Gaining System-Level Access To Vista
So I read about this yesterday from Slashdot
http://tech.slashdot.org/article.pl?.../05/26/0257213
I know that you can do it from any liveCD linux distro, though I thought it was cool that BackTrack got the publicity. Anyways, I went ahead and tried it out with my copy of Windows Server 2008 Enterprise (thanks microsoft launch tour). It worked flawlesly, and instead of running "explorer" from the Utilman.exe promt, i ran "lusrmgr.msc" and simply added my own administrator account. I got out of utilman, clicked cancel for the Windows login, did a ctr+alt+del and my new TEST_ADMIN account was waiting for me to login.
I wasn't able to do anything once i ran explorer from utilman, except run firefox (from which i was able to browse the net) which i had installed previously while logged into the admin account. it was all so easy...
it's normal it's done with backtrack.........
the guy who done the video is MUTS !!! one of the creator of backtrack !!!
and yes it's so easy, i bet that microsoft will reduce privilege of this utility , that have no point to be run with system privilege !
you can do the same in xp or 2000 , but with other files than Utilman.exe
Watch your back, your packetz will belong to me soon... xD
BackTrack : Giving Machine Guns to Monkeys since 2006
I'm sure Muts is keeping Redmond busy
dd if=/dev/swc666 of=/dev/wyze
So besides locking down your USB ports (http www thinkgeek com/gadgets/security/98fe/), how can you prevent this atrocity?
You mean, lock down USB, CDROM, Bluetooth, and Firewire. Oh, and maybe unplug your network cable. Besides that, you should be fine.
William
LOL!! Sad, but trueOriginally Posted by williamc
dd if=/dev/swc666 of=/dev/wyze
file
Theres a quick script i wrote in /pentest/passwd called utilman.py
if you run that on a local vista system, it'll detect the partition, backup utliman.exe and rename cmd.exe to Utilman.exe, its all automated. Don't run this on a WinXP box..I sent muts an updated utilman.py that never made it on BT3 that specifically detects only Vista, however if you run this on XP, it'll rename the utilman.exe on XP which doesn't work.
This is a very cool hack, really simple aswell! Thanks muts, great discovery man you deserve your very own pet penguin for that!
I also liked the selection of music for the video, it made Back|Track look like one of those operating systems you see on a Hollywood film lol
Linkified for the lazy (like me):
http://tech.slashdot.org/article.pl?.../05/26/0257213
I'm a compulsive post editor, you might wanna wait until my post has been online for 5-10 mins before quoting it as it will likely change.
I know I seem harsh in some of my replies. SORRY! But if you're doing something illegal or posting something that seems to be obvious BS I'm going to call you on it.
While you're at it...
While you're being a good little code monkey...
can't hurt to throw in a script for XP, 2003, etc as well. A replacement for the sethc.exe (windows sticky key feature) would work the same. Replacement of sethc.exe with cmd.exe or your choice of fun.
Bet your enterprise will be hopping on full disk encryption "solutions" [even though most of them are crippled by configuration changes the vendors should never give the end users options to cripple] to keep your friendly sticky keys from going rogue.
We live in good times, and yes, my firewire ports have rubber cement in them.....
Posting Permissions
