Misuse Utilman.exe on Windows systems and obtain NT Authority rights

Most windows systems (Vista, Windows 7, Window 8 etc.) allow you to access the Utilman.exe “Ease of Access” application on the login page. As the end-user has not yet logged in, Windows will start this application using NT Authority rights.

So if you are able to boot a Windows machine with for example a Kali image and no drive encryption is applied. You can easily replace the Utilman.exe with cmd.exe or your own payload and have it run with  NT Authority rights by clicking on the Ease of Access icon on the logon page.

Want to know how? Just follow the steps below:

1. Boot you windows machine with for example Kali or any other Live CD.

2. Browse to the Windows System32 folder of you Windows machine and locate the Utilman.exe

Utilman-1

3. Rename the orginal Utilman.exe to for example Utilman-old.exe

Utilman-2

4. Browse to the Windows System32 folder of you Windows machine and locate CMD.exe

Utilman-3

5. Make a copy of CMD.exe and rename it to Utilman.exe

Utilman-4

6. Boot you Windows machine as normal.

7. Click on the Ease of Access button and check put the Command Prompt.

Utilman-5

Geplaatst op december 28, 2013, in Hacking, Windows. Markeer de permalink als favoriet. Een reactie plaatsen.

Geef een reactie

Vul je gegevens in of klik op een icoon om in te loggen.

WordPress.com logo

Je reageert onder je WordPress.com account. Log uit / Bijwerken )

Twitter-afbeelding

Je reageert onder je Twitter account. Log uit / Bijwerken )

Facebook foto

Je reageert onder je Facebook account. Log uit / Bijwerken )

Google+ photo

Je reageert onder je Google+ account. Log uit / Bijwerken )

Verbinden met %s

%d bloggers liken dit: