit

[SleepTheGod]

This script implements the Windows User Profile Service Zero-Day (LegacyHive) in PowerShell, allowing for user profile manipulation using embedded C# for Native API access.

Usage

Run as Administrator

.\LegacyHive.ps1 <target_username>

Example

.\LegacyHive.ps1 attacker P@ssw0rd victim

Important Notes
Requires Administrator privileges - The exploit needs to create object directories and symbolic links

The target user must exist - The username provided as third parameter must be a valid local user

The helper account (first two parameters) must have valid credentials and be able to logon interactively

This is a POC - Use only in authorized testing environments

The PowerShell version uses embedded C# to access the necessary Windows APIs and offreg.dll functionality

Limitations vs Original C++
Thread context manipulation - The original code uses RaiseExceptionInThread to modify thread context; this is not implemented in PowerShell as it's extremely dangerous and rarely needed

offreg.dll availability - The offline registry APIs are available on Windows 10/11; if missing, the exploit won't work

Performance - PowerShell adds overhead compared to native C++

Security Warning
This is a zero-day exploit for a Windows privilege escalation vulnerability. Use only for:

Security research in controlled environments

Authorized penetration testing

Educational purposes

Running this on production systems without authorization may be illegal.