Shulou(Shulou.com)06/01 Report--

This article mainly shows you "how to bypass windows 2008 R2 authentication". The content is simple and clear. I hope it can help you solve your doubts. Let me lead you to study and learn how to bypass windows 2008 R2 authentication.

Techniques for bypassing authentication of Windows Server 2008 R2 servers and resetting system administrator passwords. This technology is suitable for almost all Windows systems, but must have one of the following two prerequisites. That is, we can have physical access to the machine running the Windows server, or we can access the hypervisor management interface when Windows Server 2008 R2 is running virtualization. In fact, this is not a novel "hacker" technology, and most of the time it will be used by system administrators as a means to forget passwords. But in some cases this method can bring you unexpected surprises. For example, when we control the management panel of hypervisor software during penetration testing, this access will allow you to control the virtual machine like physical access, including using boot disks and modifying system files. Alternatively, you can apply this technique when making some kind of physical access to the host.

A few months ago, I conducted a penetration test of the Windows domain environment running on the VMware virtual machine hypervisor. The environment mainly consists of one domain controller and three servers running Windows Server 2008 R2. In addition, I have encountered some Linux-based networking and backup devices. Because in this network environment, the infiltration machine does not encounter much difficulty. So in the early stages of penetration testing, I accessed the VMware vSphere administration panel as an administrator. This access level allows me to use bootstrap CD to reset the administrator password, and eventually I successfully gain administrator privileges and log in to Windows Server as an administrator. I'll explain in more detail how I do this and how to secure my Windows installation by applying this technology.

Reset the Windows Server 2008 R2 administrator password

In this tutorial, I used the machine that booted the CD installation of Windows Server 2008 R2 Enterprise and used Hiren to launch CD (HBCD). You can also use other ways to start CD, including the Windows installation disk. After booting the system from booting CD, we navigated to the following directory containing the drives installed on Windows Server 2008 R2:

/ Windows/System32

In this directory, we can find an executable file named "Utilman.exe". Utilman.exe is a system process that is a Windows accessibility manager program that is used to configure accessibility options such as a magnifying glass and an on-screen keyboard. What is special about Utilman.exe is that we can execute it before logging in to the system by clicking the accessibility button in the lower left corner of the Windows login menu:

Now that we can access the / Windows/System32 directory, we use the cmd.exe program to replace the Utilman.exe program. When the replacement is successful, we can start the cmd.exe with system permissions instead of Utilman.exe by clicking the accessibility button. In this way, we can easily reset the administrator password and use the administrator account to log in to the system.

First, we rename the Utilman.exe program to Utilman.exe.old, as follows:

Next, rename cmd.exe to Utilman.exe, as follows:

Now that we have replaced Utilman.exe with cmd.exe, all we have to do is restart the machine to the Windows interface and click the accessibility button on the login screen. As shown below, we directly opened a command-line input window:

Then let's change the administrator's password, as follows:

*, we use the new administrator password to log in to Windows:

The above is all the contents of the article "how to bypass windows 2008 R2 authentication". Thank you for reading! I believe we all have a certain understanding, hope to share the content to help you, if you want to learn more knowledge, welcome to follow the industry information channel!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.