Re: [Full-disclosure] Screen_unlock - Windows logon screen unlocker

["McGhee, Eddie" <Eddie.McGhee@xxxxxxx>]

Cool idea but come on, once we have physical access there's no need to 
disconnect the hdd and connect to another machine, there is plenty tools out 
there already to get access, I suppose it does show a slightly different method 
though so thumbs up I suppose. 

-----Original Message-----
From: full-disclosure-bounces@xxxxxxxxxxxxxxxxx 
[mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx] On Behalf Of Makoto Shiotsuki
Sent: 01 August 2010 04:20
To: full-disclosure@xxxxxxxxxxxxxxxxx
Subject: [Full-disclosure] Screen_unlock - Windows logon screen unlocker

When you have "suspended or hibernated Windows box" and you want to resume it 
without user's password, you may be able to accomplish this by the Winlockpwn 
in case the box has Firewire port (or PCMCIA slot).
Or you may be able to do this through Ethernet interface by the Metasploit 
using pass-the-hash method and meterpreter script
(screen_unlock.rb) if it is not protected by personal firewall.

But what if there is no Firewire port / PCMCIA slot?
What if you cannot access to the box through the Network Card?

Windows' Accessibility tools (mangify.exe, osk.exe, narrator.exe,
sethc.exe) can be executed on the Logon screen and run with "System"
privilege.  By overwriting exe file of the Windows' Accessibility tool (ex. 
magnify.exe) in the hard disk directly from another OS, you will be able to 
execute any program on the Logon screen with system privilege.

Screen_unlock is Winlockpwn-like tool based on the screen_unlock.rb meterpreter 
script.  But this is a standalone executable runs on the target box and unlocks 
the Logon screen by patching msv1_0.dll loaded by LSASS.

You can download the source code and executable from,

  http://www.st.rim.or.jp/~shio/tools/screen_unlock/screen_unlock.zip
  MD5: 44c804da3ab1491ac34a5a997242f372

Usage: 

  1. Download "screen_unlock.exe" from the web site.
  2. Remove the hard disk from target box and connect it to BT4.
  3. Examine MFT number of the program file you want to overwrite.
  4. Overwrite it with screen_unlock.exe cluster-by-cluster using dd.

     For example:

     (i=0; for c in `istat -f ntfs /dev/sda1 MFT_No | grep '^[1-9]' | 
     tr -d '\n'`; do echo $c; dd if=screen_unlock.exe bs=4096 skip=$i
     count=1 | dd of=/dev/sda1 bs=4096 seek=$c count=1 conv=notrunc;
     i=`expr $i + 1`; done) 

     Cluster size (bs=) must be confirmed before execution!

  5. Put the hard disk back to target box and turn it on.
  6. On the Logon screen, execute utilman by pressing Windows_Key + U.
  7. Select the tool overwritten with screen_unlock.exe and start it.

As you know overwriting hard disk cluster may cause serious damage to the 
target system.  Please do this at your own risk.

In case the program file to overwrite (ex. magnify.exe) has been executed 
previously, this method may fail.  The SuperFetch feature of Vista and 7 may 
become a hurdle.  If you know effective way to avoid such restrictions, please 
let me know. :)

Any feedbacks are welcome.
Thank you.

Makoto Shiotsuki


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/