Gain Access to Any Windows Computer

Sounds great, right?

The concept is simple: reset the local admin account. Resetting the admin account password is not that difficult. Using a bootable linux CD to start the computer, and overwrite the password file can done the job. However, this will leaves a discover problem, as the real administrator will knows this when they do actual maintenance.

A more clever way is to copy the password file in advance, reset the password to gain access and copy back the backed up password file. This will do the track with less likely to be discovered.

An advanced level is to get the password, instead of copy the password file.

There are two interesting files in any Windows system. They are:

1. WINDOWS\system32\config\system and
2. WINDOWS\system32\config\sam

Once you have these two files by any means, you actually have all local passwords. You can extract the syskey and dump all the password hashes. Once you obtained the hashes, you can make use of some rainbow tables online to "check" what the password is.

Because in most cases, local admin password of all workstations are the same due to disk cloning technique for fast deployment in a corporate environment. This means once you distribute a notebook to a user, the user will have the local admin password for all workstations in the environment. If your administrator is so careless to have the domain admin password the same as the local admin password, you are now controlling your whole network of Windows computer.