5 ms·

> Also 95/98/Me were woefully insecure. Who could forget the login bypass "hack": https://i.imgur.com/rG0p0b2.gif https://i.imgur.com/rG0p0b2.gif

• gibolt 6y ago
  Would have been amazing if their QA team had this as something to test for
• tinus_hn 6y ago
  Something similar works with the Windows 7 recovery partition; it pretends you have to login to one of the administrator accounts to get control, but one of the dialog has a link to a privacy policy that opens in Notepad and from its file open dialog you can start command prompts, explorer etc.
  • kemotep 6y ago
    You can do a trick on Windows 10 too (if the disk isn't encrypted and secure boot enabled). Boot a Linux usb live boot of choice, mount the Windows C: parition. Rename the Command Prompt exe to be the accessibility or sticky keys exe (something roughly along those lines). Save and reboot into Windows. Hit the on screen keyboard button on the login screen and an administrator level command prompt opens allowing you to reset the local admin password to be able to log in or do anything else that you would like to do.
    • black3r 6y ago
      if you can boot a linux usb, you can change the password directly with chntpw. the command prompt trick allows you to do one-up -> work from the system account or create a new administrator-level account and delete it afterwards allowing the user's password to remain the same. and on most PCs you don't need secure boot to block booting from USBs, a BIOS password is usually enough...
    • yardie 6y ago
      Saw a security presenter do this last year live at MS Ignite on their latest Win10 release. The collective pie on every MS Windows developer in the room could fill a boat.