Windows 8 just launched. Its best ever gift to all Security Aspirants to know about its back drops and advantages.
For any query contact: nutan.appin@gmail.com
1. White Paper On
“Cracking Windows 8 Password & its
Counter Measures”
Presented By:
Mohit Rawat
Under Guidance of:
Nutan Kumar Panda
1|Page
2. Contact: mohitreload@gmail.com
Table of Content
CHAPTER No. Title Page No
1. Introduction of Windows 8 3
2. Backdoor creation in Windows 8 4
3. Step by step process 5
4. What can be done after getting cmd? 15
5. There is certain problem with above steps. 17
6. Alternate Way 17
7. Dump Windows 8 Password in Plain Text 19
8. Security Measures 23
9. Conclusion 29
10. References 30
2 Project by – Mohit Rawat
3. Contact: mohitreload@gmail.com
1. Introduction to
Windows 8 is an operating system produced by Microsoft for use on personal computers,
including home and business desktops, laptops, tablets, and home theater PCs.
Development of this operating system started before the release of its predecessor in 2009. Its
existence was first announced in January 2011 at Consumer Electronics Show. During its
development and test phases, Microsoft released three pre-release versions: Developer
Preview (September 13, 2011), Consumer Preview (February 29, 2012), and Release Preview
(May 31, 2012). On August 1, 2012, Windows 8 graduated from the development stage and
was released to manufacturing. Windows 8 is slated for general availability on October 26,
2012.
Windows 8 introduces significant changes to the operating system's graphical user interface
and platform, such as a new interface design incorporating a new design language used by
other Microsoft products, a new Start screen to replace the Start menu used by previous
versions of Windows, a new online store that can be used to obtain new applications, along
with a new platform for apps that can provide what developers described as a "fast and fluid"
experience with emphasis on touchscreen input. Additional security features were also added
to the operating system, such as a built-in antivirus program and a secure boot feature on
systems with UEFIfirmware. Secure boot requires the operating system to be digitally signed
to protect malware from infecting the boot process. The implementation of this feature has
sparked controversy among supporters of free software. Windows 8 also introduces an
edition of the operating system designed to run on devices that utilize the ARM architecture,
known as Windows RT.
This project is tested on Windows 8 Consumer Preview and the best thing about this project is this is
done before official release of Windows 8. And the official stable version will release on 26th October
2012.
3 Project by – Mohit Rawat
4. Contact: mohitreload@gmail.com
2. Backdoor creation in Windows 8
2.1 Define:Backdoor
Creating a backdoor is a technique to maintain Un-authorized access to a system. This is an old and
evergreen technique.
2.2 From where backdoor will generate?
As we know there are certain processes that start with windows startup and runs with the login
screen. We will target one of such process and perform this attack.
2.3 What is that process?
That process is “sethc.exe”. It is the process associated with the service “Sticky key”.
2.4 What to do with sethc.exe?
When we press 5 time shift button this service runs on a windows system by the process sethc.exe.
That means if we press 5 time shift button the sub routine calls the sethc.exe process and though it
starts Sticky Key. If we will change any other service which can provide us admin level privileges to
read, write or edit then we can access the system quite easily.
2.5 What are the services than can be used for backdoor?
You can use anything you want that you think will be helpful to you.
2.6 Any suggestions for the same?
You can use cmd.exe, explorer.exe, etc…
2.7 What you are going to use?
I am going to use cmd.exe to create backdoor. As it will allow me to use windows in cli mode.
4 Project by – Mohit Rawat
5. Contact: mohitreload@gmail.com
3. Step by step process
Go to my computers.open c drive.
Goto windows. Then goto system32
Find sethc in system32
5 Project by – Mohit Rawat
15. Contact: mohitreload@gmail.com
4. What can be done after getting cmd?
4.1 We can write commands to see the user name?
>net user
It will show all the available user names
4.2 Than we can change passwords of a user name.Let’s change the password of Administrator
>net user administrator hacked
Here hacked will be the new password for administrator
4.3 To create a new username
>net user devil hacker/add
This will create a new user name devil with password hacker but it will be a limited privileged
account
4.4 To make the new user administrator
>net localgroup administrators devil/add
Here devil will get the administration privilege
4.5 If you don’t want commands you can also do it in GUI
>control userpasswords2
15 Project by – Mohit Rawat
16. Contact: mohitreload@gmail.com
We can reset password from here or we can add a new user from their by
clicking add
By click on new user we can add a new user in windows 8
16 Project by – Mohit Rawat
17. Contact: mohitreload@gmail.com
Press ok and we get a new user for windows 8
5. There are certain problem with above steps.
1. If we change the password of Administrator, user can guess that
someonehacked his system.
2. If we create a new user than also user can suspect something fishy.
3. So is there a way without changing the passwords or creating a new
account we can still able to enter into a system?
6. The Alternate Way
By press shift key five tymes we get a cmd and by enter explorer.exe we get a tray at the bottom
of the window
17 Project by – Mohit Rawat
19. Contact: mohitreload@gmail.com
On clicking on destrop we get a path to other folder present on system
We can visit anywhere from their.we can also open IE from here
Yes This is the way hackers use to enter into someone’s system without his or her permission.
You can be a victim also.
Tips: Always check your sticky key whether it is opening something
different or the normal screen. If some other thing opens than simply
format your system.
19 Project by – Mohit Rawat
20. Contact: mohitreload@gmail.com
7. Dump Windows 8 Password in Plain Text
This technique can be used in Windows xp, vista, 7 and also in 8. We use a software called mimikatz
for this.
7.1 Download mimkatz
http://blog.gentilkiwi.com/downloads/mimikatz_trunk.zip
open up the mimikatz.exe in the mimikatz folder with your type of OS. As I am having windows 32
bit I am opening mimikatz.exe from win32 folder.
Run as administrator the mimikatz.exe
Then you might get something like mimkatz#
20 Project by – Mohit Rawat
23. Contact: mohitreload@gmail.com
8. Security Measures
Windows 8 is vurnable to text passwords by using backdoor and by using softwares like mimkatz so
to overcome this we use picture passwords. Procedure to set picture password is given below.
Go to Left bottom corner of the desktop and than settings
Goto settings, then goto more PC setting
23 Project by – Mohit Rawat
25. Contact: mohitreload@gmail.com
Click on create on a picture password.
It will ask for current text password . Enter the password and press ok
25 Project by – Mohit Rawat
26. Contact: mohitreload@gmail.com
select picture to set picture password
Chose picture and click on open.
Click on use this picture. After selecting picture set picture password
26 Project by – Mohit Rawat
28. Contact: mohitreload@gmail.com
Tips: As Picture password is a new concept. It is quite difficult to hack. So Use
it and be secured.
*************
28 Project by – Mohit Rawat
29. Contact: mohitreload@gmail.com
9. Conclusion
At the time of comparison between windows & linux OS, we assume
that windows is less secure than linux OS .Upcoming latest OS of
Windows 8 is one of them it has several vulnerabilities such as we get
password of windows 8 in plain text by using software’s like mimikatz.
This project is dedicated to password associated vulnerabilities and
how to fix them.
29 Project by – Mohit Rawat