(Aug 3, 2024 05:53 AM)DramaKing Wrote: Best way to do this is to ask him if he can make you an administrator so that you won't get in trouble. But it sounds like you want to know what his password is so that there are no user changes. So what you can do is boot into the Advanced Startup Options / Advanced System Recovery as mentioned after making sure that BitLocker is not enabled. Then open a Command Prompt and enter the following commands.
Code
C:
cd C:\Windows\System32\config
copy SAM C:\Users\<username>\
copy SYSTEM C:\Users\<username>\
shutdown /r /t 0
Then you can download samdump2 and feed it the registry hives in your home folder. It may not be updated with Microsoft's latest encryption, so in that case you can try to find Python installed on the system or download a portable version of Python 3, as well as impacket and run 'python3 secretsdump.py -system SYSTEM -sam SAM LOCAL'.
Or you can use the Sticky Keys method to get a SYSTEM-level Command Prompt as previously mentioned as long as your dad never hits the Shift key five times in succession.
ok ok,i think im starting to get this, alright,so to make sure..,to go into advanced startup options i have to press shift + restart,then i can go to cmd prompt,i went there once before,what do you mean by registery hives? Im guessing its something to do with registry editor? If thats the case,i cant change any values on there.
You need admin privs for registry editor. The Command Prompt in WinRE is a back way in. You need the SAM file or 'hive' at C:\Windows\System32\config\SAM for the System Accounts Manager and the SYSTEM hive for the encryption key.
(Aug 3, 2024 06:20 AM)DramaKing Wrote: You need admin privs for registry editor. The Command Prompt in WinRE is a back way in. You need the SAM file or 'hive' at C:\Windows\System32\config\SAM for the System Accounts Manager and the SYSTEM hive for the encryption key.
I'm (painfully obviously) not smarter then you....and i cant understand any of this,sorry if this sounds like im whining,but really i dont understand what this is,so i DO need the registry editor with admin priviliges?
(Aug 3, 2024 12:06 PM)Centsicles Wrote: I'm (painfully obviously) not smarter then you....and i cant understand any of this,sorry if this sounds like im whining,but really i dont understand what this is,so i DO need the registry editor with admin priviliges?
Sorry if I'm not being clear. I should create a full tutorial on this, well, maybe I can make a video or find one.
(Aug 3, 2024 12:06 PM)Centsicles Wrote: I'm (painfully obviously) not smarter then you....and i cant understand any of this,sorry if this sounds like im whining,but really i dont understand what this is,so i DO need the registry editor with admin priviliges?
please do.And also if it helps when my dad is putting in his password there are two options,he could put in his account password or he could put in his hotmail password.He forgot the account password so he uses his hotmail one.
(Aug 4, 2024 01:41 AM)Centsicles Wrote: please do.And also if it helps when my dad is putting in his password there are two options,he could put in his account password or he could put in his hotmail password.He forgot the account password so he uses his hotmail one.
Uh, Windows accounts should be either Microsoft or local, not both. If he used a PIN, I theoretically would be able to retrieve that.
(Aug 4, 2024 04:43 AM)DramaKing Wrote: Uh, Windows accounts should be either Microsoft or local, not both. If he used a PIN, I theoretically would be able to retrieve that.
when it shows up with the uac prompt,it automatically comes up with local,but if i click more choices,it comes up with pin and underneath it is my dads hotmail
Aug 4, 2024 06:27 AM (This post was last modified: Aug 4, 2024 06:40 AM by DramaKing.)
(Aug 4, 2024 05:48 AM)Centsicles Wrote: when it shows up with the uac prompt,it automatically comes up with local,but if i click more choices,it comes up with pin and underneath it is my dads hotmail
Okay, it's a Microsoft account, at least currently. Let's start over and go step-by-step.
------
Never mind. At some point, Microsoft changed WinRE / Advanced Startup Options so that the Command Prompt requires an administrator password. We can consider this patched. If you really want this and just can't get a flash drive, you're going to need to do this the hard way. That means BeRoot, Seatbelt, PowerSploit's Privesc and Power-Up, winPEAS, and other tools that will set AV alarm bells ringing. I'll post the related video for you again, the one that goes in-depth. Then there's UAC bypasses. I'll give you one and leave you to find others. Again, MS will have patched some of them, and many others will have AV signatures created for them.
(Aug 4, 2024 06:27 AM)DramaKing Wrote: Okay, it's a Microsoft account, at least currently. Let's start over and go step-by-step.
------
Never mind. At some point, Microsoft changed WinRE / Advanced Startup Options so that the Command Prompt requires an administrator password. We can consider this patched. If you really want this and just can't get a flash drive, you're going to need to do this the hard way. That means BeRoot, Seatbelt, PowerSploit's Privesc and Power-Up, winPEAS, and other tools that will set AV alarm bells ringing. I'll post the related video for you again, the one that goes in-depth. Then there's UAC bypasses. I'll give you one and leave you to find others. Again, MS will have patched some of them, and many others will have AV signatures created for them.
(Aug 4, 2024 11:02 AM)Centsicles Wrote: how do i check for if i have access to the system directories
Run 'whoami' in the Command Prompt. If it prints anything but 'NT Authority\SYSTEM,' you don't. C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc is locked while the system is running and requires the highest privileges. Even Invoke-NinjaCopy and vssadmin require admin privileges. Expect that you will need a series of techniques.
(Aug 4, 2024 01:52 PM)DramaKing Wrote: Run 'whoami' in the Command Prompt. If it prints anything but 'NT Authority\SYSTEM,' you don't. C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc is locked while the system is running and requires the highest privileges. Even Invoke-NinjaCopy and vssadmin require admin privileges. Expect that you will need a series of techniques.
No you can just download RunAsSystem or elevate a cmd shell yourself and then you get access to it
As to the contents being locked I got no idea
Aug 4, 2024 04:22 PM (This post was last modified: Aug 4, 2024 04:23 PM by DramaKing.)
(Aug 4, 2024 04:17 PM)Byte Wizard Wrote: No you can just download RunAsSystem or elevate a cmd shell yourself and then you get access to it
As to the contents being locked I got no idea
No, he can't elevate. It's a long thread but at least read the original post. The SAM hive is locked by LSASS. I presume that NGC is the same.
(Aug 4, 2024 04:22 PM)DramaKing Wrote: No, he can't elevate. It's a long thread but at least read the original post. The SAM hive is locked by LSASS. I presume that NGC is the same.
Ah my mistake
If theres this much restriction on the PC he should really just go talk to his dad about it if he can
