{"id":4496,"date":"2015-01-05T15:10:40","date_gmt":"2015-01-05T15:10:40","guid":{"rendered":"http:\/\/www.top-password.com\/blog\/?p=4496"},"modified":"2015-01-05T15:19:52","modified_gmt":"2015-01-05T15:19:52","slug":"how-to-create-a-password-reset-backdoor-in-windows","status":"publish","type":"post","link":"https:\/\/www.top-password.com\/blog\/how-to-create-a-password-reset-backdoor-in-windows\/","title":{"rendered":"How to Create A Password Reset Backdoor in Windows"},"content":{"rendered":"

A vulnerability has been discovered as a backdoor in all versions of Windows, including Windows 10, 8, 7 and Vista. A user can reset Windows password from an elevated Command Prompt on the Windows logon screen. Here’s how to plant a backdoor to your Windows system so that you can always reset a forgotten Windows password, or even create a new administrative account when you’re locked out.<\/p>\n

Part 1: Create A Password Reset Backdoor in Windows<\/strong><\/p>\n

This method requires an administrator privilege to the computer in order to make changes to the system. Check out these step-by-step instructions:<\/p>\n

    \n
  1. First, make sure you are logged in as an administrator.<\/li>\n
  2. Download and install the freeware TakeOwnershipPro<\/a> on your computer. Go to the folder c:\\windows\\system32<\/em>. Right-click on sethc.exe and select TakeOwnershipPro<\/strong> from the context menu, this will grant full permissions of this file to your logged-on account. Proceed to take ownership of cmd.exe.\n

    \"take-ownership\"<\/p>\n<\/li>\n

  3. Make a backup copy of the sticky key application (c:\\windows\\system32\\sethc.exe<\/em>), and then replace sethc.exe with cmd.exe. If you haven’t taken ownership of sethc.exe and you might get the “access denied” error.\n

    \"rename-command-prompt\"<\/p>\n<\/li>\n

  4. Now you have successfully installed a Windows password reset backdoor.<\/li>\n<\/ol>\n

    Part 2: Reset Windows Password through Backdoor<\/strong><\/p>\n

    In the event that you forgot your Windows user password afterwards, you can simply reset the password through the backdoor you installed. Here is how:<\/p>\n

      \n
    1. When you are at the Windows login screen, press the SHIFT key continuously for 5 times and this will open a Command Prompt instead of the sticky key application.<\/li>\n
    2. At the Command Prompt, you can use the net user<\/strong> command to reset password of any existing account, or create a new user account.\n
        \n
      • To reset the password, type the following command:
        \nnet user Tom 123<\/code>
        \nReplace Tom <\/em>with the name of your Windows account, and 123<\/em> with your desired password.\n<\/li>\n
      • To create a new user account and add it to administrators group, run the following commands one by one:
        \nnet user test 123 \/add
        \nnet localgroup administrators test \/add<\/code><\/p>\n

        These commands will create a test account and give it local administrative privileges.<\/li>\n<\/ul>\n

        \"reset-windows-password\"\n<\/li>\n

      • Close the Command Prompt and you can then log into Windows with your new password, or newly-created user account. That’s it!<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

        A vulnerability has been discovered as a backdoor in all versions of Windows, including Windows 10, 8, 7 and Vista. A user can reset Windows password from an elevated Command Prompt on the Windows logon screen. Here’s how to plant a backdoor to your Windows system so that you can always reset a forgotten Windows […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10,1894,3,39,5,4],"tags":[2034,2035,2036],"class_list":["post-4496","post","type-post","status-publish","format-standard","hentry","category-tips-tricks","category-windows-10","category-windows-7","category-windows-8","category-windows-vista","category-windows-xp","tag-reset-windows-password-through-backdoor","tag-windows-backdoor-login","tag-windows-password-reset-backdoor"],"_links":{"self":[{"href":"https:\/\/www.top-password.com\/blog\/wp-json\/wp\/v2\/posts\/4496","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.top-password.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.top-password.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.top-password.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.top-password.com\/blog\/wp-json\/wp\/v2\/comments?post=4496"}],"version-history":[{"count":7,"href":"https:\/\/www.top-password.com\/blog\/wp-json\/wp\/v2\/posts\/4496\/revisions"}],"predecessor-version":[{"id":4506,"href":"https:\/\/www.top-password.com\/blog\/wp-json\/wp\/v2\/posts\/4496\/revisions\/4506"}],"wp:attachment":[{"href":"https:\/\/www.top-password.com\/blog\/wp-json\/wp\/v2\/media?parent=4496"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.top-password.com\/blog\/wp-json\/wp\/v2\/categories?post=4496"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.top-password.com\/blog\/wp-json\/wp\/v2\/tags?post=4496"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}