I notice quite often people tend to overcomplicate tasks in order to achieve their goals once they get in the mindset of having to get around advanced security protections. In this post I intend on outlining a really simple way of setting up a windows backdoor on a local machine. Assuming that you have physical access to the machine, and are not concerned about leaving any trails or modifying system files.
*edit*
As RaT has pointed out below a machine using full disk encryption will prevent this method.
*/edit*
I can confirm that this method works on windows 7 and windows 8, probably previous versions if they support accessibility options from the login screen.
things needed:
- a USB or CD with an OS you can live boot into
- physical access to target machine
steps;
1. turn off the machine so that it will accommodate booting from a USB/CD. With windows 8 machines fast boot may need to disabled, otherwise holding the power button sometimes works for me.
2. boot into preferred distro and mount the Windows disk
3. navigate to where you have mounted the windows disk and then navigate to /Windows/System32/
4. find and rename narrator.exe to narrator2.exe or if you have no intentions of restoring the computer simply delete the file
5. make a copy of cmd.exe and rename it to narrator.exe
6. reboot the PC, booting into windows
7. on the login screen (for this example I'm using windows 7) there should be a button that provides accessibility options, open the options and select the option that provides text to be read out loud (narrator). apply and click ok.
What should appear now is a command prompt at the login screen. from there you may change any permissions or passwords as a system level account using the basic windows commands. This method has the potential to execute any executable you wish from the login screen simply by moving the program to C:/Windows/System32/ and renaming the file to narrator.exe.
ive been currenty looking for some new joomla exploits getting tired of thumb blasting WP i was given this by a buddy https://www.youtube.com/watch?v=C4N0eNMVJY0 but want more so if u know of any not published and passed around let me know
here is the tool link http://ge.tt/5jlinwJ2/v/0 works on windows/and linux post results and no neg shit
Hello Experts.
Can you share your experience about Hacking an SSH account password? Which tool is better? Hydra, Medusa or....
Thank you.
Hello.
I canceled Hydra Scanning and it show me that I can use "-R" for resume it but When I use it, The Hydra not show the scanning progress As in the past :
7fcd53ca2000-7fcd53ca3000 rw-p 00185000 08:02 2491705 /lib/x86_64-linux-gnu/libc-2.13.so
7fcd53ca3000-7fcd53ca8000 rw-p 00000000 00:00 0
7fcd53ca8000-7fcd53e72000 r-xp 00000000 08:02 5246821 /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
7fcd53e72000-7fcd54072000 ---p 001ca000 08:02 5246821 /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
7fcd54072000-7fcd5408d000 r--p 001ca000 08:02 5246821 /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
7fcd5408d000-7fcd5409c000 rw-p 001e5000 08:02 5246821 /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
7fcd5409c000-7fcd540a0000 rw-p 00000000 00:00 0
7fcd540a0000-7fcd540df000 r-xp 00000000 08:02 5278734 /usr/lib/x86_64-linux-gnu/libssh.so.4.2.4
7fcd540df000-7fcd542de000 ---p 0003f000 08:02 5278734 /usr/lib/x86_64-linux-gnu/libssh.so.4.2.4
7fcd542de000-7fcd542e0000 rw-p 0003e000 08:02 5278734 /usr/lib/x86_64-linux-gnu/libssh.so.4.2.4
7fcd542e0000-7fcd5430a000 r-xp 00000000 08:02 5273814 /usr/lib/libpq.so.5.4
7fcd5430a000-7fcd54509000 ---p 0002a000 08:02 5273814 /usr/lib/libpq.so.5.4
7fcd54509000-7fcd5450b000 r--p 00029000 08:02 5273814 /usr/lib/libpq.so.5.4
7fcd5450b000-7fcd5450d000 rw-p 0002b000 08:02 5273814 /usr/lib/libpq.so.5.4
7fcd5450d000-7fcd547ce000 r-xp 00000000 08:02 5250075 /usr/lib/x86_64-linux-gnu/libmysqlclient.so.18.0.0
7fcd547ce000-7fcd549cd000 ---p 002c1000 08:02 5250075 /usr/lib/x86_64-linux-gnu/libmysqlclient.so.18.0.0
7fcd549cd000-7fcd549d3000 r--p 002c0000 08:02 5250075 /usr/lib/x86_64-linux-gnu/libmysqlclient.so.18.0.0
Hello.
How can I doing brute-force password hacking via Hydra?
I used "sudo nmap -sS -sV -vv -n -Pn -T5 my IP -p80 -oG - | grep 'open'" and the result is :
Host: my ip () Ports: 80/open/tcp//http//Allegro RomPager 4.07 UPnP|1.0 (ZyXEL ZyWALL 2)/
I know that "Hydra" with below syntax can do attack but use dictionary and I don't like it :
hydra -l {username} -P {password list path} -s {port} {IP Address} http-get /
I want to use Hydra without password dictionary.
Thank you.
Hello Experts.
I used Nmap for scanning an IP but the host Blocked my IP address and I can't scanning it or ping, how can I unban myself?
Any tricks fro Evading it?
Thank you.
Hello Expert.
How can I hacking Android phone that connected to my Local network via Wireless? I want to see SD card contents and SMSs. Any idea or solutions?
Thank you.