Skip to main content

Lab 2.1: Windows Password Bypass

Learning Objectives​

By the end of this lab, you will be able to:

  • Reset a Windows password without knowing it
  • Gain administrator access on a Windows system
  • Understand the limitations of Windows security without encryption
  • Evaluate the importance of physical security
  • Apply appropriate protective measures

Estimated Duration​

30 minutes

Prerequisites​

  • A functional Windows 10/11 VM (created in windows_vm.mdx)
  • VirtualBox or VMware installed
  • User account with password on the VM

Professional Context​

In a professional context, it often happens that:

  • An employee forgets their password
  • A former administrator left without providing access
  • A system needs to be recovered after an incident

This lab teaches you legitimate system access recovery techniques. These same techniques can be used maliciously, hence the importance of understanding necessary protections.

Legitimate use cases:

  • Technical support and helpdesk
  • System recovery
  • Authorized forensic investigation
  • Authorized security testing

IMPORTANT - READ BEFORE STARTING:

The techniques in this lab allow bypassing Windows authentication. They are taught in a system security learning context.

AUTHORIZED:

  • On your own test VM
  • On systems you own
  • As part of an investigation mandate with written authorization
  • For legitimate recovery of lost access

PROHIBITED AND ILLEGAL:

  • On someone else's computer without permission
  • On company systems without explicit mandate
  • To access confidential data without rights
  • With the intent to harm or steal information

Consequences: Unauthorized access = Crime (Canadian Criminal Code, sections 342.1 and 430)

By completing this lab, you commit to using this knowledge ethically and legally.

Preparing the Test VM​

Step 0.1: Create a Security Snapshot​

IMPORTANT: Before starting, create a snapshot of your VM!

In VirtualBox:

  1. Select your Windows VM
  2. Click Machine → Take Snapshot (or camera icon)
  3. Name: "BEFORE_LAB_BYPASS"
  4. Click OK

Why? If something goes wrong, you can revert to this state in 10 seconds.

Step 0.2: Create a Test Account​

On your Windows VM:

  1. Start normally
  2. Open Settings → Accounts → Family & other users
  3. Click Add someone else to this PC
  4. Without a Microsoft account → Create a local account
    • Name: TestUser
    • Password: Password123!
  5. Note this password somewhere

Now we will "forget" this password and bypass it!

Method 1: Utilman.exe Replacement (Classic)​

Step 1.1: Understand Utilman.exe​

Utilman.exe is the Windows "Utility Manager" that runs:

  • On the login screen (before login!)
  • With SYSTEM privileges (more powerful than admin!)
  • Accessible via the accessibility icon (bottom-right corner)

The trick: Replace utilman.exe with cmd.exe

  • Result: Clicking on accessibility = cmd in SYSTEM!
  • With cmd in SYSTEM, you can do anything!

Step 1.2: Access System Files​

On your VM:

  1. Shut down the Windows VM (complete shutdown)

  2. Start in Recovery Mode:

    • Start the VM
    • As soon as the Windows logo appears, force shutdown the VM (Ctrl+C or power off button)
    • Repeat 2-3 times
    • Windows should display "Preparing Automatic Repair"
    • Click Advanced options

    OR (clean method):

    • Start the VM
    • At login, click Power then hold Shift and click Restart
    • Choose Troubleshoot → Advanced options → Command Prompt

  3. You are now in a recovery mode command prompt!

Step 1.3: Identify the Correct Drive​

In the recovery command prompt:

Execute:

diskpart
list volume
exit

Observe:

  • The C: drive in recovery mode is NOT necessarily your Windows!
  • Look for the volume with "NTFS" and size matching your Windows disk
  • Note the drive (often D: or E: in recovery mode)

To test which drive contains Windows:

dir D:\Windows\System32

If you see lots of files, it's the correct drive!

Questions:

  1. What is the drive of your Windows partition in recovery mode?
  2. Why does the drive change compared to normal mode?

Step 1.4: Backup and Replace Utilman.exe​

Assuming D: is your Windows drive.

Execute:

copy D:\Windows\System32\utilman.exe D:\Windows\System32\utilman.exe.bak
copy D:\Windows\System32\cmd.exe D:\Windows\System32\utilman.exe

What you just did:

  1. Created a backup of utilman.exe (just in case)
  2. Replaced utilman.exe with cmd.exe

That's it! The "backdoor" is installed.

Step 1.5: Restart and Test​

  1. Close the command prompt
  2. Click Continue (normal restart)
  3. The VM restarts to the login screen

On the login screen:

  1. Click on the Ease of Access icon (bottom-right corner)
  2. MAGIC! A command prompt opens!
  3. This command prompt is as SYSTEM!

Verify:

whoami

Should display: nt authority\system

Questions: 3. Did you get a command prompt on the login screen? 4. What is your privilege level (result of whoami)?

Step 1.6: Reset the Password​

In this SYSTEM command prompt:

To see all users:

net user

To reset TestUser's password:

net user TestUser NewPassword123!

Alternative - Remove the password completely:

net user TestUser ""

Questions: 5. Did you succeed in changing the password? 6. How long did the entire operation take?

Step 1.7: Log in with the New Password​

  1. Close the command prompt
  2. Click on the TestUser account
  3. Enter the new password (or none if removed)
  4. You are logged in!

CONGRATULATIONS! You just bypassed Windows authentication!

Step 1.8: Clean Up (Optional)​

Once logged in, restore the original utilman.exe:

Open cmd as administrator:

copy C:\Windows\System32\utilman.exe.bak C:\Windows\System32\utilman.exe

(If you don't do this, the backdoor remains active!)

Method 2: Sticky Keys Backdoor (Alternative)​

This method is similar but uses sethc.exe (Sticky Keys).

Step 2.1: Principle​

Sticky Keys = Accessibility feature activated by pressing Shift 5 times

The trick: Replace sethc.exe with cmd.exe

  • Pressing Shift 5x = cmd in SYSTEM!
  • Works even on the login screen!

Step 2.2: Backdoor Installation​

In recovery mode (like method 1):

copy D:\Windows\System32\sethc.exe D:\Windows\System32\sethc.exe.bak
copy D:\Windows\System32\cmd.exe D:\Windows\System32\sethc.exe

Step 2.3: Activation​

On the login screen:

  1. Press Shift 5 times
  2. A command prompt opens!
  3. You are SYSTEM
  4. Reset the password as before

Questions: 7. Which method do you prefer (Utilman vs Sticky Keys)? 8. Why might an attacker prefer Sticky Keys?

Method 3: Safe Mode + Built-in Administrator​

This method exploits the hidden Windows Administrator account.

Step 3.1: Start in Safe Mode​

From the login screen:

  1. Click Power
  2. Hold Shift and click Restart
  3. Choose Troubleshoot → Advanced options → Startup Settings
  4. Click Restart
  5. Press 4 or F4 (Safe Mode)

Step 3.2: Built-in Administrator Account​

In Safe Mode:

  • Windows automatically enables the hidden "Administrator" account
  • This account often has NO password by default!
  • It has all rights

If the Administrator account appears:

  1. Click on it
  2. No password? Just press Enter
  3. You are logged in as admin!

Step 3.3: Modify Other Accounts​

Once logged in as Administrator:

Open cmd:

net user TestUser NewPassword

Or via graphical interface:

  1. Control Panel → User Accounts
  2. Manage another account
  3. Select TestUser → Change the password

Questions: 9. Did the Administrator account have a password? 10. Does this method seem simpler or more complex to you?

Part 4: Security Implications​

Step 4.1: Time Required for an Attacker​

Measure the time:

From the moment you have physical access to a locked machine until gaining full admin access:

Utilman Method: ___ minutes Sticky Keys Method: ___ minutes Safe Mode Method: ___ minutes

Average: Generally less than 5 minutes for someone who knows!

Questions: 11. Are you surprised by the speed? 12. What would happen if someone had physical access to your computer for 5 minutes?

Step 4.2: Real Attack Scenarios​

Scenario 1: Unlocked office

  • Employee goes for coffee (2 minutes)
  • Malicious colleague installs Sticky Keys backdoor
  • Employee returns, nothing seems changed
  • Later: Attacker presses Shift 5x, gets SYSTEM

Scenario 2: Stolen laptop

  • Laptop stolen without BitLocker
  • Thief boots in recovery mode
  • Access to ALL files in minutes

Scenario 3: Malicious "Technician"

  • Fake IT technician asks for your computer
  • Installs backdoor in 2 minutes
  • Returns the "repaired" computer
  • Permanent backdoor installed

Questions: 13. Which of these scenarios seems most likely to you? 14. How to protect against each?

Step 4.3: Why These Methods Work​

What you learned:

  1. Physical access = Game Over (without encryption)

    • If someone can touch your computer, they can compromise it

  2. Windows stores hashed passwords

    • But with SYSTEM access, you can change them without knowing them

  3. Recovery mode has too much power

    • Necessary for troubleshooting, but a security risk

  4. System files are modifiable

    • If the disk is not encrypted

Questions: 15. Why does Windows allow these recovery techniques? 16. How could Microsoft prevent these bypasses?

Part 5: Protective Measures​

Step 5.1: BitLocker - Ultimate Protection​

BitLocker encrypts the entire hard drive.

With BitLocker enabled:

  • Impossible to access files without the decryption key
  • Recovery mode cannot modify files
  • Bypass methods no longer work!

Check if BitLocker is enabled:

  1. File Explorer
  2. Right-click on C:
  3. If you see a closed padlock = BitLocker active

Enable BitLocker (Windows Pro only):

  1. Settings → Update & Security → Device encryption
  2. Turn on BitLocker
  3. Save the recovery key (IMPORTANT!)

Questions: 17. Is BitLocker enabled on your VM? 18. On your personal computer?

Step 5.2: BIOS/UEFI Password​

Firmware level protection:

  1. Restart the VM
  2. Press F2 or Del to enter BIOS
  3. Look for "Security" or "Password"
  4. Set:
    • Supervisor Password (BIOS admin password)
    • User Password (password at startup)

With BIOS password:

  • Impossible to boot in recovery mode without the password
  • Additional protection

CAUTION: Do not lose this password! Very difficult to recover!

Step 5.3: Secure Boot​

Secure Boot ensures only signed OS boot.

Protection against:

  • Bootkit
  • Boot-level rootkit
  • Unauthorized OS

Enable in BIOS:

  1. BIOS → Boot → Secure Boot
  2. Enabled

Limitation: May block some OS (older Linux versions)

Step 5.4: Physical Security Policy​

Organizational best practices:

  1. Automatic lock

    • Windows + L systematically
    • Lock after 1 minute of inactivity

  2. Never leave a computer unattended

    • Office, café, library

  3. Anti-theft cables

    • For laptops in the company

  4. Video surveillance

    • Areas with sensitive equipment

  5. Access badge

    • Limit physical access to servers

Questions: 19. Does your computer lock automatically? 20. After how long?

Part 6: Testing and Validation​

Step 6.1: Test with Simulated BitLocker​

On your VM:

  1. Restore original utilman.exe (if modified)
  2. Create a snapshot "BEFORE_BITLOCKER"
  3. Create a file "secret.txt" on TestUser's desktop
  4. Shut down the VM

Simulate encryption:

  • Imagine the disk is encrypted
  • In recovery mode, you couldn't access D:\Windows\System32
  • All methods fail!

Questions: 21. Without BitLocker, could you read secret.txt? How? 22. With BitLocker, is it possible?

Step 6.2: Backdoor Verification​

How to detect if a backdoor is installed?

Method 1 - Manual check:

dir C:\Windows\System32\utilman.exe
dir C:\Windows\System32\sethc.exe

Check size and date. If recently modified = suspicious!

Method 2 - Check with PowerShell:

Get-FileHash C:\Windows\System32\utilman.exe
Get-FileHash C:\Windows\System32\cmd.exe

If the hashes are identical = utilman.exe has been replaced!

Questions: 23. What would be an automated check to implement? 24. How to detect these modifications in a company?

Part 7: Practical Exercises​

Exercise 7.1: Helpdesk Scenario​

Situation: An employee forgot their Windows password. You are IT support.

Task:

  1. Document the complete recovery procedure
  2. Include security precautions
  3. Indicate the time required
  4. List checks to perform afterward

Deliverable: Written procedure (1 page)

Exercise 7.2: Security Audit​

Task: Create a PowerShell script that checks:

  • If utilman.exe has been modified
  • If sethc.exe has been modified
  • If BitLocker is enabled
  • If a BIOS password is configured (detectable via WMI)

Deliverable: Functional PowerShell script

Exercise 7.3: Time Comparison​

Experiment:

  1. Measure the time to bypass the password (method 1)
  2. Enable BitLocker (if Windows Pro)
  3. Attempt the same method
  4. Document the difference

Questions: 25. Does BitLocker completely prevent the bypass? 26. What is the time difference?

Deliverables​

To submit:

  1. Answer document (Word/PDF) containing:

    • Answers to the 26 questions
    • Measured time for each method
    • Screenshots of the 3 functional methods
    • Helpdesk procedure (Exercise 7.1)

  2. Screenshots (minimum 5):

    • Command prompt via Utilman (showing whoami)
    • net user command showing users
    • Successful password change
    • Login with new password
    • Hash verification (modified utilman.exe)

  3. Security analysis (1-2 pages):

    • Impact of these vulnerabilities in a company
    • Recommended protective measures
    • Comparison with/without BitLocker

  4. PowerShell script (Exercise 7.2)

Evaluation Criteria​

CriterionPoints
Mastery of the 3 bypass methods30%
Understanding of security implications25%
Quality of analysis and recommendations20%
Documentation and screenshots15%
Detection script (Exercise 7.2)10%

Quick Reference Commands​

Recovery Mode​

Access recovery mode:

shutdown /r /o /f /t 00

Identify Windows partition:

diskpart
list volume
exit

Bypass Methods​

Utilman replacement:

copy D:\Windows\System32\utilman.exe D:\Windows\System32\utilman.exe.bak
copy D:\Windows\System32\cmd.exe D:\Windows\System32\utilman.exe

Sticky Keys replacement:

copy D:\Windows\System32\sethc.exe D:\Windows\System32\sethc.exe.bak
copy D:\Windows\System32\cmd.exe D:\Windows\System32\sethc.exe

Password change:

net user <username> <new_password>
net user <username> ""

Detection​

Hash verification:

Get-FileHash C:\Windows\System32\utilman.exe
Get-FileHash C:\Windows\System32\sethc.exe
Get-FileHash C:\Windows\System32\cmd.exe

Restoration:

copy C:\Windows\System32\utilman.exe.bak C:\Windows\System32\utilman.exe
copy C:\Windows\System32\sethc.exe.bak C:\Windows\System32\sethc.exe

Troubleshooting​

Problem: "Access Denied" in recovery mode​

Solution: You are already in recovery mode with privileges, this should not happen. Ensure you are using the recovery command prompt, not the normal Windows one.

Problem: Cannot find utilman.exe​

Solution: You are not on the correct drive. The Windows drive in recovery mode is not always C:. Try D:, E:, etc.

Problem: Backdoor does not work after restart​

Solution:

  • Ensure you copied to System32 (not SysWOW64)
  • Check if the file exists: dir C:\Windows\System32\utilman.exe

Problem: "Sticky Keys" still shows the original dialog​

Solution: The copy did not work correctly. Retry from recovery mode.

Going Further (Optional)​

Challenge 1: Alternative Method - Kon-Boot​

Research Kon-Boot - a tool that temporarily bypasses Windows login without modifying files.

Questions:

  • How does it work?
  • Is it detectable?
  • Advantages vs methods in this lab?

Challenge 2: Automated Detection​

Create a script that:

  • Runs at startup
  • Checks the integrity of utilman.exe and sethc.exe
  • Alerts admin if modified
  • Automatically restores from backups

Challenge 3: Complete Evil Maid Attack​

Document a complete "Evil Maid" attack scenario:

  1. Physical access (5 min)
  2. Backdoor installation
  3. Keylogger installation
  4. Persistence configuration
  5. Planned data exfiltration

Then list all possible defenses.

Additional Resources​

Conclusion​

This lab taught you:

  • 3 Windows password bypass methods
  • The importance of physical security
  • Why BitLocker is crucial
  • How to detect and prevent these attacks

Key Lessons:

  1. Physical access = Total control (without encryption)
  2. BitLocker is essential on laptops
  3. Automatic locking protects against opportunistic access
  4. These techniques are legitimate for authorized recovery
  5. Security is multi-layered (physical + software)

Next step: Lab 2.2 where you will learn to create disposable VMs to test destructive changes without risk!

Final Note: Ethical Responsibility​

You now know how to bypass Windows authentication in minutes.

This knowledge is a powerful tool:

  • Use it for good (legitimate recovery, authorized testing)
  • Never to harm, steal, or violate privacy
  • Always obtain written authorization before any test
  • Respect laws and professional ethics

Remember: With great power comes great responsibility.

Commitment: "I understand the implications of these techniques and commit to using them only in a legal and ethical framework."

Your signature: ____________________

Lab developed as part of the Operating Systems course - MODULE 2