Utilman Login Bypass
Okay this technique is really old, and not technically an attack. It originated from an old Microsoft TechNet Active Directory support forum. This technique, called the “Utilman Bypass”, was one technique recommended to log into a Windows server in case you forgot the password. The Utilman bypass works by manipulating a helpful windows function that is available at the login prompt. It allows a system level command session to open without using credentials. I have friends who support large corporate networks that tell me that they still use this technique for legitimate purposes. For example, when old corporate stand-alone systems need to be backed up and re-purposed and no one can remember the passwords, they will use this technique.
For this exercise, we will boot from the disk and change the Windows “Utilman” program, so when the “Windows” + “u” keys are pressed, a command prompt will open instead of...