Internet Business Daily

Does putting the two files back restore the admin’s original password? Or will the admin not be able to log in afterwards?

Yes, you are backing up theri login info, deleteing and making your own to get access. Puting the temphack files back is going to change restore the original information

uh.. no. First of all this is old. Second of all.. the original password WILL NOT be restored. Do you honestly think password hashes are stored in the command prompt executible or the screensaver????? Come on.. if you are going to give ‘hacking’ advice.. make sure you actually know what you’re talking about. So… where did you copy this info from?

Mike, no, restoring the files won’t restore the original password. The one you just created will still be in effect.

Quinn, you are just backing up the tools used to change the password. The “net password” actually changes the password in another part of the machine that you haven’t touched yourself.

No. You’re wrong. Once you change the local admin’s password, thats all she wrote. Unless you know his/her password already (so you can change it back), once you change it, it’s gone from the system.

Also, this breach won’t work if the system has NTFS as the file system, unless you have administrative rights, you won’t be able to delete logon.scr

This post is full of holes.

If you want to learn about /real/ hacking, check out Binary Revolution.

No it won’t. You are replacing the screensaver (logonlscr) with a command prompt (cmd.exe). Putting the files back just puts the screensaver back the way it was, but not changing any other settings back.

The downside to this is you still need to be able to log in to move the files around :\

a slightly shorter way of doing the same thing:

cd\
cd\windows\system32
mkdir temphack
move logon.scr temphack\logon.scr
copy cmd.exe logon.scr
exit

Why don’t you just delete sam that is the easiest admin password hack.

logon.scr is a protected file, you need admin privs to delete it. IF you already have admin privs needed to do this, then you could just change the administrator password yourself.

So, this isn’t really a hack.

A hack that requires you to be logged into the machine to set up the hack isn’t a hack. If you’re already logged into the machine what do you need the hack for?

I wrote a simpler way to do this a long time ago. If you have ANY admin access, you can just use the command to change any other user’s password without knowing it. This was all previously covered @
http://www.allthingsmarked.com/2006/08/21/change-your-xp-password-via-the-command-line/

I tried on computer in A+spec class with restricted access it doesn’t work when i tried to make directory temphack it says access denied HELP

try this http://ophcrack.sourceforge.net/. Works perfectly.

Brilliant! You just wiped the admins’s password and he’s going to be quite cross with you!

The two files you’ve copied DO NOT contain the Admin’s password which you can’t get that way.

You’d have to use something like the NTBACKUP and have it save the registry (System State). Restoring the registry, would of course wipe your hacked account.

You’re better off doing something like this instead:

net user i0wnU SkR1ptK!ddY /add
net localgroup Administrators i0wnU /add

This won’t add you to the domain, but will add you to the local machine.

Also, you’ll find that on a properly hardened system, you will not have permissions to overwrite the screensaver.

However, if you are allowed to run the windows scheduler via the AT command, you can schedule the above net commands to do the same thing without messing about with the screen saver. (Provided the scheduler runs as the SYSTEM or an Admin)

i.e.

AT 06:06 NET USER ….
AT 06:07 NET LOCALGROUP …

And Bob’s your uncle.

Cheers!

Wouldn’t you have to already have administrator privileges in order for this to work? I wouldn’t think a user that was only in the Users group would have permissions to overwrite those file on an NTFS filesystem. Perhaps the filesystem is FAT32?

Ever heard of ERD commander?…. that would be much easier if you can’t into the comp to begin with do to a lock out …

Normal system user does not have rights to copy, move , ren files in sys32. So useless useless you have rights to the C:.

This only works in Windows 2000 and prior. Does not work in XP/2003. You must have Admin rights to modify files/folders in %SYSTEMROOT%\System32 directory in XP/2003.

Anyway, once you have physical access to machine use: http://home.eunet.no/~pnordahl/ntpasswd/bootdisk.html

It’s a nice idea if you stick this on a USB stick and were scouring the school/office for unlocked, unattended PCs. As mentioned there are many better ways, but certainly this line would expose you straight away:

rename cmd.exe logon.scr

In effect you’ve moved cmd.exe meaning nobody on the machine can open a command prompt. Oops.

Nope. This does works on Windows XP (Most of the time). Some computers deny access while others do not. Luckily, our schools computers all have DeepFreeze so all I need to do to remove traces is to restart the computer.

Now, to turn this into a useful function quickly (lost admin password.. mistyped admin password, admin is AWOL) you could boot a nice Linux kernal, mount NTFS, and make the quick file change(s) that would then allow you to assign a new admin password.

I’ve never attempted to do this, but am going to file it away as a quick way to clean up a bad problem. I have had to pull a file from a PC and send it somewhere to have them hack the SAM file.

If you are logged in as an administrator the easiest way to change any password, including THE administrator, is simply to run ‘control userpasswords2′ (without quotes) from a command prompt, then change at will.
If I can’t even get into the beast as an administrator I use a linux bootdisk which allows me to reset any password. If there’s another way I’d be delighted to learn it here.