3 ms·
According to step 7 and 8, you only need to create a copy of the cmd binary and name it sethc. Here's a 'guide' from 2012 http://carnal0wnage.attackresearch.co
by ominous 12y ago
According to step 7 and 8, you only need to create a copy of the cmd binary and name it sethc.
Here's a 'guide' from 2012 http://carnal0wnage.attackresearch.com/2012/04/privilege-escalation-via-sticky-keys.html http://carnal0wnage.attackresearch.com/2012/04/privilege-esc...
And here's a 'fix' from microsoft: https://social.technet.microsoft.com/Forums/windows/en-US/a3968ec9-5824-4bc2-82a2-a37ea88c273a/sticky-keys-exploit https://social.technet.microsoft.com/Forums/windows/en-US/a3...
- Someone1234 12y agoIt doesn't need fixing, it is working as intended. If you can alter one system file then you can alter all system files. So even if this got "fixed," then another program would be replaced, a service, or the login screen itself. The only actual fix is to protect the Windows installation itself, this can be accomplished through full disk encryption (e.g. Bitlocker) in combination with uEFI secure boot. To be honest I roll my eyes when people post "exploits" like this. It just shows that people have no core understanding of computer security from the ground on up. As an aside this exact exploit would work perfectly on a Linux (e.g. Ubunutu) system that didn't implement full disk encryption.
- skolor 12y agoThe clever part is getting the startup repair command prompt with no additional tools. Its similar to the old windows login bypasses (https://i.imgur.com/fqjnKh.jpg https://i.imgur.com/fqjnKh.jpg) in that it gives on more tool to use for pentesting.