JCA – Tech Blog

I administer hundreds of Windows computers in a very big lab at one of my work place and every user has their own login and password. Whenever a student encounter any problems in their computer, they are required to fill up a form to report the problem to me. When I have time to take a look at the computer but the student is not there, I am forced to reset the user account’s password so that I can login to check and fix the problem.

There are a few ways to log in to a Windows account if you don’t know the administrator password. Most of them are boot CDs where you can boot up the computer and then change the password without knowing the current valid password. Many years ago I’ve written about DreamPack PL where you can hack into a Windows XP computer without changing the password. I don’t really like to use this method because I had to replace sfcfiles.dll file in recovery console and then restore it back when I am done. It only works on XP and most antivirus flag this tool as a hack tool.

All this while I’ve been using Windows Key Enterprise to reset user account password and this is a problem to the student because they have to set a password again the next time they login. Today I am happy to find a tool which solves the problem. I now no longer need to reset the user account password and I can still login as the computer’s administrator. It works on Windows 2003, XP, Vista, 2008, and even Windows 7!

Kon-Boot is an prototype piece of software which allows to change contents of a Windows and Linux kernel on the fly while booting. In the current compilation state it allows to log into a linux system as ‘root’ user without typing the correct password or to elevate privileges from current user to root. For Windows systems it allows to enter any password protected profile without any knowledge of the password.

I’ll show you how easy it is to use Kon-Boot to login to any linux or windows computer without using the correct password.

1. Download Kon-Boot ISO and burn to CD. Refer to this article if you don’t know how to burn ISO file to CD.

2. Insert the Kon-Boot CD that you just burned and boot the computer with the CD. You will need to configure the BIOS to start up the computer with CD.

3. A kryptos login splash screen appears. You’ll need to hit enter to continue or else the screen will stay there.

4. Kon-Boot will tell you that it is ready to hax0R in. It will check SMAP BIOS entries, detect dummy BIOS, and fix SMAP entries.

5. Windows will now load as normal.

6. When the Log On to Windows box appear, simply type anything in the password box and you’re in! You can even leave the password field blank.

Do take note that Kon-Boot does NOT modify any of your files. If you boot up the computer the next time without Kon-Boot CD and try to login using any password, you’ll get the error “The system could not log you on. Make sure your User name and domain are correct, then type your password again. Letters in passwords must be typed using the correct case.”

I’ve scanned Kon-Boot ISO image file in VirusTotal and so far only Kaspersky, F-Secure and Microsoft detected it as a threat. For testing purposes, I’ve installed and updated Kaspersky Anti-Virus 2009 on my desktop computer, then used Kon-Boot to login to a password protected account. I am still able to login and Kaspersky did not find any suspicious activity.

Kon-Boot is free, small and very useful! In my opinion, it is so far the BEST tool to login to Windows without password today. As good as it is, I am sure some of you will use Kon-Boot to illegally break in Windows. Think carefully of what you’re going to do because you will lose friends, job, trust and etc if you’re caught breaking in to Windows without permission.