Maximum PC

Just read the latest issue and noticed a mention to backtrack and using winlockpwn to reset passwords. First of all, winlockpwn is a firewire based reset tool. It relies on DMA, running from backtrack to Firewire on XP. The article seemed to pass over this important piece of information. If your interested in performing this reset, I'd recommend the following resources:

http://www.storm.net.nz/projects/16
http://forums.remote-exploit.org/showthread.php?p=83524

As for password reset, as the article was attempting to explain, I'd recommend this posting:

http://forums.remote-exploit.org/showthread.php?t=11624

If anyone from Maximum PC is interested in having their future Linux articles proofed for accuracy, please send me a message.

William

Sorry, that position is taken.

I haven't read that article, but perhaps I should to see how accurate the claims of inaccuracy are.

Let me know. The post doesn't explain clearly (or, ironically, accurately) the problem with the article.

I *think* that the poster is complaining that the article doesn't explain the process clearly enough. I *assume* that this was the result of limited space and the desire to explain how to use the tool rather than how the tool works.

I'm shooting in the dark, though, 'cause I haven't found the Nov issue yet.

Gimme my issue!!

Personally. I think he's trying to pimp his own site, but hey..what do I know.

Perhaps someone should move this the mag feedback

Knowing MaxPC, they were either limited in space or, choose not to give the full instructions for breaking passwords out of some legal nod to their lawyers.

All good thoughts, guys.

I hadn't considered moving the thread until it was mentioned but I think you're right. This is definitely Mag Feedback. So ... I'm punting it over there.

Thanks!

My apologies for not explaining clearly enough. Winlockpwn requires both the host and victim to have functional firewire ports for this hack to be successful.

The article states "you can pick from numerous penetration methods, but for a simple password change, use winlockpwn."

Backtrack does not come with winlockpwn. Second, winlockpwn does not change the password, it simply changes the reference in memory where the password is stored allowing all passwords to be accepted as correct. Third, there are many other methods that would be considered simple and not require looking for tools and dependancies. I'd go with replacing the utilman tool on vista and xp which is builtin to backtrack:
http://www.offensive-security.com/movie ... ahack.html

I hope this clarifies my point.

William

I'll have to wait until I get my hands on the issue before I can comment fully, William. You're just making me more anxious to get my issue!

Not like you wrote an article for it or anything either...

I looked over it, it seemed straight forward. I didn't try it, I was busy last night. I will look into it again tonight. I didn't have a free 2 GB thumb drive or I would have tried it.

Well, what were your conclusions? Am I off base or did MaxPC give inaccurate information?
William

There's a lot of comments raggin' on Will, but he's right...and I felt compelled to stick in my few cents worth.

I downloaded the USB version of BackTrack 3 and it is just under 800 MB, enough to fit on a 1 GB stick, though you may want to put it on a 2 GB so that you'll have extra space just in case. The tools provided are quite extensive as is. A CD and VMware image is also available.

I agree that the way the reference to winlockpwn was just "thrown in" was somewhat deceptive. It made it sound like winlockpwn was included in this "PC Lockpick"; it's not (according to the online documentation).

I would also dispute the reference to it being "simple" to use. I refer you to Maximum PC's Mark Soper's article posted 3/10/08, "Who's Afraid of the FireWire Port? Maybe - You!", in which he states: "Thankfully, winlockpwn isn't available as a preconfigured .exe file - Boileau has published it as a research tool for serious security researchers (but, let's face it, serious hackers will also "benefit" from it too). It requires a Linux-based PC with a FireWire port, the Python programming language, and some programming libraries." Also if you click on the BT forum links that Will has provided, you'll see some discussion on getting winlockpwn to work.

I don't think that the information was inaccurate. I do think that the information that you've added is important, but was it important enough to try to stuff into that little HOW-TO? I don't think so.

I do think it was a valid comment, though, and my answer is just my opinion. If the article was any longer, I would definitely have argued that they should explain how winlockpwn works and when it would be useful.

Edit: After reading the article, I tried to use winlockpwn using a Backtrack3 install on a USB key. It doesn't exist.

Hopping onto google, I've discovered that winlockpwn is not part of the standard Backtrack3 install and that adding it to the distro requires adding a few extra packages. Difficult? Not for someone well-versed in linux. As easy as the article implies? Nope .. not even close.

I must disagree with you gentlemen. Winlockpwn is there in the USB disk image of BT3. I tried it out last night, but as I'm a noob w/ Linux I had no success. I'll check out the forums that Will graciously provided. Thanks Will!
Also, I'm wondering about any changes to the existing tutorials. How is it different now that it's not running over firewire to a windows system but while you're temporarily booted w/ Linux? When I try to run, I get error 2: can't find file. So far, my attempts have changed nothing in XP.

The tool works by having the host computer (Backtrack) connect to a victim computer (XP/Vista) via the firewire port. You need the tool, a firewire cable, and two firewire ports. One on your Backtrack computer and one on your XP/Vista computer. Most laptops come with Firewire. You can use a PCMCIA card if it doesnt.

William