3

I have a physical access to HDD with "target" Widows 10 Pro installation. I can't login into this system as admin. I need to make the system trust my own CA. Is it possible to somehow put the certificate as trusted into windows while it's off, and then, when booted, have it trust that certificate?

I know Windows stores it's certificated in Registry. By looking into it, it seems like it is in REG_BINARY format, a blob of a certificate. I could load a system hive from the target disk via different windows installation that I am an admin off, and theoretically, I could put entries into it. The question is - do the blob for the same cert in registry differ from one Windows installation to another. Any hint on the matter would be much appreciated.

Additional info: The disk is not encrypted, I can modify files on it, I can see the Windows folder, and write to it.

  • 2
    Just to clarify, which Windows installation are we talking here? If it is an XP you may consider something like Windows PE with DaRT (technet.microsoft.com/en-us/windows/hh826071) then you should be able to alter the hive by loading it. I have not tried with anything newer, but it may well work... – RLFP Aug 12 '16 at 12:28
  • @RLFP Windows 10 is in question. Added it to question. – Maxim V. Pavlov Aug 12 '16 at 12:32
  • 1
    Let's assume the disk is not encrypted... – Thomas Weller Aug 12 '16 at 12:37
2

You can do this. First, look at the certificate properties and locate the thumbprint value. For an example, let's look at an existing certificate which you can do this using the MMC Certificates snap-in:

MMC Certificates Snap-in

Select Local Computer and then browse to the Trusted Certification Authorities section to view the certificates there:

MMC Snap-in

Looking at the properties, locate the Thumbprint value:

Certificate Properties

Now, open Regedit.exe and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates and find that thumbprint in the list:

Regedit

Right-click that value and export it to a file. Next, mount the other hard drive and load the HKLM registry hive and import that value. The certificate should now be trusted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.