I understand that similar methods have been posted here, but I felt that there has been a recent influx of questions related to bypassing the login screen or gaining admin rights on laptops. Also, I dont belive this variant of the sethc vuln has been discussed.
Requirements:
Nothing special is required to do this, just a functioning computer.
- A computer running Windows 7 (It might work on Windows 8 also)
- A method of entering Startup Repair (I will include one in this guide)
Steps:
1) Enter startup repair. When I did this method all I did was remove my battery whilst booting up my PC. When I put the battery back in and booted up the startup repair option was available.
2) Once in startup repair, you will be given the option to either cancel or restore your computer, you're going to want to hit cancel. A scan will commence once you click cancel and after some time you will be presented with a box that gives the following options: Dont send and Send information. Click neither, instead click the dropdown arrow bellow both options. Doing this will present you with a text box. Scroll down until you see a blue/hyperlinked filed that is a .txt file. Click the hyperlinked text file and it should open up a file browser.
3) Once in the file browser, look at the bottom of the screen for 'file type'. The file type should be set to .txt, change this to all files.
4) Once you have changed the filetype, head to System 32. Once there, make a copy of CMD so that you have two, your regular CMD and CMD copy. Next find sethc.exe. Rename sethc.exe to sethcBACKUP.exe. Go back to your CMD copy, now rename the copied CMD to sethc.exe. This will replace sticky keys with CMD, so spamming your shift key will open CMD!
5) Once you have finished Step 4, click cancel on the file browser. Then click Dont Send, and then click finish. This will reboot your PC.
6) Once you boot up your PC, make sure you boot normally and head over to the login screen. Once there, hit shift 5-6 times and CMD should open.
7) This is the part you do what you want. What I did when I used this method was unlock the computers local administrator account and change its password to password, and logged in with that. This is, imo, the best thing to do.
I hope you have enjoyed my tutorial, if you need any help or have any questions, ask in the thread! Good luck!
No one :(
Okay, come on show me some love?
