How to Hack a Windows XP User Account... Read In : )

[Spennyboy]

Hey guys, not that this would be used in everyday life... but now and again you could be faced with a situation where you need to be able to 'access' another user account on your computer, whether it be for permissons or for files.

This short but sweet tutorial will explain to you how to gain access to any account on a computer... in around 2 minutes ... even quicker if your fluent on a computer. :thumbs

First off, no matter how babyish the language used is, im writing this so absolutly anyone could follow it.

When you turn the machine on, you will see the user log on pannel as show below:


9/10 the account you want will be password protected. so heres how we bypass that :thumbs

1. Restart the computer so your loading it up from the start again. Then instead of letting it load properly, you need to boot it up in 'safe mode'.

All machines are different, but most will give you a boot menu by press F8 when you turn the computer on. Others could be F10 - F12...

2. Let the computer load in safe mode, you will know your in safe mode because there will be text in every corner saying 'safe mode'.

3. Once loaded, you will see there is another account selectable now, called 'admin', select that and let windows load.

4. Once it has loaded and you can see the desktop, get your self into control pannel. This is be found by click on start then settings.

5. Once your in control pannel, go to 'User Accounts', once that new window opens, select the account that you want to have access to and then you will have some more options.

6. Click on the bit where it says remove password, then confirm it. You have now succesfully removed the password to that account.

7. Reset the machine, wait till it loads to user accounts, then click on the account you have just edited, and it will boot into it and you will have full access. :thumbs

Summary:
Boot up in safe mode, Log in as Admin, go to control pannel, user accounts, remove password, restart, log in

Now i no that is a good few of ya that would of thought this as easy know how or even common sense, but i bet there is at least one who will benefit! :thumbs

Comments Welcome....

I have just typed that now, so there are possibly errors, please advise if you pick up on something.

Just thought i would add me little bit to this section as its look very bare atm. :thumbs

[whatnow]

nice I guess but it's got a slight flaw in having to know the Admin password. Any machine with anything decent would have this set.

I'm sure you could bypass the admin password too however it would add a few steps to the guide

not bad for seeing if your mum's been looking at fetish porn I spose ?

[Spennyboy]

most bog standard home computers aint gonna have much set tho.

Im only posting this as i was at a mates house earlier today and his brother was being a cnut and wuldnt tell us the password to the computer... the above is how i got around it

[Possy_99]

All machines are different, but most will give you a boot menu by press F8 when you turn the computer on.


...don't mean to be a twat, but all machines may be different, but the key to enter safe mod isn't, F8 will bring up the menu where you can chose safe mode, or F5 will boot direct into safe mode.

[Spennyboy]

ah see, a flaw in my plan, i didnt no that... i always used F8 to get the menu to boot to safe mode... u learn something new everyday!

[Possy_99]

...lol, that's the fun of pc's eh..

[Sanj[UK]]

or if u wanna do it the quick way (works on most xp machines) when your at the login screen..depending how you got it setup i.e if you have the normal xp layout wid just the usernames showing up press alt+ctrl+del twice and you will get the classic login screen, type in administrator and press enter but as like spence's guide this will only work if there is no admin pass set

[whatnow]

which on all dell and co. PC's it wont, so sorry, it is a good guide

[Spennyboy]

thanx... and more importa***ey... it works!

[unclex]

Nice post

[BM]

Also this wont work if on a domain as most of the accounts will be on the AD server.

[unclex]

But we are talking about a local admin desktop, not one that is connected to a domain or a server that is providing profiles for users.

In the domain example this may still work for local admin.

Oh god - I am now going to have to test this - bummer

[whatnow]

you know you love it really unclex

[unclex]

Ok it still works

but you will lose all EFS encrypted files, personal certificates and stored passwords for web sites or network resources, if you reset a users account.

But you can create a new local admin account.

But if you pull your profile from a AD server then you will not be able to change it.

:|

Still a good post Spencer_y89

[Spennyboy]

all the confirmation to know it work guys

lets see if we can get some more similar post in here!

[Pongo]

*Ahem* /me clears his throat and takes to the stage.

Quick and easy.

Offline NT Password & Registry Editor (v041205)
Petter Nordahl-Hagen has written a Windows NT/2000/XP offline password editor:

h**p://home.eunet.no/~pnordahl/ntpasswd

This is a utility to (re)set the password of any user that has a valid (local) account on your Windows NT/2000/XP/2003 system, by modifying the encrypted password in the registry's SAM file.
You do not need to know the old password to set a new one.
It works offline, that is, you have to shutdown your computer and boot off a floppy disk or CD. The boot-disk includes stuff to access NTFS partitions and scripts to glue the whole thing together.
Works with syskey (no need to turn it off, but you can if you have lost the key)
Will detect and offer to unlock locked or disabled out user accounts!
Caution: If used on users that have EFS encrypted files, and the system is XP or later service packs on W2K, all encrypted files for that user will be UNREADABLE! and cannot be recovered unless you remember the old password again!
Download links:
bd041205.zip (~1.1MB) - Bootdisk image, date 041205 h**p://home.eunet.no/~pnordahl/ntpasswd/bd041205.zip
cd041205.zip (~3MB) - Bootable CD image with same version and drivers as floppies above
h**p://home.eunet.no/~pnordahl/ntpasswd/cd041205.zip
sc041205.zip(~1.3MB) - SCSI-drivers (041205) (only use newest drivers with newest bootdisk, this one works with bd041205)
h**p://home.eunet.no/~pnordahl/ntpasswd/sc041205.zip
To write these images to a floppy disk you'll need RawWrite2 which is included in the Bootdisk image download. To create the CD you just need to use your favorite CD burning program and burn the .ISO file to CD.
Support and Problems? Don't call me! Talk to the creator of this great tool. He also has a good FAQ set up covering most of the day-to-day questions. Read it right HERE h**p://home.eunet.no/~pnordahl/ntpasswd
Author claims that this tool was successfully tested on NT 3.51, NT 4, Windows 2000 (except datacenter), Windows XP (all versions) and Window Server 2003. Notice that it is NOT compatible with Active Directory.







Need to change Windows NT/2000 Domain Admin password? This tool, however useful, will only reset the local administrator's password (e.g. the one found in the local computer's SAM). To reset a password of a domain administrator (or any other user for that matter) you must perform the routine that is described in the following page: Forgot the Administrator's Password?or Reset Domain Admin Password in Windows 2000 AD. h**p://www.petri.co.il/reset_domain_admin_password_in_windows_2000_ad.htm



Note: The above trick will probably not work under Windows Server 2003 due to service account security changes. To work around these limitations please read the Forgot the Administrator's Password? - Reset Domain Admin Password in Windows Server 2003 AD page.
h**p://www.petri.co.il/reset_domain_admin_password_in_windows_server_2003_ad.htm



Author (Oliver Mattos) claims it also works with Windows NT and Windows Server 2003 and Windows Longhorn, but the BEST thing about it is the fact that it won't reset your passwords, but simply reveal them for you to remember and then use.

Give it a try. The author would like to receive feedbacks for debugging and troubleshooting purposes.

Note: You'll need a blank floppy to run the process, and it will take anywhere between a few minutes to a few hours for the scan to complete.

Update: Author now offers the same tool as a CD image for those of you who do not have a floppy in their computer.

Usage, instructions and additional information can be found at h**p://www.xppasswordrecovery.co.uk

[Spennyboy]

ah, but u dont get the same sense of achievement using a 'program'

good old fashion hard entry (ahem)

nice post tho

[unclex]

like the post Pongo - I see some Linux there

[Pongo]

Yep M8, it's a linux boot disk (either CD or Floppy) I use it quite a lot for sorting out systems where the 4 y/o kids have somehow put a password on the admin acount !

[BM]

We had a student use the floppy disc method on a PC at the college where i work. The student was promptly expelled and we had the fun job of changeing all the local admin passwords and disabling boot from floppy and password protecting the bios on every PC (1000+) :grr:

Got some overtime from it so its not all bad :thumbs