5 ms·
Unshackle: A tool to bypass Windows and Linux password logins
- AdvDebug 3y agoUnshackle is a simple tool that deletes windows password logins (Linux support coming soon) using a bootable USB Drive, and makes you enter the system without any passwords, based on Alpine Linux.
- mrlinx 3y agoSo you replace sethc.exe with what?
- orthoxerox 3y agoA small C++ program that calls "net users" to erase or change the password.
- sunbum 3y ago[flagged]
- iso1631 3y ago> Linux support coming soon IF you're booting I used to use vim to just edit the shadow file. Or simply passwd to set the password to something. How does it cope with encrypted drives?
- sgerenser 3y agoDoesn’t windows use full disk encryption like macOS does these days? How would you unencrypted the boot drive without the password?
- SamuelAdams 3y agoWindows Bitlocker is the FDE product that Microsoft uses. It’s not enabled by default. It is possible to have Bitlocker disabled and password auth enabled.
- 0cf8612b2e1e 3y agoAt least on my corporate Windows laptop, the Bitlocker password is restricted to numeric digits only. Coupled with natural human laziness, and brute forcing looks fairly feasible.
- tredre3 3y agoEven if the PIN was only 4 digits you would be very unlikely to successfully bruteforce it. The TPM will throttle you after a few tries and lock you out for an increasing amount of time after each further attempt. An attacker might get 10 good tries before continuing becomes pointless, so unless the PIN is one of 1234 4321 0000 1111 2222 you're probably safe. Note: TPM2.0 allows alphanumerical PINs but I think you need a group policy for Windows to allow it.
- kekebo 3y agoThere's Bitlocker but it's optional and has to be enabled by the user.
- m45t3r 3y agoThere is also "Device Encryption"[1] that is separate from BitLocker and works in any version of Windows 10/11 as long TPM is available (and AFAIK is also turned on by default). BitLocker is only available in the Pro versions. [1]: https://support.microsoft.com/en-us/windows/turn-on-device-encryption-0c453637-bc88-5f74-5105-741561aae838 https://support.microsoft.com/en-us/windows/turn-on-device-e...
- sgerenser 3y agoAmazing. Apple has had FileVault for 20 years (although it’s only in the past 9 years or so that it’s been enabled by default).
- spydum 3y agoHow strange, shouldn't windows be checking if the binary is signed? Isn't that part of what secureboot and deviceguard do? Or does it just run like any addon?
- aaronmdjones 3y agoSecure Boot only verifies the NT kernel loader; that in turn will verify that the kernel is signed by Microsoft, and then the kernel will verify any device drivers it loads. Userland (e.g. explorer.exe) is free to be run without any signatures whatsoever; this includes the login screen.
- sim7c00 3y agoits a shame they need to lean on defender for this. it wouldnt be too long of a stretch to expect windows to verify the binaries it ships with, and not accept unsigned ones for those windows / MS binaries in the windows directory :(. it does no justice to all the good that could be done via secure boot
- mr_mitm 3y agoWe don't expect Linux to do this, do we? Just use full disk encryption, preferably with pre-boot authentication. TPM if you must, but this will only make the attack somewhat more expensive. Other than that, the hardware is compromised as soon as somebody gets their hands on it. Checking the integrity of a few binaries is mostly security theater. Besides manipulating executables, the adversary could simply modify or read the user database in C:\Windows\System32\config\SAM. [1] Alternatively, patch routines directly in memory [2] [1] https://www.kali.org/tools/chntpw/ https://www.kali.org/tools/chntpw/ [2] https://www.piotrbania.com/all/kon-boot/ https://www.piotrbania.com/all/kon-boot/
- the8472 3y ago> We don't expect Linux to do this, do we? Linux can be setup to verify an immutable userland via secure boot + dm-verity. I think it's used in some google devices (chromebooks?).
- majkinetor 3y agoTitle seems like some form anti-windows campaign while tool clearly states its for both windows and linux.
- pge 3y agoI had a similar reaction at first, but the title is accurate. The tool only works on Windows. From the site: >Tested on : >Windows 10 pro x64 >Linux bypass is still under development.
- majkinetor 3y agoNo its not, the title on GitHub is different. It also states under Usage: Choose your OS (Windows or Linux). You can't say until using it which aspect of Linux support is under development.
- zokier 3y ago> You can't say until using it which aspect of Linux support is under development. Its not big project, you can pretty quickly browse through the code and see that there is zero linux support
- haspok 3y agoSeems to be from the Windows 7 era - doubt it will work at all on later versions: https://superuser.com/questions/732605/how-to-prevent-the-sethc-exe-hack https://superuser.com/questions/732605/how-to-prevent-the-se... ps. I stand corrected - probably something similar still works: https://4sysops.com/archives/reset-a-windows-11-password-and-the-windows-server-2022-administrator-password/ https://4sysops.com/archives/reset-a-windows-11-password-and...
- Timwi 3y agoHm, it says to press Shift 5 times on the Windows login screen. By default this will enable sticky keys. Is that the intention or is that a conflicting keybind?
- dist-epoch 3y agoThey replace the sticky keys executable with an exploit which you trigger with the 5 x Shift key presses.
- pjerem 3y agoSmart !
- doubled112 3y agoIts been a few years, but I used to use chntpw. Has it stopped working?
- abwizz 3y agono and there are numerous alternatives. idk why this made the frontpage other than beeing interesting
- tallanvor 3y agoIt requires physical access to the machine, which is always 95% of the game. Plus, Bitlocker would prevent this from working, so if you're using a recent computer and have Pro/Enterprise and enable it, you don't have to worry about this attack vector.
- CleanCoder 3y agoThe limitations of this tool are obvious from the author's documentation. Plus, a door lock would prevent this from working, so if you're living in a recent house and have thick door and lock the door, you don't have to worry about this attack vector. It's strongly suggested to also hot glue your USB ports shut for added security.
- dotancohen 3y ago> It's strongly suggested to also hot glue your USB ports shut for added security. I'll just unplug your mouse / keyboard / wifi dongle and get to the USB port that it's using. Unless you are suggesting that modern computers should ship with zero USB ports.
- 8n4vidtmkvmk 3y agoJokes on you, I'll open the computer case and plug directly into the mobo
- jesprenj 3y agoYou couldn't, the case cover is hot-glued to the case. Hot-glue is the epitome of Windows security.
- squarefoot 3y agoThese days I would simply let the PC in the sun until it melts all glue. /s (not so much)
- catboybotnet 3y agoNeat, but replacing Utilman.exe with cmd.exe using most Linux ISOs is easy, and I've already got the drives needed. The amount of customers that get locked out of their servers...
- shawnz 3y agoThey actually recently made this attack vector more difficult with a recent Windows Defender update: https://security.stackexchange.com/a/176456 https://security.stackexchange.com/a/176456
- jesprenj 3y agoA trick I used that still worked after this Defender update (tested some months ago) is replacing Magnify.exe with ftp.exe. This does not make Defender suspicipus, but one can open Magnify.exe from the lock screen and one can execute commands from within the ftp.exe shell by prefixing them with !. This is great, because ftp.exe binary is signed by Microsoft and is a completely legit binary (:
- luma 3y agoWhy does the title say “Windows” when the repo says “Windows and Linux”?
- ivann 3y agoLinux support is still marked as under development.
- dsr_ 3y agoWhich is a little strange -- since you have physical access and are capable of booting from a USB stick, the procedure is to tell the bootloader to use sh as the init, mount the root filesystem r/w, change the root password (copying the hash for later if you want to restore it), make sure it's written to disk and reboot into the normal system -- only now you have root. If you have access to the bootloader's kernel command line, you don't need the USB stick, either. What this doesn't do is get you access to an encrypted filesystem, unless the encryption password happens to be written somewhere in the unencrypted partition. That happens unsurprisingly often.
- tylergetsay 3y agoA cleaner imo solution is kon-boot which modifies the kernel on windows/osx to disable password checking
- jaclaz 3y agoOnly for the record, until it lasted (seemingly noone has been interested in finding and updating the patterns to be patched or maybe some other security measure was implemented in later Windows 10) the "best" way (IMHO) was to patch a file. Booting from USB with grub4dos, patching the .dll then continuing booting and you could login as the original user but without (or with "any") password: http://reboot.pro/index.php?showtopic=18588 http://reboot.pro/index.php?showtopic=18588 There are (were) derivatives to be run from a WinPE, but any hex editor that could access the .dll would have done. Let's say that it was a poor man's Konboot, that has (or at least used to have) a similar approach, but patching files in memory.
- guilamu 3y agoYou can do that easily today with medicat (and ventoy).
- jaclaz 3y agoYep, but medicat lists (among other tools) the PEPassPass (which is a derivative of PassPass), all those tools need to boot into an Operating System (a PE or a Linux), change something, then reboot to the "normal" OS. What is (was) elegant in the grub4dos PassPass is (was) that you booted to grub4dos, ran the batch and then continue booting to the "normal" OS.
- guilamu 3y agoIndeed, good point.
- 0x53 3y agoRecently I forgot my password to a laptop I didn’t use much. It was bitlocker encrypted, but I had saved the keys. So I booted into a live Linux system mounted the bitlocker partition with dislocker and then dumped the Sam hashes with impacket’s secretsdump. Then I used hashcat to try and crack my own password since I thought I remembered parts of it. Ended up working!
- user070223 3y agoOn a simlliar note: Has anyone succefully installed yubikey windows 10(home) login for local accounts? They rereleased it for windows 10 I think(version 2+), but it never worked for me (apperently they relased a new version 2.11 recently for 11 & 10(22h2 fix), which I haven't tried)
- BlackLotus89 3y agoYou can do the same thing without using a boot drive at all. * Press F11 while booting * open cmd in the rescue menu * navigate to windows system32 folder * rename sethc.exe to sethc.exe.backup * copy cmd.exe to sethc.exe * reboot and press at login 5 times shift * add admin user * profit Thing that is missing is password edit of online only accounts or convert to local account
- agadius 3y agoWhere’s the source code for the binary file called “unshackle” which is used in the solution? (This one: https://github.com/Fadi002/unshackle/raw/main/unshackle https://github.com/Fadi002/unshackle/raw/main/unshackle)
- codys 3y agoIt appears to be a pyinstaller generated executable, presumably we'd expect it to contain https://github.com/Fadi002/unshackle/blob/main/src/unshackle.py https://github.com/Fadi002/unshackle/blob/main/src/unshackle..., but I haven't confirmed that.
- snvzz 3y agoI guess someone just discovered `init=/bin/bash`. Of course, that won't work on a LUKS encrypted system.
- nneonneo 3y agoI spent my high school years with chntpw (http://www.chntpw.com/download/ http://www.chntpw.com/download/) on a bootable floppy in my backpack (later, a bootable USB), for those times when a certain machine needed to be "liberated" from restrictive school policies. A particularly fond memory is of enabling a bunch of teens to play StarCraft on the machines in a computer lab after-hours... I'd heard about teens jailbreaking Chromebooks and the like recently, so it's nice to see the spirit of rebellion is still alive and well in the new generation :)