All right, in the previous two lessons, we saw how to, first of all, pull off the exploit of swapping
our command file for the set etsi or the Sticky Keys executable file and our Windows System 32 directory
that gave us the ability to compromise the computer by just pressing the shift key five times.
I'll demonstrate that one more time here.
There we go.
We've got a beautiful Windows command prompt running as the system level user entity authority.
That's a windows into authority, the super administrator route on this Windows seven computer that
I own several years ago.
And once we could run that command prompt, we could reset my username with just net user beeping,
beeping, reset my username to beeping.
So now I don't need to remember my username from all those years ago, but if I log in is beeping,
I'm hoping that my important work files and some of my family vacation photos are still on this old
computer from years ago.
And look at that, my important work files and family vacation photos.
OK, maybe I staged those files for you a little bit.
But the point is, anything that was on this computer from several years ago that I just could not access
anymore because I forgot my password, I can now get to and I can see everything that was not encrypted
on this computer.
The only way really to protect against this is to disable and bypass the ability to boot from a CD or
DVD.
The other way to protect your files is to encrypt them.
If I encrypt something in here, like my family vacation photos by right clicking coming to advanced
and then telling it to encrypt the contents to secure the data, well then everything is going to be
encrypted using my username and this password, the big pain that I'm using right now.
So if someone comes in and resets my password later, they won't be able to see any of the files that
I encrypted using that previous password.
They will have to know my username and real password before they can do this.
So any and files that I've encrypted will still be safe.
That's one of the reasons we use encryption on computers these days, is because if someone does get
our laptop, if we walk away from it in a coffee shop or if we leave it in an airport, or if someone
just accesses our desktop and runs this hack, any files that are encrypted will not be visible to those
new users who use even the administrative level account.
Well, let's see that administrative level account, because I think I had some more files on this computer.
Maybe I saved them as administrator and I didn't take time to reset that administrative password.
Let's switch users by logging off and coming back in as Iron Man.
And remember, Iron Man is a member of the administrative group.
So if I use this password, Jarvis.
It's going to do a little bit of setup because this is a brand new user who's logging in for the first
time.
It just so happens that we created this user with the username Ironmen and Password Jarvis.
And because this is a brand new user, if I go into Iron Mans documents, they're completely empty.
However, Iron Man is an administrator on this computer, so Iron Man can not only look inside Iron
Man's folders.
But it is an administrator, he can continue through to be Paines folders.
They are my family vacation photos, my important work files, now, if I go back up, I can look at
administrator.
And all I have to do is click through for permission to continue, and now I can look for those other
files that I think I had on this old computer from forever ago.
Let's go to the desktop.
There's nothing in documents.
Let's check here.
Look at that.
There are are all my old files from when I was working on my certified ethical hacker certification.
Wow.
Very nice.
So you can see as this new user, Iron Man, that I just created.
I'm not only able to see my old files, I'm able to see everybody's files on this computer, this old
laptop, as long as they didn't use encryption.
So if you want to protect against this hack, use encryption on the hard drive.
But if you tie it to your usernames, if you're doing this for a large enterprise, it's a great way
to protect that data because someone is going to lose an old laptop.
And by encrypting that information, you'll make sure that even though someone can use that laptop because
they can create a new user, just like we did using a simple Windows 10 boot disk or even a bootable
USB drive, they'll be able to create new users.
They just won't be able to access those old files if they're encrypted.
And the second way you can protect against these types of attacks is to make sure that you turn off
that ability to change the boot order.
If you're a system administrator for a company, you may not want people to be able to boot from a CD
disk or boot from USB.
You can go into bios on your company's computers and you can turn off or disable or password protect
that ability to change the boot order.
So we've seen a vulnerability that sticky keys.
We've seen an exploit the ability to copy the command prompt file over.
If I hit shift key here five times, I'm going to see a new command prompt window pop up open from anywhere
I may be.
Then third, we saw the compromise where I was able to add a new user and then I can log in.
Is that user.
I can make that user an administrator using just a couple of simple commands at the command prompt.
And then I can see all the files on the computer from all the users on this machine.
Well, this is a great first exercise in practical hands on real world ethical hacking, because you
may have an old computer or someone may give you an old computer someday and you may want to be able
to set up a brand new user without installing a whole new operating system or wiping the hard drive.
You may you may want to help your friends access some old files that they thought were gone forever
because they just couldn't remember their password from years ago.
And if you work in information security in a company, you can use this to bypass some user settings
and actually see what a user has installed on your computer.
We use some tools like this sometimes when we're doing forensics or gathering information on what someone's
been doing on our network.
However, use this, make sure you use it with full permission from the owner of the system or the owner
of the network or use it on computers that you own and control.
I hope you've enjoyed this first Hands-On exercise and ethical hacking.
We'll see you in the next lesson.