I'm working on a pentest project (with permission of course). I'm trying to get the local hash on a computer so that I can crack it and use it as a skeleton key for other computers (all computers have the same local password).
Some things I've tried:
- Noobish Sticky Keys Trick (Registry changed, no recovery menu presented on reboot)
- Reverse Meterpreter Shell with various privilege elevation exploits (no dice)
- Booting Linux, accessing hashes through live CD, using sticky keys trick, rainbow tables, etc.
The third would be the most viable option, but the BIOS is locked/password protected. So I would just clear/reset the BIOS, but the PC case is physically locked.
How in the world can I get the hashes off of this computer? I would think that the BIOS is the weak link, but again, I can't seem to clear or reset it without the BIOS password. It's just a simple Windows 7 box, but it is proving to be quite the adversary.
Rephrasing this as a more information security question, what are some ways attackers could reset the BIOS without access to the motherboard?