I'm working on a pentest project (with permission of course). I'm trying to get the local hash on a computer so that I can crack it and use it as a skeleton key for other computers (all computers have the same local password).

Some things I've tried:

  1. Noobish Sticky Keys Trick (Registry changed, no recovery menu presented on reboot)
  2. Reverse Meterpreter Shell with various privilege elevation exploits (no dice)
  3. Booting Linux, accessing hashes through live CD, using sticky keys trick, rainbow tables, etc.

The third would be the most viable option, but the BIOS is locked/password protected. So I would just clear/reset the BIOS, but the PC case is physically locked.

How in the world can I get the hashes off of this computer? I would think that the BIOS is the weak link, but again, I can't seem to clear or reset it without the BIOS password. It's just a simple Windows 7 box, but it is proving to be quite the adversary.

Rephrasing this as a more information security question, what are some ways attackers could reset the BIOS without access to the motherboard?

  • 1
    Break the lock on the case. Even though you are asking this so that you can use it for a pentest, the question itself is not a security question but a computer hardware question. – schroeder Dec 6 '16 at 7:45
  • Does it have a USB port? – Julian Knight Dec 6 '16 at 8:31
  • just wait for the cmos battery backup to die – dandavis Dec 6 '16 at 19:18

Most locks ( take a picture of it and show it here or on https://reddit.com/r/lockpicking/ ) can be picked, even those annoying tubular cylinders I sometimes see on PC cases. You would only need a short and medium hook, and a tension tool (Sparrows sells one for tubular locks). Pick it by depressing pins, and pass-over all pins 3-4 times. Also google the lock, and determine if it can be bypassed with reaching tools (bent metal rods, paracord).

Do you know for a fact that you can clear the password by removing the 3V battery? Often it is in EEPROM on modern machines, so you must then - if that's the case - access the harddrive and install/overwrite binaries.