[HN Gopher] Unshackle: A tool to bypass Windows and Linux passwo...
___________________________________________________________________
Unshackle: A tool to bypass Windows and Linux password logins
Author : AdvDebug
Score : 77 points
Date : 2023-07-20 10:54 UTC (12 hours ago)
(HTM) web link (github.com)
(TXT) w3m dump (github.com)
| majkinetor wrote:
| Title seems like some form anti-windows campaign while tool
| clearly states its for both windows and linux.
| pge wrote:
| I had a similar reaction at first, but the title is accurate.
| The tool only works on Windows. From the site:
|
| >Tested on : >Windows 10 pro x64
|
| >Linux bypass is still under development.
| majkinetor wrote:
| No its not, the title on GitHub is different.
|
| It also states under Usage: Choose your OS (Windows or
| Linux).
|
| You can't say until using it which aspect of Linux support is
| under development.
| zokier wrote:
| > You can't say until using it which aspect of Linux
| support is under development.
|
| Its not big project, you can pretty quickly browse through
| the code and see that there is zero linux support
| haspok wrote:
| Seems to be from the Windows 7 era - doubt it will work at all on
| later versions: https://superuser.com/questions/732605/how-to-
| prevent-the-se...
|
| ps. I stand corrected - probably something similar still works:
| https://4sysops.com/archives/reset-a-windows-11-password-and...
| agadius wrote:
| Where's the source code for the binary file called "unshackle"
| which is used in the solution? (This one:
| https://github.com/Fadi002/unshackle/raw/main/unshackle)
| codys wrote:
| It appears to be a pyinstaller generated executable, presumably
| we'd expect it to contain https://github.com/Fadi002/unshackle/
| blob/main/src/unshackle..., but I haven't confirmed that.
| Timwi wrote:
| Hm, it says to press Shift 5 times on the Windows login screen.
| By default this will enable sticky keys. Is that the intention or
| is that a conflicting keybind?
| dist-epoch wrote:
| They replace the sticky keys executable with an exploit which
| you trigger with the 5 x Shift key presses.
| pjerem wrote:
| Smart !
| tallanvor wrote:
| It requires physical access to the machine, which is always 95%
| of the game. Plus, Bitlocker would prevent this from working, so
| if you're using a recent computer and have Pro/Enterprise and
| enable it, you don't have to worry about this attack vector.
| CleanCoder wrote:
| The limitations of this tool are obvious from the author's
| documentation. Plus, a door lock would prevent this from
| working, so if you're living in a recent house and have thick
| door and lock the door, you don't have to worry about this
| attack vector. It's strongly suggested to also hot glue your
| USB ports shut for added security.
| NoMoreNicksLeft wrote:
| > It's strongly suggested to also hot glue your USB ports
| shut for added security.
|
| I don't see any reason to stop at _my_ USB ports. Take a hot
| glue gun with you where ever you go, and glue them all shut
| as soon as you find them. Help make the world a better place.
| dotancohen wrote:
| > It's strongly suggested to also hot glue your USB ports
| shut for added security.
|
| I'll just unplug your mouse / keyboard / wifi dongle and get
| to the USB port that it's using. Unless you are suggesting
| that modern computers should ship with zero USB ports.
| 8n4vidtmkvmk wrote:
| Jokes on you, I'll open the computer case and plug directly
| into the mobo
| jesprenj wrote:
| You couldn't, the case cover is hot-glued to the case.
| Hot-glue is the epitome of Windows security.
| squarefoot wrote:
| These days I would simply let the PC in the sun until it
| melts all glue.
|
| /s (not so much)
| toast0 wrote:
| All the cards should be hot glued into place, and any
| extra connectors hotglued as well. The solution to not
| enough hotglue is simply more hotglue!
|
| > I'll just unplug your mouse / keyboard / wifi dongle
| and get to the USB port that it's using. Unless you are
| suggesting that modern computers should ship with zero
| USB ports.
|
| PS/2 is still available for mouse/keyboard (and secure).
| Wifi dongles are abomination. Worst case, hotglue those
| into the port.
| tylergetsay wrote:
| A cleaner imo solution is kon-boot which modifies the kernel on
| windows/osx to disable password checking
| catboybotnet wrote:
| Neat, but replacing Utilman.exe with cmd.exe using most Linux
| ISOs is easy, and I've already got the drives needed. The amount
| of customers that get locked out of their servers...
| shawnz wrote:
| They actually recently made this attack vector more difficult
| with a recent Windows Defender update:
|
| https://security.stackexchange.com/a/176456
| jesprenj wrote:
| A trick I used that still worked after this Defender update
| (tested some months ago) is replacing Magnify.exe with
| ftp.exe. This does not make Defender suspicipus, but one can
| open Magnify.exe from the lock screen and one can execute
| commands from within the ftp.exe shell by prefixing them with
| !. This is great, because ftp.exe binary is signed by
| Microsoft and is a completely legit binary (:
| user070223 wrote:
| On a simlliar note: Has anyone succefully installed yubikey
| windows 10(home) login for local accounts? They rereleased it for
| windows 10 I think(version 2+), but it never worked for me
| (apperently they relased a new version 2.11 recently for 11 &
| 10(22h2 fix), which I haven't tried)
| AdvDebug wrote:
| Unshackle is a simple tool that deletes windows password logins
| (Linux support coming soon) using a bootable USB Drive, and makes
| you enter the system without any passwords, based on Alpine
| Linux.
| iso1631 wrote:
| > Linux support coming soon
|
| IF you're booting I used to use vim to just edit the shadow
| file. Or simply passwd to set the password to something.
|
| How does it cope with encrypted drives?
| mrlinx wrote:
| So you replace sethc.exe with what?
| orthoxerox wrote:
| A small C++ program that calls "net users" to erase or change
| the password.
| sunbum wrote:
| [flagged]
| BlackLotus89 wrote:
| You can do the same thing without using a boot drive at all.
| * Press F11 while booting * open cmd in the rescue menu
| * navigate to windows system32 folder * rename sethc.exe to
| sethc.exe.backup * copy cmd.exe to sethc.exe * reboot
| and press at login 5 times shift * add admin user *
| profit
|
| Thing that is missing is password edit of online only accounts or
| convert to local account
| doubled112 wrote:
| Its been a few years, but I used to use chntpw.
|
| Has it stopped working?
| abwizz wrote:
| no and there are numerous alternatives.
|
| idk why this made the frontpage other than beeing interesting
| jaclaz wrote:
| Only for the record, until it lasted (seemingly noone has been
| interested in finding and updating the patterns to be patched or
| maybe some other security measure was implemented in later
| Windows 10) the "best" way (IMHO) was to patch a file.
|
| Booting from USB with grub4dos, patching the .dll then continuing
| booting and you could login as the original user but without (or
| with "any") password:
|
| http://reboot.pro/index.php?showtopic=18588
|
| There are (were) derivatives to be run from a WinPE, but any hex
| editor that could access the .dll would have done.
|
| Let's say that it was a poor man's Konboot, that has (or at least
| used to have) a similar approach, but patching files in memory.
| guilamu wrote:
| You can do that easily today with medicat (and ventoy).
| jaclaz wrote:
| Yep, but medicat lists (among other tools) the PEPassPass
| (which is a derivative of PassPass), all those tools need to
| boot into an Operating System (a PE or a Linux), change
| _something_ , then reboot to the "normal" OS.
|
| What is (was) elegant in the grub4dos PassPass is (was) that
| you booted to grub4dos, ran the batch and then _continue_
| booting to the "normal" OS.
| guilamu wrote:
| Indeed, good point.
| luma wrote:
| Why does the title say "Windows" when the repo says "Windows and
| Linux"?
| ivann wrote:
| Linux support is still marked as under development.
| dsr_ wrote:
| Which is a little strange -- since you have physical access
| and are capable of booting from a USB stick, the procedure is
| to tell the bootloader to use sh as the init, mount the root
| filesystem r/w, change the root password (copying the hash
| for later if you want to restore it), make sure it's written
| to disk and reboot into the normal system -- only now you
| have root.
|
| If you have access to the bootloader's kernel command line,
| you don't need the USB stick, either.
|
| What this doesn't do is get you access to an encrypted
| filesystem, unless the encryption password happens to be
| written somewhere in the unencrypted partition. That happens
| unsurprisingly often.
| sgerenser wrote:
| Doesn't windows use full disk encryption like macOS does these
| days? How would you unencrypted the boot drive without the
| password?
| SamuelAdams wrote:
| Windows Bitlocker is the FDE product that Microsoft uses. It's
| not enabled by default. It is possible to have Bitlocker
| disabled and password auth enabled.
| 0cf8612b2e1e wrote:
| At least on my corporate Windows laptop, the Bitlocker
| password is restricted to numeric digits only. Coupled with
| natural human laziness, and brute forcing looks fairly
| feasible.
| kekebo wrote:
| There's Bitlocker but it's optional and has to be enabled by
| the user.
| m45t3r wrote:
| There is also "Device Encryption"[1] that is separate from
| BitLocker and works in any version of Windows 10/11 as long
| TPM is available (and AFAIK is also turned on by default).
| BitLocker is only available in the Pro versions.
|
| [1]: https://support.microsoft.com/en-us/windows/turn-on-
| device-e...
| sgerenser wrote:
| Amazing. Apple has had FileVault for _20 years_ (although
| it's only in the past 9 years or so that it's been enabled
| by default).
| spydum wrote:
| How strange, shouldn't windows be checking if the binary is
| signed? Isn't that part of what secureboot and deviceguard do? Or
| does it just run like any addon?
| mr_mitm wrote:
| Windows Defender started checking for modifications to binaries
| like utilman.exe or sethc.exe a couple of years ago.
| sim7c00 wrote:
| secureboot could be leveraged for such things but as with most
| great features, only the bare minimum implementation is
| provided in 'modern secure operating systems'
| aaronmdjones wrote:
| Secure Boot only verifies the NT kernel loader; that in turn
| will verify that the kernel is signed by Microsoft, and then
| the kernel will verify any device drivers it loads. Userland
| (e.g. explorer.exe) is free to be run without any signatures
| whatsoever; this includes the login screen.
| sim7c00 wrote:
| its a shame they need to lean on defender for this. it
| wouldnt be too long of a stretch to expect windows to verify
| the binaries it ships with, and not accept unsigned ones for
| those windows / MS binaries in the windows directory :(. it
| does no justice to all the good that could be done via secure
| boot
| mr_mitm wrote:
| We don't expect Linux to do this, do we? Just use full disk
| encryption, preferably with pre-boot authentication. TPM if
| you must, but this will only make the attack somewhat more
| expensive. Other than that, the hardware is compromised as
| soon as somebody gets their hands on it. Checking the
| integrity of a few binaries is mostly security theater.
|
| Besides manipulating executables, the adversary could
| simply modify or read the user database in
| C:\Windows\System32\config\SAM. [1]
|
| Alternatively, patch routines directly in memory [2]
|
| [1] https://www.kali.org/tools/chntpw/
|
| [2] https://www.piotrbania.com/all/kon-boot/
| the8472 wrote:
| > We don't expect Linux to do this, do we?
|
| Linux can be setup to verify an immutable userland via
| secure boot + dm-verity. I think it's used in some google
| devices (chromebooks?).
| pjmlp wrote:
| Still possible, as presented at BlueHat IL 2023, the goal is
| to eventually have everything signed, based on how UWP
| sandboxing is working, now extended to Win32 as well.
|
| First set of changes already in flight for the next Windows
| 11 stable release.
| 0x53 wrote:
| Recently I forgot my password to a laptop I didn't use much. It
| was bitlocker encrypted, but I had saved the keys. So I booted
| into a live Linux system mounted the bitlocker partition with
| dislocker and then dumped the Sam hashes with impacket's
| secretsdump. Then I used hashcat to try and crack my own password
| since I thought I remembered parts of it. Ended up working!
___________________________________________________________________
(page generated 2023-07-20 23:02 UTC)