4 ms·

If you have physical access to the PC, why not just boot up Ubuntu, and replace the files that need replacing? No need to rely on a feature in Windows that can

by runeks 12y ago

If you have physical access to the PC, why not just boot up Ubuntu, and replace the files that need replacing? No need to rely on a feature in Windows that can be disabled. If full-disk encryption isn't used, there's really not much the underlying OS can do to prevent this.

sauere 12y ago
Physical-access always means "game over" unless full-disk encryption is used.
- ygra 12y ago
  In this case FDE won't help, right? As the OS already can read the hard drive during the repair phase (or otherwise can't get that far).
  - DangerousPie 12y ago
    It looks like you can only launch the repair once you have decrypted the hard drive [1]. [1] http://answers.microsoft.com/en-us/windows/forum/windows_7-system/running-windows-7-repair-on-a-bitlocker-encrypted/89e2cae0-7d49-4cc4-981e-3776701bbf4b http://answers.microsoft.com/en-us/windows/forum/windows_7-s...
- DanBlake 12y ago
  You can do a entire dump of the HD while its turned on and save it to a backup. Then you can restore the backup back to the initial HD
r3bl 12y ago
Could you link some kind of a guide about what should be changed from a Live CD/USB?
- ominous 12y ago
  According to step 7 and 8, you only need to create a copy of the cmd binary and name it sethc. Here's a 'guide' from 2012 http://carnal0wnage.attackresearch.com/2012/04/privilege-escalation-via-sticky-keys.html http://carnal0wnage.attackresearch.com/2012/04/privilege-esc... And here's a 'fix' from microsoft: https://social.technet.microsoft.com/Forums/windows/en-US/a3968ec9-5824-4bc2-82a2-a37ea88c273a/sticky-keys-exploit https://social.technet.microsoft.com/Forums/windows/en-US/a3...
  - Someone1234 12y ago
    It doesn't need fixing, it is working as intended. If you can alter one system file then you can alter all system files. So even if this got "fixed," then another program would be replaced, a service, or the login screen itself. The only actual fix is to protect the Windows installation itself, this can be accomplished through full disk encryption (e.g. Bitlocker) in combination with uEFI secure boot. To be honest I roll my eyes when people post "exploits" like this. It just shows that people have no core understanding of computer security from the ground on up. As an aside this exact exploit would work perfectly on a Linux (e.g. Ubunutu) system that didn't implement full disk encryption.
    - skolor 12y ago
      The clever part is getting the startup repair command prompt with no additional tools. Its similar to the old windows login bypasses (https://i.imgur.com/fqjnKh.jpg https://i.imgur.com/fqjnKh.jpg) in that it gives on more tool to use for pentesting.
- jlgaddis 12y ago
  http://pogostick.net/~pnh/ntpasswd/ http://pogostick.net/~pnh/ntpasswd/
audunw 12y ago
Lots of work/school computer has a password locked BIOS which prevents you from booting from anything else. If they also have a physical lock on the computer, or if it's a laptop that you can't open or doesn't have a bios reset functionality, or you're worried about getting caught opening the computer, you're effectively locked out. This exploit does actually open possibilities where there were few/none before. Also I imagine it's easier for some people to execute.
- noodly 12y ago
  This password locking is worthless - most (if not all) BIOSes have backdoor password that allows anyone to bypass password lock. Here's one of the pages that lists some of them: http://www.uktsupport.co.uk/reference/biosp.htm http://www.uktsupport.co.uk/reference/biosp.htm
  - jethro_tell 12y ago
    Also you could probably reset the bios in a couple minutes.
  - psykovsky 12y ago
    Don't even get me started on the passwords to unlock HDD's, the ones you set on the BIOS... One day I will write how I unlocked the Toshiba(TSSTCorp) HDD I had forgotten the password for on my laptop. I had to buy a new HDD, because I didn't have a spare one at the time, but I did it in less than 5 minutes, unscrewing and screwing the laptop covers and HDD's included. They weren't even the same brand. I bought a Samsung to unlock the Hitachi.
  - Mandatum 12y ago
    Some devices make this very difficult. Well, not very difficult - just more time consuming. I was trying to unlock a BIOS password on a Toshiba Satellite maybe 3 years ago, none of the default or "backdoor" passwords would work. However, you were able to reset it by using a jumper to complete a specific part of the circuit.. Not for the faint hearted, however if a thief steals the laptop, they'll have no problem opening it up in their own time. I'm glad they've made this harder, as most thieves are deterred by the technical aspects of breaking in to wipe a computer.

by runeks 12y ago

sauere 12y ago

Physical-access always means "game over" unless full-disk encryption is used.

ygra 12y ago
In this case FDE won't help, right? As the OS already can read the hard drive during the repair phase (or otherwise can't get that far).
- DangerousPie 12y ago
  It looks like you can only launch the repair once you have decrypted the hard drive [1]. [1] http://answers.microsoft.com/en-us/windows/forum/windows_7-system/running-windows-7-repair-on-a-bitlocker-encrypted/89e2cae0-7d49-4cc4-981e-3776701bbf4b http://answers.microsoft.com/en-us/windows/forum/windows_7-s...
DanBlake 12y ago
You can do a entire dump of the HD while its turned on and save it to a backup. Then you can restore the backup back to the initial HD

r3bl 12y ago

Could you link some kind of a guide about what should be changed from a Live CD/USB?

ominous 12y ago
According to step 7 and 8, you only need to create a copy of the cmd binary and name it sethc. Here's a 'guide' from 2012 http://carnal0wnage.attackresearch.com/2012/04/privilege-escalation-via-sticky-keys.html http://carnal0wnage.attackresearch.com/2012/04/privilege-esc... And here's a 'fix' from microsoft: https://social.technet.microsoft.com/Forums/windows/en-US/a3968ec9-5824-4bc2-82a2-a37ea88c273a/sticky-keys-exploit https://social.technet.microsoft.com/Forums/windows/en-US/a3...
- Someone1234 12y ago
  It doesn't need fixing, it is working as intended. If you can alter one system file then you can alter all system files. So even if this got "fixed," then another program would be replaced, a service, or the login screen itself. The only actual fix is to protect the Windows installation itself, this can be accomplished through full disk encryption (e.g. Bitlocker) in combination with uEFI secure boot. To be honest I roll my eyes when people post "exploits" like this. It just shows that people have no core understanding of computer security from the ground on up. As an aside this exact exploit would work perfectly on a Linux (e.g. Ubunutu) system that didn't implement full disk encryption.
  - skolor 12y ago
    The clever part is getting the startup repair command prompt with no additional tools. Its similar to the old windows login bypasses (https://i.imgur.com/fqjnKh.jpg https://i.imgur.com/fqjnKh.jpg) in that it gives on more tool to use for pentesting.
jlgaddis 12y ago
http://pogostick.net/~pnh/ntpasswd/ http://pogostick.net/~pnh/ntpasswd/

audunw 12y ago

Lots of work/school computer has a password locked BIOS which prevents you from booting from anything else. If they also have a physical lock on the computer, or if it's a laptop that you can't open or doesn't have a bios reset functionality, or you're worried about getting caught opening the computer, you're effectively locked out. This exploit does actually open possibilities where there were few/none before. Also I imagine it's easier for some people to execute.

noodly 12y ago
This password locking is worthless - most (if not all) BIOSes have backdoor password that allows anyone to bypass password lock. Here's one of the pages that lists some of them: http://www.uktsupport.co.uk/reference/biosp.htm http://www.uktsupport.co.uk/reference/biosp.htm
- jethro_tell 12y ago
  Also you could probably reset the bios in a couple minutes.
- psykovsky 12y ago
  Don't even get me started on the passwords to unlock HDD's, the ones you set on the BIOS... One day I will write how I unlocked the Toshiba(TSSTCorp) HDD I had forgotten the password for on my laptop. I had to buy a new HDD, because I didn't have a spare one at the time, but I did it in less than 5 minutes, unscrewing and screwing the laptop covers and HDD's included. They weren't even the same brand. I bought a Samsung to unlock the Hitachi.
- Mandatum 12y ago
  Some devices make this very difficult. Well, not very difficult - just more time consuming. I was trying to unlock a BIOS password on a Toshiba Satellite maybe 3 years ago, none of the default or "backdoor" passwords would work. However, you were able to reset it by using a jumper to complete a specific part of the circuit.. Not for the faint hearted, however if a thief steals the laptop, they'll have no problem opening it up in their own time. I'm glad they've made this harder, as most thieves are deterred by the technical aspects of breaking in to wipe a computer.