psexec and winlogin

Since I knew who Paula Januszkiewicz is I have been under her impression. Today I watched her presentation from TechEd and I try to show some of her trick :)

The first is connected with winlogon - Paula shows that there is possible to get access to a administrator's PC without having their credentials. How? By using psexec. Its a tool which can leverage your credentials and make many impossible things real. The tool is written by Mark Russinovich - my personal God of Windows Internals :) So...
1. Download the tool and open the command line with the administrator privileges.

Of course you have got the UAT turned on so confirm the operation.

2. Go the the psexec directory and you may read the help about this great tool.

3. Enter the following command

About arguments you can real in the previously mentioned help :)

4. Lock the screen in normal way e.g CTRL+ L.

5. When locked screen is displayed, press ALT+TAB - you have got a command line. Run the explorer.exe and make fun with system account provileges :)

Is your Windows password really strong?

How to check if your password is really unbreakable? Simply - use Cain & Abel. It is software which is "easily downloadable from the Internet". So lets do it.
1. Open the Cain and go to the Cracker tab. Then check Import hashes from local system.

2. Highlight preferred account and choose NTLM hash breaking by using the brute force.

3. Enter key space and approximate maximal and minimal password length and start the attack.

Don't be scared if you see that you will have to wait about 13 years as it was in my case :) It is time which is needed to cover whole range of combination from the key set.
4. And after some time.... you have got it (or the better option for your password - you cannot find it despite you have been trying for very long time) :)