📑 Lab: Regaining access to a local Windows account

Project objective: To demonstrate the procedure for regaining administrative privileges in a Windows environment by exploiting a physical security vulnerability (Physical Access Exploit).

🎯 Project Goal

• Demonstrate password recovery for local Windows accounts.

🛠 Skills & Tools

• System Internals: Manipulation of pre-logon services and exploitation of system privileges
• Windows RE (Recovery Environment): Use of advanced repair tools.
• CLI Mastery: Working in the Command Prompt with SYSTEM privileges.
• Security Auditing: Identifying vulnerabilities arising from physical access to hardware.

📋 Steps

1. Enter Recovery Mode On the login screen, hold down the Shift key while clicking the Power button, then select Restart .

   

2. Alternative Method (Hard Reset) If Shift + Restart doesn't work, power your PC off and on 2-3 times as soon as the Windows logo appears. This will force it into Automatic Repair mode .

   

3. Windows Recovery Environment (WinRE) After completing step 1 or 2, the Windows Recovery Environment menu should appear.

   

4. Troubleshoot Next, select Troubleshoot

   

5. Advanced option Next, select Advanced Option

   

6. Command Prompt Next, select Command Prompt. In the terminal, you will need to enter a few commands to change files places.

   

7. Copy Utilman.exe Next, in the Command Prompt, you will need to enter the following commands:

    copy c:\windows\system32\utilman.exe c:\

   You will be asked whether to overwrite c:\Utilman.exe (Yes/No/All). When prompted, type y and press Enter .

   

8. Copy cmd.exe Next you will need enter the following comands:

    copy c:\windows\system32\cmd.exe c:\windows\system32\utilman.exe

   Once again, you will be prompted to overwrite c:\Utilman.exe (Yes/No/All). Simply type y to confirm.

   

9. Exit from CMD and restart computer Once you see the message 1 file(s) copied, congratulations! You have successfully completed the first part of the account recovery process.

   

10. Login Menu Next step: After restarting your computer, click the Accessibility button on the login screen. This will open the Command Prompt. From here, there are two popular ways to reset your password.

    

    
    

• The first option ideal for users whose accounts are not linked to a Microsoft account is to use the User Accounts settings. Type the following command into CMD:

 control userpasswords2

A list will appear showing all the users who have accounts on this computer.

Select the account you wish to change the password for and click Reset Password . Then, you can type your new password and click OK .

• The second option is to type a command directly into the Command Prompt.

 net user [user name] [new password]

⚠️ Security Notes

• The project highlights the critical importance of BitLocker encryption. Without it, physical access to the device allows full control to be gained over local accounts.

🎓 What I Learned

Working on this project gave me a practical understanding of key aspects of Windows system security:

• Offline File Manipulation: Understanding that the file system (NTFS) is fully editable from an external environment (WinRE) if it is not protected by encryption.

• Physical Access Security: Understanding the critical importance of physical security – access to hardware allows virtually any software-based lock at the local account level to be bypassed.

• Importance of Mitigation: Understanding the role of BitLocker as a key layer of defence; without data encryption, local account passwords are merely an illusory barrier.