Chapter 9

Utilman & Keylogging - Other Password Recovery Options

We have looked at several ways to grab passwords and crack them. In this bonus chapter I just wanted to cover some other possible ways that you could recover passwords from a system. This chapter isn’t really about password cracking, just some interesting ways that I have used to pull passwords or bypassed passwords in the past. If it is too technical, just read along or jump ahead to the next one, some of the techniques are very interesting. We will see how you could grab passwords or access systems during physical attacks, an attack where the security tester has physical access to a system. Then look at a couple more “untraditional” ways to recover passwords from a system. For ages the security field mantra has been, if you have physical access, you have total access. And in many cases, this is true. I performed onsite server and workstation support throughout upstate New York and Northern Pennsylvania...

Utilman Login Bypass

Okay this technique is really old, and not technically an attack. It originated from an old Microsoft TechNet Active Directory support forum.  This technique, called the “Utilman Bypass”, was one technique recommended to log into a Windows server in case you forgot the password. The Utilman bypass works by manipulating a helpful windows function that is available at the login prompt. It allows a system level command session to open without using credentials. I have friends who support large corporate networks that tell me that they still use this technique for legitimate purposes. For example, when old corporate stand-alone systems need to be backed up and re-purposed and no one can remember the passwords, they will use this technique.

For this exercise, we will boot from the disk and change the Windows “Utilman” program, so when the “Windows” + “u” keys are pressed, a command prompt will open instead of...

Recovering Passwords from a Locked Workstation

Moving forward with this concept, how cool would it be for a penetration tester (if they had physical access to a system) to be able to grab the passwords off of a Windows system that was sitting at a locked login prompt? And what if you could get these passwords in plain text? Well, if the circumstances are right, you could! A while back, I was wondering if it would be possible to get passwords off of a locked Desktop? You know, a user is using the system and dutifully locks his workstation before leaving for lunch. If you have physical access to the system, this could be done.

First you need to be able to enable the system level command prompt from the login screen. Discussed above, the “Utilman Login Bypass” trick enables a pop-up system level prompt by just pressing the “Windows” and “u” key on the keyboard. Now all we need is a USB drive with Mimikatz installed. The Mimikatz Window’s executable...

Keyscan, Lockout Keylogger, and Step Recorder

When a penetration tester has remote access to a user’s machine, sometimes they find that it is beneficial to run a remote keyboard scanner. This tool is a program that runs silently in the background recording all the keys that a user presses. It is a way that you could possibly gain additional passwords. In this section we will look at two different ways to do this in Metasploit. Then we will look at turning Microsoft’s Problem Step Recorder into a remote recording “spy” tool.

Keylogging with Metasploit

We will start this chapter by exploring Metasploit’s built in key scanner. Metasploit has a helpful set of Meterpreter commands for capturing keys pressed on a target machine.

➢      keyscan_dump

➢      keyscan_start

➢      keyscan_stop

These commands are available through Meterpreter, so we will start with a system that we have already run an exploit on and were successful in creating a remote session. We will use our Windows 11 system as a target. We will need System level access, so after we get the remote session, we will have to run the “getsystem” command.

If we type “help” at the Meterpreter prompt we will be given a list of commands that we can run. For this section we are concerned with just the “keyscan” commands:

So, let’s go ahead and see what it looks like when we start a remote keylogger. Then we will view the captured key...