Tutorial  Updated

Exploitation Of Windows 7 Start Up Repair and Sticky Keys

<!--Not Liable for Damages To System or Any Misuse Of Info-->
<!--Please read the comments in the "Source Of Info" May not work and can mess up your system->


Exploitation of Windows Startup Repair and Sticky Keys:

Boot windows when you see "Starting Windows" Turn off system.

Gkl3MSN.png


Turn on system than boot into windows this should pop up:

pIr536N.png


Click "Launch Startup Repair (recommended)
Let it do it's stuff. When you get this screen push "Cancel" (MUST DO THIS DO NOT CLICK "Restore")

pYxugvA.png


After pushing cancel it should pop up this Screen:

pHCiP16.png


Click on "Show problem details" then scroll down to the bottom and click the link on the very bottom. Notepad should open up. In notepad click File/Open then double click your Local Disk (The below picture is D: because of virtual box but your's should be C: if not using virtual box.)

MAyXFwT.png


Once in your "Local Disk" click "Windows" then "System32" DO EVERYTHING I DO FROM THIS POINT! IF NOT YOU MAY BREAK YOUR COMPUTER! Scroll down and find "cmd," then make a copy of it in the same folder (Ctrl-C, Ctrl-V). You should get a file named "cmd - Copy" or something like that. :

5HMRUFk.png


Then find "sethc" in the same folder. This file runs Sticky Keys (That thing when you click shift to many times.) Rename it to "sethc 1":

F7uuTRG.png


Then rename your copy of cmd ("cmd - Copy") to "sethc"

grcYqLB.png


Now exit Notepad and turn off your computer either by clicking "Finish" or Restart it manually. Now it should boot up to the login screen:

dZF2CDh.png


Click shift 5 times to open up cmd (As seen as above)
Next, we need to find out your local administrator is. To do this type in (To the cmd) "net localgroup Administrators" This will show all the admins on your PC look for an administrator account that does not have your school/work domain in front of it followed by "./" As you can see, one of the admins is named "qwaszx." This is common for schools to use random strings to ward off evil spirits (Kids).

GgF7xE2.png


Now we need to change the admin password to do so type (Into cmd) "net user <ACCOUNT NAME HERE> *" Then type in your new password twice (Into cmd) Now you can log on to the admin account! But some schools/workplaces like to disable this account if so just go and do the following things:

4J0GnCI.png


If admin disabled type "net user <ACCOUNT NAME HERE> /active:yes" This will allow you to access the admin account.

Ny5K0BL.png


(SOURCE OF INFO)
 
Last edited by Luglige,

Captain_N

Well-Known Member
Member
Joined
Mar 29, 2010
Messages
1,903
Trophies
2
XP
2,018
Country
United States
the start up and repair should be disabled. The admins are not going to do that tho. Will this work on computers that have no local accounts because they are using active directory. I know for a fact that at my work you cant login to a local account as its controlled by active directory domain server. no internet means no login. They have that shit pretty locked down as well as bios passwords.... the computers wont even bring up the login screen when there is no server communication. they also have recovery disabled which they dont need as all student pcs are imaged and store no personal data.
there is one possible flaw. they did not disable windows 7 power shell on student accounts. Thats is a big way in. The powershell whould be running under least privilege but still its a way in.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    Xdqwerty @ Xdqwerty: @Psionic Roshambo, I thought dbz abridged ended at the cell saga