Re: Screen_unlock - Windows logon screen unlocker

["Thor (Hammer of God)" <thor () hammerofgod com>]

Cool idea?  Comon' Eddie.  This is about the stupidest fucking post since the last stupidest fucking post, whatever 
that was... 

t

> -----Original Message-----
> From: full-disclosure-bounces () lists grok org uk [mailto:full-disclosure-
> bounces () lists grok org uk] On Behalf Of McGhee, Eddie
> Sent: Sunday, August 01, 2010 2:08 AM
> To: Makoto Shiotsuki; full-disclosure () lists grok org uk
> Subject: Re: [Full-disclosure] Screen_unlock - Windows logon screen unlocker
>
> Cool idea but come on, once we have physical access there's no need to
> disconnect the hdd and connect to another machine, there is plenty tools out
> there already to get access, I suppose it does show a slightly different method
> though so thumbs up I suppose.
>
> -----Original Message-----
> From: full-disclosure-bounces () lists grok org uk [mailto:full-disclosure-
> bounces () lists grok org uk] On Behalf Of Makoto Shiotsuki
> Sent: 01 August 2010 04:20
> To: full-disclosure () lists grok org uk
> Subject: [Full-disclosure] Screen_unlock - Windows logon screen unlocker
>
> When you have "suspended or hibernated Windows box" and you want to
> resume it without user's password, you may be able to accomplish this by the
> Winlockpwn in case the box has Firewire port (or PCMCIA slot).
> Or you may be able to do this through Ethernet interface by the Metasploit
> using pass-the-hash method and meterpreter script
> (screen_unlock.rb) if it is not protected by personal firewall.
>
> But what if there is no Firewire port / PCMCIA slot?
> What if you cannot access to the box through the Network Card?
>
> Windows' Accessibility tools (mangify.exe, osk.exe, narrator.exe,
> sethc.exe) can be executed on the Logon screen and run with "System"
> privilege.  By overwriting exe file of the Windows' Accessibility tool (ex.
> magnify.exe) in the hard disk directly from another OS, you will be able to
> execute any program on the Logon screen with system privilege.
>
> Screen_unlock is Winlockpwn-like tool based on the screen_unlock.rb
> meterpreter script.  But this is a standalone executable runs on the target box
> and unlocks the Logon screen by patching msv1_0.dll loaded by LSASS.
>
> You can download the source code and executable from,
>
>  http://www.st.rim.or.jp/~shio/tools/screen_unlock/screen_unlock.zip
>  MD5: 44c804da3ab1491ac34a5a997242f372
>
> Usage:
>
>  1. Download "screen_unlock.exe" from the web site.
>  2. Remove the hard disk from target box and connect it to BT4.
>  3. Examine MFT number of the program file you want to overwrite.
>  4. Overwrite it with screen_unlock.exe cluster-by-cluster using dd.
>
>     For example:
>
>     (i=0; for c in `istat -f ntfs /dev/sda1 MFT_No | grep '^[1-9]' |
>     tr -d '\n'`; do echo $c; dd if=screen_unlock.exe bs=4096 skip=$i
>     count=1 | dd of=/dev/sda1 bs=4096 seek=$c count=1 conv=notrunc;
>     i=`expr $i + 1`; done)
>
>     Cluster size (bs=) must be confirmed before execution!
>
>  5. Put the hard disk back to target box and turn it on.
>  6. On the Logon screen, execute utilman by pressing Windows_Key + U.
>  7. Select the tool overwritten with screen_unlock.exe and start it.
>
> As you know overwriting hard disk cluster may cause serious damage to the
> target system.  Please do this at your own risk.
>
> In case the program file to overwrite (ex. magnify.exe) has been executed
> previously, this method may fail.  The SuperFetch feature of Vista and 7 may
> become a hurdle.  If you know effective way to avoid such restrictions, please
> let me know. :)
>
> Any feedbacks are welcome.
> Thank you.
>
> Makoto Shiotsuki
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/