You would not expect it to be easy to create a backdoor logon. Indeed, the technique described on this page does not threaten Vista security, unless someone has a Trojan horse program to prepare the way. Whatever you make of this technique, you have to smile at Microsoft’s unintended meaning of ‘Ease of access’.
You might have seen this..
How the Vista Backdoor Logon Works
This back door method exploits the ‘Ease of Access’ menu at the bottom of a regular Windows Vista Logon. Normally, if you click the Icon then you get a choice of help from Narrator, Magnifier and High Contrast. The trick is to replace the file called Magnify.exe, with a file which is really cmd.exe.
Once you make the change, then when you select Magnifier from the Ease of Access dialog box, you enter the operating system at the command prompt. The result is you can logon as the System account, without the need of a password. One limitation is that your shell program is cmd.exe rather than explorer. A more serious limitation is that in order to enter via this backdoor, you would need to install a Trojan horse program. Another possibility is that you have logged on previously, and manually made the changes described below.
Mission to Create an Impostor instead of Magnify.exe
The idea is to change the programme names so that the hyperlink link called ‘Make items on the screen larger (Magnify)’, actually points to cmd.exe. The result is that you open a back door logon to Vista.
Preliminary Step – Deal with Permissions
Problem: You cannot rename or delete the original Magnify.exe in Windows \system32. Even though you are an administrator, even though UAC is enabled, all you get is this message:
‘You need permission to perform this action’
Solution: Take ownership of the file Magnify.exe, then change the permission for the Administrator’s group to Full control. Then rename Maginify.exe to MagnifyOld.exe.
Main Step – Create the Impostor Magnify.exe
- Create a new folder called Ease
- Copy CMD.exe —> \Ease \cmd.exe
- Rename \Ease \cmd.exe —> Magnify.exe
- Copy \Ease \Magnify.exe —> Windows \system32\Magnify.exe
What you have achieved is that the old, relatively harmless, ‘Magnify’ becomes the more versatile cmd.exe.
Test Your ‘Ease of access’ Backdoor Method
- At the Vista Logon screen, click on Ease of access
- Check the box next to: Make Items on the screen Larger (Magnifier)
- Click ‘OK’
- You should now find yourself at the Command Prompt
- Try whoami (System account)
- Try regedit
0 comments