Full Disclosure mailing list archives
Re: Abusing Windows 7 Recovery Process
From: Gregory Boddin <gregory () siwhine net>
Date: Wed, 10 Jul 2013 15:51:22 +0200
It won't. The whole point is to have full local access to hard-drives (from a locked workstation for eg), to modify/read things in it. The loaded environment IS a live environment. I would say: almost a copy of the install CD loaded from the hard-drive. What you can do is : take the SAM, modify somewhere else (not a windows expert tough), re-inject and gain local access. (which is kind of useless since local data are already available once the recovery is booted, unless there's software you would like to run in that workstation once the password is reset). On 9 July 2013 20:39, some one <s3cret.squirell () gmail com> wrote:
My initial thoughts after adding the user and rebooting was that it was only valid in the recovery console session or something as once i rebooted it was gone... Tried it again today in a different place and same deal. Reboot no new user... Anyone have this working after reboot? Once you've inserted your payload with admin-or-better rights, it can be anything from a rootkit that GP can't touch to a patched GP subsys that doesn't apply AD policies. This isn't really a caveat. On 2013-07-08 12:39:18 (+0200), Fabien DUCHENE wrote:There may be an Active Directory domain policy which only allows a configured set of groups/users to be admin of your workstation. Keep in mind domain policies are applied at startup and periodically._______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Abusing Windows 7 Recovery Process some one (Jul 01)
- <Possible follow-ups>
- Re: Abusing Windows 7 Recovery Process Fabien DUCHENE (Jul 08)
- Re: Abusing Windows 7 Recovery Process some one (Jul 08)
- Re: Abusing Windows 7 Recovery Process Chris Arg (Jul 09)
- Re: Abusing Windows 7 Recovery Process sec (Jul 08)
- Re: Abusing Windows 7 Recovery Process some one (Jul 10)
- Re: Abusing Windows 7 Recovery Process Gregory Boddin (Jul 10)
- Re: Abusing Windows 7 Recovery Process some one (Jul 10)
- Re: Abusing Windows 7 Recovery Process adam (Jul 10)
- Re: Abusing Windows 7 Recovery Process some one (Jul 10)
- Re: Abusing Windows 7 Recovery Process Alex (Jul 12)
- Re: Abusing Windows 7 Recovery Process Chris Arg (Jul 12)
- Re: Abusing Windows 7 Recovery Process Alex (Jul 13)
- Re: Abusing Windows 7 Recovery Process Julius Kivimäki (Jul 13)
- Re: Abusing Windows 7 Recovery Process Alex (Jul 13)
- Re: Abusing Windows 7 Recovery Process Valdis . Kletnieks (Jul 13)
- Re: Abusing Windows 7 Recovery Process Moshe Israel (Jul 14)
- Re: Abusing Windows 7 Recovery Process some one (Jul 08)