Printable View
i have an interesting problem for u all!
A systems administrator has blocked and hidden access to DOS, sys files, config files and everything useful (including mouse right click). I need access to some of these files, and up to now password crackers have all required to use DOS to run the dictoinary files. is there any way around this? what programs can u suggest? and how do they work?
Why has the admin done this???
Why do you want to undo it???
Why not ask the admin if you need access he/she will give you access!!!
Admin can and possibly know that you have been trying to use a password cracker (LOGS) if so you in D33P 5H1T
Smile =O0
Why don't you present your case to the systems administrator and get his permission to access those files? If it's legitimate, he should allow you access. If your need is not legitimate, then you don't need to access the files. You are denied access to those areas for security reasons, so you either have a legitimate need or you don't. Best thing to do is to ask the systems administrator.
Hmmmm ....
The reasons Sysadmins hide such files is to provide a level of internal network security. (I.E to stop internal users "buggering around" with the network)
If you have a legitimate reason for access, raise a work request / contact the sysadmin and ask for access to be granted to those files. It's a short, and easy method.
If you don't have such a legitimate reason then no one here is going to help you. (you will also probably get flamed)
Also another reason to beware ..... I'm a System Admin, and I work for a big company in the UK .... I might be checking through the logs as I type. Do you work at mine?? Because if so, you're looking at the wrong end of a P45.
Regards
What Operating system r u on? I am assuming you are on a lan..
try Windows hot keys, they are often over looked.
I wish upper managment would let me implement the same type of thing. To many people mess crap up when they have complete access to their computer. The only reason anyone here needs a right click is when the are using AutoCad. Other then that, everything is available through hot keys (ctrl-c to cut, etc etc). I still don't have ANY clue why someone other then a sysadmin would need DOS, sys file access, config fill access, or anything else that you claim is useful (except maybe right click in certain occassions). So if you really do need those things, contact you system administrator and ask him to unlock it for you. If he says no, then go to management and explain your situation. If they say no, that means that you have absoutly no valid reason to access those things. If you want to hack a computer, set one up at home and play with it. Work is a place to work, not hack......(maybe I should get back to work....)
Well if you can't find out how to enable the right mouse and get to dos, which in my opinion is basic script kid stuff. Then you will most likely have no idea how to use any of the cracking tools.
Just go ask your admin to enable some of this stuff for you.
OK! to further explain my predicament, the previous sys admin has 'left' and locked access to all his files and every forseeable way into them. We are currently at a dead end and no-one can fix it witout resetting the systems and loosing everything (not an option!). In respose to cwk9 I have tryed unlocking them simply through windows; writting simple override-script programs and even accessing the network core via external hacking. None of these have met with any solutions!!
In effect, the last remaining option is to locate and disable his user and password! Then recofigure the system settings and access options. However, as I stated we cannot access DOS to run any such password crackers nor can we find any that don't require DOS to run!
Please help!
If you really do have the access to locate and disable his password(s), you should also have the access to change it.Quote:
Originally posted here by chewitt1001
In effect, the last remaining option is to locate and disable his user and password! Then recofigure the system settings and access options. However, as I stated we cannot access DOS to run any such password crackers nor can we find any that don't require DOS to run!
Please help!
Passwords exist for a reason (to keep honest people, honest).
(and I honestly don't think you've given enough information here for anyone to be of any real help, here - and you've mentioned some pretty "heavy duty-like" techniques to try to get in to a system, yet you can't figure out how to get to DOS?!? Something honestly doesn't sound right to me, Bob...)
Are you sure that nobody else has admin rights. You should at least have a backup admin account. If you do. You can delete his profile and you won't loose anything.
try phoning the previous admin, and get the password (hell get legal to threaten court action)
Then again, if you have (physical) access to his machine (or even the DC), you pretty much have the password.
I've actually run into a similar problem with a previous admin keeping the passwords to the system, just because he got fired. This was at a middle school in FL that my dad works at. He asked if there was anyway around it. I told him sure there is, but I never got to doit because they ended up hiring a new admin and he knew what he was doing.
But this case does happen, especially when the last admin gets fired. (did I mention he walked out with all the software too. The school got some back but not all of it)
But the fact does remain, You don't know how to get to DOS? If you don't know how to GET there, you have no business BEING there! And especially not messing with .ini and .sys files.
Here is a word of advice. At work, your System Admin knows EVERYTHING you do to his/her computers. If you even try messing with the autoexec, or config or win.ini files you WILL get fired. I know I would if I found out someone was messing with those system files. I suggest you just leave the files alone, forget whatever the hell it was you were thinking of doing, and keep your job. But thats just my opinion.
X
so how can u access DOS? i have tried using boot disks during startup -and locating A-drive boots has been removed from the startup procedure. All MSDOS run programs are restricted access. shutting down option to DOS has been removed. MSDOS shortcuts and MSDOSprompt have been restircted! A-drive and CDrom can only be accessed through programs in which they are needed eg MicrosoftWord, and therefore it is impossible to open programs from CD or disk.
We are at a loss. there is only one admin account. in response to Draziw yes we have physical access to his computer. however pretty much having his password is what I can't do and y I asked for help in the first place!!!
p.s. password cookies and PIF.files have been removed from network access.
Quote:
i have tried using boot disks during startup -and locating A-drive boots has been removed from the startup procedure.
????
Nah I won't ask...
pull the battery or clear the CMOS and get the BIOS, enable booting from A: and go from there.
If you really have access to the machine, then you have access, and can get the system password for BIOS cleared. then go from there. there are plenty of password crackers out there, and other ways around it, that I dont need to discuss how to use. This should get you started, but I dont think anyone else is going to hold your hand thru the whole thing.
Im taking it you are the replacement admin?
if so, better start reading. Lots.
If not, hire someone competent. Or is that another "if so?"
Avenger
Chewitt,
If you can run windows, we are not talking about a BIOS password, right? Run the BIOS setup and enable A boot. But if you have the bios password problem, then just follow avenger_jcc's advice.
Sorry for my poor english, folks!
Phantasma
what i find interesting is that this problem has evolved since the first post.... it started with needing to unrestrict access to we need to get in because the sys admin left and now no one can admin. didn't you hire a new admin? wouldn't all of this be his/her job to deal with?
Ummm... and in the case of BIOS passwords, most manufacturers have "master passwords" that will bypass any other BIOS-level passwords. Getting them should be common sense, and is left as an exercise to the reader. (and getting them when you're not supposed to have them is only slightly more difficult, I must say)
well its quite simple. u can't boot externally ie from disk!!!!!!!!!!
will someone please help!!!!!!!!!
Is it me or You "chewitt"???
1/ Do you know how to enter your BIOS Setup?
y = next question
n = training required
2/ is your BIOS passworded?
y = you haven't read some of the other posts
n = i..why haven't you checked the "boot order"/available drives (some BIOS can disable the FDD)
ii .. have you checked that the FDD is working?
2a Have these posts helped you?
y = Thank you and have a nice day
n = OK what have we missunderstood?? or more.. what are you having trouble explaining to us..
perhaps a game of hot or Cold may get the answer?
cheers
The Und3rtak3r
chew..U have a privat message waiting for U
LOL, great post Und3ertak3r! lolol
:D
und3ertak3r - y/y/y
no i'm not the sys. admin and no we don't have one currently!
we have accessed the BIOS sucessfully and have booted from FDD.
the previous sys admin passwords/settings have been removed via DOS.
senior staff have requested the networks be reset (now we can access them) instead of faffin around editting each individual user settup.
cheers to those who have tried to help! even though it took a while for u all to be less sceptical of the situation!!!! (for which i cant blame u)
Another one of these "the admin left without telling us the password" threads.
On the off chance this is true, have your cheap upper management spring for some consultant to come in and recover what is needed. He can show you how and you can tell us then.
Id love to hear/see how "all the admin settings and passwords" were removed via dos...
Especially by you. "senior staff" wants the "network reset" huh? then "senior staff" should hire someone competent.
please feel free to send along the solution to how to rip out NTFS permissions (assuming that it was in place) or the admin password via a dos prompt, as I would really REALLY like to see that.
Avenger
Why don`t u reinstall everything without hiding everything?
Quote:
...uhmmm Huh??! :confused:
not sure where that came from or what it meant... ??
Try some of this stuff (it worked for me when I was in a similar situation).
(I know I just cut and pasted it but I tried to attach it in a .txt file but it wouldn't upload for some reason).
(As far as I know I picked this info up at this site but I don't remember in what thread or who originally posted it (tell me and I'll gladly credit you)).
Bypassing local restrictions
First of all, what are local restrictions? Whenever we refer to the word 'local' what it actually means is YOUR computer, i.e. the one you are sitting at. This is of course, the opposite to 'Remote' which would refer to a computer somewhere else (for example, a computer you connect to over the Internet would be reffered to as a 'Remote Computer'). Restrictions are what system admins and those strange technicians with beards put on your local computers to stop you from access certain things. Typical local restrictions include:
Blocking access to the Windows control panel, and any of the tools contained within.
Blocking access to MS Dos
Blocking access to the registry
Blocking access to items on the start menu
Blocking access to particular directories or files (typically c:\windows, c:\windows\system)
Blocking particular web sites
Stopping you performing simple actions (such as creating shortcuts, and renaming files)
Block access to the BIOS (main setup of the computer, Basic Input Output System
Why would they want to do this? Well, just maybe, they are expecting hackers like you! We all know that we wouldn't use our knowledge to cause damage to the system (right?) - but there are many people who would. Now, for some reason, all of the networks I have access to are set up really really well (by technicians with beards)...but does this mean they are un-hackable? Of course not. Literally ever time they change something about the system, whether it be adding a new program or patching a security hole, they always open up a new hole somewhere else - its true. Remember, no system can ever be 100% secure. Now, lets talk about some ways to bypass all of these restrictions and regain our freedom.
*Note* Some of these techniques are very dependant on how your system is setup, and some of them simple won't work for you. Please don't send me emails saying 'It doesn't work! its rubbish!"..because I guarentee you it will work for a lot of people.
Most of the restrictions we mentioned above are set up using a program called Poledit (short for Policy Editor). This program is included on the windows 9x and NT CD's - but is not installed by windows. You will need to have a look on your windows CD for 'poledit' in order to install it. Poledit allows you to create system policies which will block off certain areas of windows.
How does it work? Basically, all it does is add information to the registry. Then, windows can look in the registry to see what you are allowed to access, and what your not. hmm, not particularly secure is it? So, in order to bypass the local restrictions, what we actually need to do is edit the registry. Now, if your bearded technician actually understands how the policies work - they will have set up the policies so that you don't have access to the registry! Game over...or not. All it does is block the use of regedit.exe - so what we need to do is find a way of editing the registry without using regedit. Well, some of you clever people will use your programming languages to do it...but notepad is as good as any!
You can write registry files in notepad! all you need to do is save them as .reg and then run them. So, the first thing we would do is re-enable the use of regedit.exe to make getting rid of the policies a little more simple. In notepad, type in:
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr
entVersion\Policies\System]
"DisableRegistryTools"=dword:00000000
*NOTE* Please leave a blank line after the last line or the code won't work! I don't know why this is, but just trust me!
Now save it as "Registry.reg" and double click on it. If you recieve a message about adding data to the registry, just click ok. Now try running regedit (either from the c:\windows directory or from a floppy disk if the admins have removed it) again - it should now let you in!
Now you can go to the registry key:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr
entVersion\Policies\]
This is where the system policies are stored. Editing the items here should regain you access to the features of windows. Lets look at a few more examples:
Another one that the bearded technicians love to disable is the display settings. The display setting are usually accessible by right clicking on the desktop and choosing 'properties'. The reason they usually disable this is because people like to mess around with the screen savers and put hacker backgrounds on the computers. So, going into notepad and writing the following:
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr
entVersion\Policies\System]
"NoDispCPL"=dword:00000000
"NoDispBackgroundPage"=dword:00000000
"NoDispScrsavPage"=dword:00000000
"NoDispAppearancePage"=dword:00000000
"NoDispSettingsPage"=dword:00000000
and saving + running that, will regain you access to it.
*NOTE* If you already regained access to regedit, you could just go to the registry key mentioned above and delete the records above.. This would provide the same effect.
Here is the registry code to remove the other most common policy restrictions:
Access to the DOS prompt:
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr
entVersion\Policies\WinOldApp]
"Disabled"=dword:00000000
Re-enable the network properties in the control panel:
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr
entVersion\Policies\Network]
"NoNetSetup"=dword:00000000
Access to the password properties in the control panel:
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr
entVersion\Policies\System]
"NoSecCPL"=dword:00000000
Put 'Run', 'Find', and the 'Settings' items back on the start menu:
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr
entVersion\Policies\Explorer]
"NoRun"=dword:00000000
"NoFind"=dword:00000000
"NoSetFolders"=dword:00000000
Stops you not being able to see drives in 'My Computer':
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr
entVersion\Policies\Explorer]
"NoDrives"=dword:00000000
Being able to view the Device Manager tab in the system properties:
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr
entVersion\Policies\System]
"NoDevMgrPage"=dword:00000000
"NoConfigPage"=dword:00000000
There are many more items that the policies can block - so I suggest you play with the poledit program and see exactly what you can do.
I have just shown you how unsecure policies are - yet admins still use them. However, the other option is 3rd party programs. These are programs written by other companies that are supposed to stop you doing things. Lets look at how these might work. Well, firstly - a program can't control what your doing unless its running, right? So, the first thing to look at is whether you can close the program down and therefore end the restrictions. I would first of all look at using ctrl-alt-delete and seeing what is running...if you can see something which looks suspicious - kill it. However, some programs use stealth to stop themselves being listed in ctrl-alt-delete - so try using the program that comes with windows 98 called 'System Manager'. It has a feature that shows you what is running on your system, and often lists items which don't appear in ctrl-alt-delete. The next option is to get a copy of the program yourself! Use it at home and learn how it works...see if you can spot anything that could be a potential exploit and also check out how it uses the registry. If all fails, take the drastic approach and get to the add/remove programs page and try and remove it.
Here's are some other little tricks:
If you are restricted from creating shortcuts on the desktop, you can use the windows scripting host built into later versions windows 95 and all versions of 98. The windows scripting host is kind of like a replacement for the outdated batch files (.bat files) which use the msdos language. They use either Visual basic or Java and allow you to perform many useful windows functions - and you can write your little programs in notepad! So, if you are restricted from creating a shortcut on the desktop, try this:
Open Notepad
Type in the following (but fill in the bits in red with the relevant information!!):
Dim WSHShell, MyShortcut, MyDesktop, DesktopPath, FileSys
set FileSys = CreateObject ("scripting.FileSystemObject")
Set WSHShell = WScript.CreateObject("WScript.Shell")
DesktopPath = WSHShell.SpecialFolders("Desktop")
Set MyShortcut = WSHShell.CreateShortcut(DesktopPath & "\mylink.lnk")
MyShortcut.TargetPath = "the full path to the target file"
MyShortcut.WorkingDirectory = "the working directory for the file, i.e. the path to the folder it is in"
MyShortcut.WindowStyle = 4
MyShortcut.IconLocation = "the full path to the target file"
MyShortcut.Save
MsgBox "Done", vbinformation, "Done"
Save this file as a .vbs file. e.g. choose 'save as' from the file menu and then type the name as 'mylink.vbs'.
Once the file is saved, double click on it. A message box should appear saying 'Done' and a shortcut should now be on your desktop.
Here is the example code to create a shortcut to telnet:
Dim WSHShell, MyShortcut, MyDesktop, DesktopPath, FileSys
set FileSys = CreateObject ("scripting.FileSystemObject")
Set WSHShell = WScript.CreateObject("WScript.Shell")
DesktopPath = WSHShell.SpecialFolders("Desktop")
Set MyShortcut = WSHShell.CreateShortcut(DesktopPath & "\Telnet.lnk")
MyShortcut.TargetPath = "c:\windows\telnet.exe"
MyShortcut.WorkingDirectory = "c:\windows\"
MyShortcut.WindowStyle = 4
MyShortcut.IconLocation = "c:\windows\telnet.exe"
MyShortcut.Save
MsgBox "Done", vbinformation, "Done"
If you are unable to access the main motherboard setup or BIOS, there are a couple of ways of getting through the password. The first is to try some backdoor passwords - BIOS manufacturers sometimes put backdoor passes in, here are some for various BIOS's:
j262
condo
djonet
lkwpeter
biostar
biosstar
AWARD_SW
HLT
SER
SKY_FOX
BIOSTAR
ALFAROME
lkwpeter
j256
AWARD?SW
LKWPETER
Syxz
aLLy
589589
589721
awkward
AW
AMI
AMIDECODE
PASS
PASSWORD
PASSOFF
phoenix
AMI_SW
A.M.I.
AMI!SW
AMI?SW
HEWITT RAND
AWARD SW
AWARD_SW
AWARD_PS
AWARD_PW
AWARD_HW
AWARD
Syxz
j262
589589
589721
lkwpeter
djonet
CONDO
J64
BIOS
SETUP
CMOS
BIOSTAR
BIOSSTAR
If none of the backdoor passes work, try using a BIOS password cracker - the file "cmoscrack.exe'' is included in this volume. This is just one of the crackers that I found.
As I say, local restrictions can be very dependant on how the system is set up - but I think most of you will find that the system policies trick works! It is also worth mentioning that you may need to remove the policies each time you log on...this is because the technician might have set the network up so that whenever you log on the policies are downloaded to your machine. This can be a pain, but just write yourself a large .reg file which you can run when you log on and remove all the restrictions at once!
Please note!! Regedit is like performing a surgury, there is no ooops, undo, etc.
BACK UP THE REGISTRY FIRST!!
regedit in a newbies hands is the same as a kid with matches in a dry dry forest.....
nice!
unfortunately a bit too late, as i mentioned before the problem has been solved!
and in response to avenger_jcc (aka the thick one), ask anyone who can work a computer properly! all u need to do is build a DOS based program to locate and remove the relative PIF, config and cookies!
again thanx to those who have tryed to be helpful
i suggest u keep shut about ur inept ability to use a computer, otherwise u will be hounded on by a lot of people! ps. start with the complete idiots guide to windows -not brilliant but we all have to start somewhere!!!!! lol :)
YAY!
Chewitt found out how to hack every local computer using the most basic thing on earth, DOS! great no more SAM database, no more permissions, no more restrictions ever again! Now that we have found this out we can all go back to Windows 3.0 or DOS 6.22 and all be sys admins....:-(
Chewitt1001 your my hero!
Love,
Steve Jobs
Go ahead and try to get a SAM file from a NTFS partition in dos without NTFSDOS you F**king moron.
Sorry about the language folks, but my intelligence has been insulted.
But, thats enough on it, Im not going to comment any further as he has demonstrated his "knowledge" ...
Well that is what I wanted to say however not with such a harsh tone. That is what suprised me is that no one mentioned the famous linux disk that allows you to reset the admin password...then again seeing that he thinks that...
all u need to do is build a DOS based program to locate and remove the relative PIF, config and cookies!
however wasn't it him that said they couldn't even access DOS...now that is right he did it with a floppy disk that he was able to read after he enabled the FDD from the bios' protected password...now maybe it is me but last I knew cookies didn't play a part in protecting a system...and config? What did he do delete the config.sys file?
Chewitt1001 please do everyone who know's something a favor and hire a sys admin that doesn't need a "Complete Idiots Guide to Computers" and then locate yourself near a shredder and just shred trash.
I am in the military and get paid $546.00 every two weeks (aprox) to fix and setup computers and there are people out there who make 4 times as much and do much less and know much less like Chewitt1001 that make me sick. Everyone who this doesn't apply too please excuse my Biotching however I am tired of this I feel like avenger_jcc...just insulted
As for me I have trouble with how his intent from his first post changed. Then there is the entire DOS thing nothing about a CMD shell LOL..I hade to re-think oh yeah then again most people I know and talk to call it CMD. Cybermagellan know what you mean about gov work after 10 years I left it, and really anyone that is admin have peers we can telephone with such things. Insulting yes like a few here, sounds to me like this person has the title and he screwed the real admin fired him and his ass is in a sling how often you seen that one LOL
Yeah I know what your talking about..."help I messed and I need other people to fix my screw up" yeah it is a syndrome unfortunatly. Fortunate enough for few because it teaches them what humility is and where to look for things...next question just as you had stated Palemoon what was the intent from the beginning? I can only think of a few...
1. He fired the real admin and now has to fix his screw up
2. Really did replace the admin and got screwed in the process
3. Local user who wants to screw the admin
Well guess we'll never know cause he probably caught so much shiat he'll never show back up
It annoys me greatly that he was helped along, even by me, on how to get into the BIOS. then turns around and calls me thick for asking him for the answer to how he did something he claimed to have done, when anyone who knows NT at ALL knows cant be done. (what a sentance that was) It just irked me terribly to be called thick, after I helped this "gentleman."
so again, sorry for the harsh post....
you think someone called avenger dont have a temper??! :)
LOL I fell the same way you do avenger...just wish that he wouldn't "fake the funk" on that and they insult you on that however that shows a point that I try to make to people....
Computer wise (hackers) often are more intelectual beings than non-hackers so why call us criminals?
I had this class on the Cisco PIX firewall and on Raptor firewall and me and my instructor got into a 2 day argument on why he thought hackers were sick minded deviots and why I didn't, then when I pointed out to him how the Raptor firewall could be disabled on a network he was quiet all of a sudden...scary these are the people that are protecting our information.....!
congratulations most of u have failed!!!!!!!!!!!
this was a test of stupidity and compitance. i would have thought most of u may have been more sensible as to NOT log on with ur work computers and potentially leading to hackers infaltrating ur systems!!
not very clever!
we wish to appologise to those of u who took this seriously and spent time on this. and to those of u who found holes in these interesting stories -shame on u for not getting out while it was safe!
goodbye
CheWitt corporation (check various newsgroups we're there!)
-and to those of u who find out don't bother wasting ur time finding us. most of these messages have been sent via somewhere in UK essex or something and back to australia, r signal is virtually untracable so don't bother wasting ur time!
useless american muppets!
hmmm, useless american puppets, huh?
Well at least we know what grammar and spelling are.
go someplace else, child.
this is not the place for you or your games.
Have a nice day at the playground... :)
Avenger