Bypassing Windows Login – The easy way
I am an experienced Vulnerability Researcher and Security Architect with 16+ years of experience in various verticals and horizontals, be it consumer electronics, semiconductors, automotive or other. Having started in software engineer in low-level embedded devices from writing applications to kernel drivers on various operating systems and then moving to my real calling i.e. hacking. Love to stick to the older golden days of game hacking, BBS, shareware, phreaking, phrack, virus era, metal music, cheats and many more such cool stuff from the underground. I wear many hats from time to time as necessary - but I also love to help people and organizations to deal with the core cybersecurity issues and not provide them a checklist with a presentation. Opinions and posts on my site are purely my own and do not reflect my work.
Recently I came across an office laptop which everyone had forgotten the password of. Little to my surprise all the standard combinations that we use didn’t work either. Being part of a startup we do not have a domain controller or an super admin account like the ones available in enterprise environment, such that this admin account can manage the users on the PC/Machine in a define and proper way.
However, we don’t have any such provisions – I know it sucks !
Unfortunately after trying multiple password combinations and combing through BIOS settings, i decided to reset it using a different mechanism. The one way – how forensics guys extract data from locked machines.
Method:
I downloaded a copy of pop os(doesn’t matter which one Kali will work fine to) –
Created a bootable iso with Balena
Plugged in the USB into the windows machine
Booted into the live PopOS
Connected the live OS to a WiFi for downloading some tools
Tools required:
lsblk – to find out where the windows partition is mounted
samdump2 – do dump LM/NTLM hashes from SAM file(\Users\Windows32\system\SAM)
blkhive – to read the SAM file as it is in windows registry format
chntpw – to edit the SAM file
Execute:
#chntpw -l SAM (returns the list of users in the SAM file)
//Select your user
#chntpw -r
//This tool will ask you to reset or clear the password
- Just select option 2 to clear password for your user
- If the user is locked - unlock with
#samunlock -U
- then run the chntpw again to clear the password
If this is success – Reboot – Remove the Live USB !
Password should be reset for that user name and must be empty login now.
Done !
Note: This might not work for a number of below scenarios:
Bitlocker is enabled
Some tool is protecting SAM file
SAM file is stored encrypted
Some password is set to protect SAM file
You can also try to crack the LM/NTLM hashes mentioned in the SAM file – but if the password is strong then you will be out of luck.
