5

This tool requires physical access of course, and there are many things you can do once you have physical access, but this peaked my curiosity.

The tool in question: https://www.kickstarter.com/projects/jontylovell/password-reset-key?ref=discovery

Obviously the magic to this piece of hardware is what's contained on it, and if that is true, any usb key could be used to accomplish the same job. I know there are software like Katana and the like that can do similar things.

My question is, does anyone know what this could be running to make this happen? Is it rubber ducky-like (http://hakshop.myshopify.com/products/usb-rubber-ducky-deluxe) or something else?

I'm a security professional and penetration tester by trade, but no administrative windows expert and most of my work is done remotely, so I put this out to the on-site guys and the windows experts.

I'm not looking to knock off the product, in fact, I think quite the opposite, its a cool piece of kit and may purchase one for kicks. Just curious if anyone knows whats going on behind the curtain.

Improve this question
6
  • 2
    Try the Hirens Boot CD (HBCD for short). It works great for me... hirensbootcd.org/download
    – KnightOfNi
    Commented Jan 28, 2014 at 2:43
  • Thanks. I'm familiar with Hirens, great tool. I was more interested in what the kickstarter product is using on the software side.
    – eficker
    Commented Jan 28, 2014 at 2:55
  • I was hoping someone might have knowledge of the software itself, but it probably is some sort of barebones linux with some scripting behind it. Sounds like it may not be off-the-shelf. Thanks for all the great responses, however. I will wait to see if any more come up and then pick an answer. Thanks!
    – eficker
    Commented Jan 28, 2014 at 3:15
  • 1
    It's not linux, it kind of emulates XP. But it does change locally stored passwords, along with a ****load of other stuff I never use :)
    – KnightOfNi
    Commented Jan 28, 2014 at 3:32
  • I always thought the gui it runs was interesting. Looks like xp, acts like something someone wrote in there garage. It has saved me many times, however, when i didn't quite have drivers for hardware and whatnot.
    – eficker
    Commented Jan 28, 2014 at 4:00

6 Answers 6

Reset to default
6

Resetting a windows password is not equivalent to recovering a windows password.

Resetting a password

The password can be reset by booting to another operating system and editing the registry hive. This is trivial, and there are many tools which can do it, such as Trinity Recovery Kit. I suspect this USB stick just boots to a version of Linux and runs a few scripts.

In summary: Just write blank password entries into the SAM (which is basically just stored in the registry protected by an ACL so only SYSTEM can access it).

However resetting a windows password denies access to EFS encrypted files and DPAPI encrypted data, since the keys for these are encrypted using a KEK derived from the password. When the user changes their password, they are re-encrypted with the new KEK. Access to EFS and DPAPI resources is lost even if the administrator resets the password.

Recovering a password

A recovered password allows continued access to EFS and DPAPI protected resources. In addition, it may give access to additional resources (e.g. it may be a domain logon).

To recover the password you need a tool like John the Ripper, Lopht or HashCat. Which could also run off a USB stick. Extract the hashes from the SAM, feed them to a cracking program. Then reboot and log in with recovered passwords.

Improve this answer
4
  • Ben, thanks for the response. Great in-depth writeup about how this works. I didn't realize it was an ACL that protects the registry entry. One thing that made ms08-067 such a huge vulnerability (among other things of course). On the cracking front, it seems like collection to the usb stick and then cracking elsewhere would be a better option, but this isn't being marketed as a hacking tool of course.
    – eficker
    Commented Jan 28, 2014 at 3:12
  • @eficker, Not sure what the relationship to ms08-067 is? The ACL on the registry is not really any different to /etc/shadow being accessible only by root - the same methods will work against Linux of course - if you boot to an OS where you are root, you can read everything.
    – Ben
    Commented Jan 28, 2014 at 8:00
  • ms08-067 gave you a system level access, allowing all kinds of access, including dumping the password hashes out of the registry. Anyway, besides the point.
    – eficker
    Commented Jan 28, 2014 at 23:50
  • 4
    Whole-disk encryption would help defend against this. Without the decryption key, even an attacker with physical access will not be able to read/modify the registry when booting to their own media. However, that same attacker could install hardware keyloggers or other tools that would help them capture the keys or the authenticators to unlock those keys for later use.
    – Iszi
    Commented Jun 7, 2014 at 5:01
8

The kickstarter page actually gives away the method:

Using the key you can boot the PC into a special admin mode that allows you to view all of the user accounts and reset any password. Quickly regain control of the PC and get back to work.

Basically you reboot the PC with a custom OS located on the USB flash drive itself; from that OS, the relevant files on the disk are modified. The USB device is nothing special: it is just a normal USB flash drive; the "added value" of this device is purely aesthetic. Downloadable boot images which can do the same thing from a "normal" USB flash drive can be obtained from various places, e.g. this one.

This password reset method will fail if any of the following holds:

  • The boot-on-USB option was deactivated in the BIOS, and a BIOS password was set to prevent reactivation (of course, some BIOS accept "default passwords", and a BIOS password can be cleared by removing the CMOS battery, which is doable with physical access and a screwdriver).

  • The operating system uses disk encryption and requires a password upon boot -- not just as a verification, but because the encryption key is derived from the password (TrueCrypt can do that).

Also, as @Ben explains, a password reset is not recovery: that which was encrypted with a key derived from the old password remains inaccessible.

Improve this answer
1
  • Thomas- thanks for the response. Good point on the bios. I once did this in a class I was teaching to demonstrate how physical access is all access. Also, some bioses (biosi?) have a hotkey during boot for boot source options.
    – eficker
    Commented Jan 28, 2014 at 3:10
3

There have been Windows password reset CDs for some years that let you do this. You can put a slightly modified image on a bootable USB stick. I presume this key simply packages existing software in a pre-packaged key.

The reset CDs do NOT work if the disk is encrypted. All security professionals know that a non-encrypted disk is not safe against an attacker with physical access.

Two popular boot CDs work in completely different ways:

Offline NT Password & Registry Editor - This is actually a bootable Linux system, which can read the Windows file system, and reset a password hash. It works most of the time, but the support for the Security Accounts Manager (SAM) - where Windows stores password hashes - is not perfect. So sometimes it just doesn't work, and risks corrupting the SAM. This is free.

Kon Boot - This boots the Windows system that is password protected, but hot patches it to disable asking you for a password - you just get logged in as administrator automatically. In my experience it is more reliable than the other tool. It is not free, but is quite cheap.

There may be other approaches, in particular based on Windows PE but I'm not familiar with them.

Improve this answer
2
  • I have used ONTPRE many times - I really like it
    – cutrightjm
    Commented Jan 27, 2014 at 22:41
  • paj- Thanks for the response. I neglected to think about disk enc, but great point. Of course and sadly 99% of harddrives are probably not encrypted, especially on the consumer side which it seems this product is focused.
    – eficker
    Commented Jan 28, 2014 at 3:02
1

Password Reset Key seems to contain a modified Windows PE OS. I think it is something similar to PCUnlocker Live CD/USB drive. It's not a completely new thing. There are many freeware such as Rufus, ISO2Disc which allows you install a Windows OS on a USB drive.

Improve this answer
1

I bet the use "Ultimate Boot CD running BartPE" there was a live cd on the net some time ago this did let you do all these operations. I am sure it will not decrypt the password hash on the fly.. It will rather exchange that hash with an own generated... pasword reset like... And will have the same effect. http://obrazki.tnttorrent.info/tnt24.info_German_Police_-_Special_Windows_Boot_CD_ENG_GER_.2218__253984.gif?image Similar to this one. this windows live cd was also only some hundred mb. and you could start it also while pc was locked, it made a new start button pop out and gave you access to everything through this.

Improve this answer
0

In windows you can replace 'utilman.exe' with 'cmd.exe' using a windows installer media.

Boot into repair mode and open up a command prompt, CD into C:\, go to system32, backup the exe's and replace utilman with cmd.

Restart your computer, click the "ease of access" button down in the left corner, suddenly, a wild CMD prompt appears with admin rights.

Now you can just change the PW of any user.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .