You might find some shop somewhere that still has legitimate retail or even OEM packs sitting on a dusty shelf.
Other than that, the only way I can think of to get a fresh legitimate copy of Vista is via an MSDN (Microsoft Developer Network) subscription; they usually include old software and OS versions for compatibility / testing reasons.
But of course the big question is.. why on earth would you want Vista???