3CX Phone System for Windows -
VOIP IP PBX

Application Publishing with 2X ApplicationServer

Guy Recommends

A solution to monitor, manage and archive thousands of events that are generated by devices across the entire network.
Download FREE trial

Windows Vista - Backdoor Logon

You would not expect it to be easy to create a backdoor logon. Indeed, the technique described on this page does not threaten Vista security, unless someone has a Trojan horse program to prepare the way. Whatever you make of this technique, you have to smile at Microsoft's unintended meaning of 'Ease of access'.

How the Vista Backdoor Logon Works

This back door method exploits the 'Ease of Access' menu at the bottom of a regular Windows Vista Logon. Normally, if you click the Icon then you get a choice of help from Narrator, Magnifier and High Contrast. The trick is to replace the file called Magnify.exe, with a file which is really cmd.exe.

Once you make the change, then when you select Magnifier from the Ease of Access dialog box, you enter the operating system at the command prompt. The result is you can logon as the System account, without the need of a password. One limitation is that your shell program is cmd.exe rather than explorer. A more serious limitation is that in order to enter via this backdoor, you would need to install a Trojan horse program. Another possibility is that you have logged on previously, and manually made the changes described below.

Rename Magnify backdoor logon

Mission to Create an Impostor instead of Magnify.exe

The idea is to change the programme names so that the hyperlink link called 'Make items on the screen larger (Magnify)', actually points to cmd.exe. The result is that you open a back door logon to Vista.

Preliminary Step - Deal with Permissions

Problem: You cannot rename or delete the original Magnify.exe in Windows \system32. Even though you are an administrator, even though UAC is enabled, all you get is this message:

'You need permission to perform this action'

Solution: Take ownership of the file Magnify.exe, then change the permission for the Administrator's group to Full control. Then rename Maginify.exe to MagnifyOld.exe.

$Vista Take Ownership Windows\system32$

Main Step - Create the Impostor Magnify.exe

Create a new folder called Ease
Copy CMD.exe ---> \Ease \cmd.exe
Rename \Ease \cmd.exe ---> Magnify.exe
Copy \Ease \Magnify.exe ---> Windows \system32\Magnify.exe

What you have achieved is that the old, relatively harmless, 'Magnify' becomes the more versatile cmd.exe.

Test Your 'Ease of access' Backdoor Method

At the Vista Logon screen, click on Ease of access
Check the box next to: Make Items on the screen Larger (Magnifier)
Click 'OK'
You should now find yourself at the Command Prompt
Try whoami (System account)
Try regedit
Feel the power!

Modifications to the 'Ease of Access' backdoor

You could apply the same back door technique that I suggested for Magnify.exe to Narrator.exe. Another modification is to substitute other programs for cmd.exe. I tried explorer.exe, but that did not work for me.

Summary of Vista Backdoor Logon

The idea behind this Vista backdoor logon is to re-program the Magnify or Narrator. As a result, if you call for 'Ease of access', then you can logon by pressing Narrator or Magnifier. With this technique, you logon as the System account without the need to supply a password. One limitation, that I have yet to overcome, is that you have a command prompt shell rather than an explorer shell.

Guy recommends: The SolarWinds ipMonitor

My attraction to ipMonitor is because it inhabits that zone of part work, part play; Guy just could not put the dashboard away. This excellent performance monitor will get you started in the quest to remove bottlenecks on your network. SolarWinds provides this fully-functioning product free for 21 days. So download and install ipMonitor, then start scrutinizing your computers CPU, memory and disk performance. You can also select from zillions more performance counters such as fan temperature and battery level.

Installing ipMonitor is a breeze, but learn from gung-ho Guy's mistake and install SNMP on each computer that you wish to monitor. What sealed my unreserved recommendation of SolarWinds is their support team, you will get expert help even when you are evaluating the ipMonitor.

Download SolarWinds ipMonitor (21 days eval)

Train Signal has just released their New Windows Vista Training Course. As an MCT trainer, I am a huge advocate of Train Signal’s products. What impresses is me is that they demonstrate everything that they teach and they stay away from traditional 'lecture-style' training. If you are looking for a complete DETAILED coverage of Windows Vista, then I highly recommend that you give this course a try. I have reviewed their 18 hours of videos myself, and I guarantee that you will not be disappointed!

Watch a Vista Training Video Demo.

Windows Vista Security:

Other Sections

Guy Recommends: GFi EventsManager

Here is a solution to monitor, manage and archive thousands of events that are generated by devices across your entire network. Get your free evaluation copy of GFI EventsManager.

Please report a broken link, or an error.