Full transcript
0:00Security researchers found a new way to
0:02break out of the Windows installation
0:04process or OBE, the outof-box experience
0:08that allows them to get into a local
0:10administrator's command line. Let me
0:12show you. So, to be able to play with
0:13this, I'm going to be using a Windows 11
0:15virtual machine that I have set up here
0:17in VMware Workstation. Now, this is a
0:19completely fresh VM. I wanted to be able
0:21to show you this process just so we
0:23could get into that OBE or out ofbox
0:25experience that you might be used to to
0:28set the keyboard configuration to add
0:30new users to deal with privacy settings
0:32yada yada yada. So from here we're
0:34booting into Windows for the very first
0:35time. Say we're booting up to the
0:37installation media, the disk to be able
0:39to actually install Windows. And let me
0:41cruise through this process just so we
0:43can see where we would usually land. I
0:44don't have a product key in this case.
0:46And once we get through here, it'll ask
0:48us, oh, what version of Windows do we
0:49want to install? I'll use Windows Pro.
0:51Whatever. Click on next. But then it'll
0:53tell us, hey, currently right now, as it
0:56stands with my virtual machine, we're
0:58not able to run Windows 11 because
0:59Windows 11 was one of the first ones
1:01that required a TPM or trusted platform
1:04module. You might have seen that screen
1:06where it was checking our PC if it were
1:08able to run Windows. But we know, or you
1:11might know, I think I've showcased this
1:12in a video, or at least I really hope
1:14so. we can bypass the TPM check or even
1:17the RAM check, storage check, CPU check,
1:19and all of the checks that Windows does
1:22to determine whether or not it's able to
1:23be installed. Let me just speedrun
1:25through this and then we'll get to the
1:26actual OB breakout. We could, if we
1:29really wanted to, modify the settings of
1:31the virtual machine and then just add
1:33hardware for a TPM or trusted platform
1:36module. Now, I can't do that right now
1:37because the machine is on, but even when
1:39we do this, then the drive gets
1:41encrypted and you can as easily clone
1:42the VM from a snapshot or any other use
1:45case. So, I really like to try and
1:46bypass those checks. But here's the
1:48thing, I always forget how to do this. I
1:50feel like I've done it once and it was
1:52sort of a set and forget because then I
1:54have a base image or VM that I can use
1:56and clone and use for any purposes that
1:58isn't drive encrypted. So, anyway, I
2:00needed to go track down the steps again
2:03to install Windows 11 into VM without
2:05TPM. Now, there is a manual way to do
2:07this by opening regedit and using the
2:09command prompt to create a couple
2:10registry tweaks, but this is all done
2:13via a terminal that you open at this
2:15guey or graphical user interface screen
2:18using the special hotkey combination
2:20shift F10. That'll open up the command
2:22prompt and you'll be an administrator.
2:24So, that technique, which is not what
2:26we're talking about today, has
2:27historically been used for quite a bit
2:29to be able to add other local admin
2:31accounts, back door system when you have
2:33access. But what I want to do is use
2:36these commands that essentially do all
2:38the same thing as the manual action, but
2:40I can at least copy paste that into the
2:42VM. So, back at the Windows installation
2:44prompt, before we've even done this, let
2:46me go ahead and shift F10, get that
2:48admin prompt open, and then I'll
2:49rightclick and actually go to the edit
2:51window to paste in all of these
2:53commands. And to be clear, with shift
2:55F10, you do get that admin prompt, but
2:58that can be disabled. So, this is all
3:00about another way that you could
3:02actually break out of this OBE
3:04out-of-box experience during the
3:06installation process. And I want to show
3:08you that now that we can finally get
3:10Windows installed. Let me click through
3:11again. We'll get to the install process
3:14after we agree to the terms. Yep. Yep.
3:16Yep. Looks fine to me. Let's go ahead
3:18and install to the VM disc and go ahead
3:20and do it. Okay. Now that Windows is
3:22installing, after that, we can take a
3:24look at the OBBE breakout. It's easier
3:26than you think. But before we do, while
3:28we're waiting for Windows to install,
3:30please let me take just a quick moment
3:31to tell you about the sponsor of today's
3:33video, Anyesk. The best choice for
3:36remote desktop access. Anyesk is fast,
3:40even on low bandwidth connections. With
3:4299.98%
3:44uptime, it's reliable, backwards
3:47compatible with older operating systems,
3:49even with file transfer functionality,
3:52and a clean user interface. It feels
3:55like you're sitting at the remote
3:56device. And the best part is Anyesk is
3:59completely free for personal use. There
4:02are customtailored business plans to
4:04help your whole team stay connected with
4:06tons of use cases like video editing,
4:09remote 3D printing, and general
4:11collaboration across your organization.
4:14Connect your own devices for access
4:16anywhere and even help support family
4:18members with troubleshooting and those
4:20everpresent tech support asks. Use
4:23Anyesk to save time and effort with the
4:26easily customizable, secure, and smart
4:28choice for remote access. Whether it's
4:30in the cloud, on premise, or even on
4:33mobile, Anyesk is trusted by over
4:36185,000 businesses worldwide. Get
4:39started with Anyesk and connect your
4:41world with my link below in the video
4:43description. jh.live/nyesk.
4:46Huge thanks to Anyesk for sponsoring
4:49this video.
4:50Okay, now Windows has been installed to
4:53the disc and it's booting up for the
4:54very first time to the OBBE or out ofbox
4:58experience. Remember, this is when it'll
4:59ask you about your region, your
5:01location, the privacy settings you want,
5:03adding a second keyboard layout, all
5:05that. But the question is, how could we
5:07get an administrative command prompt?
5:09So, we could do whatever we wanted to do
5:11even from this screen. Well, we know
5:13that we could use that shift F10 hotkey
5:16to be able to open up that admin command
5:18prompt, but that could be disabled. That
5:20might be turned off on some systems. So,
5:22what are the alternatives? Well, think
5:24of when you're usually operating and
5:26working on your Windows desktop. Well,
5:28you could open up the start menu or I
5:30don't know, you hit control altdelete
5:32maybe. Let me try that real quick. We
5:33could try here. I'll send control
5:35altdelete to that virtual machine, but
5:38nothing really happens. I can I can keep
5:40clicking that and it's just not doing it
5:41right. So this is where it's simple
5:43because in all reality we could use some
5:45tricks using some of the even
5:47accessibility tools that are available
5:49here for us. So if I click that menu
5:51down at the bottom you might be able to
5:53see the magnifier contrast themes
5:55narrator voice access on screen keyboard
5:57etc. But magnifier is actually a special
5:59one because that will open up another
6:01window for us. If I click that on you
6:03can see it's opened up and now I'm
6:05zoomed in to the 200%. Let me bring that
6:08out to 100%. But while I have this
6:10window open, it's another window. So I
6:12actually get to do a little bit more
6:14regular Windows desktop things like alt
6:18tab on my keyboard and switching or
6:20navigating between different windows. We
6:22could see what's open, even the
6:23Microsoft account kind of vague
6:25amorphous blob there. And we could even
6:27use the Windows key and R on our
6:30keyboard to open up the run dialogue
6:32box. So I pressed that. You might not
6:33have seen it. You might have seen oh the
6:35screen flicker for a quick second. We
6:36lost focus to the magnifier because it's
6:39been created. It's opened the window,
6:40but it's in the background. It's behind
6:42the screens. Then we can't really see
6:45it. But if I alt tab, we do have a run
6:48dialogue box. I can click into it, and
6:49it's still not shown. It's still not
6:51present or visible, but it is focused.
6:53So, I could type in here cmd.exe.
6:57And if I wanted to hit enter to open up
6:59that command prompt or I could hit
7:01control shift enter on our keyboard and
7:04that will run it with administrator
7:06privileges like UAC user account
7:08control. We get our little popup. Do you
7:10want to allow this app to make changes
7:11to your device? Windows command
7:13processor cmd.exe. Yes, but it doesn't
7:16show up. It's still in the background
7:18though. If I alt tab look around, there
7:21is our administrator prompt. And I can
7:23try and type in here who am I? Even if I
7:25can't see it, I'll hit enter. And it's
7:27really tough to see, okay, the results
7:30there. But you can run commands. So you
7:32can net add local admin, create another
7:34backdoor user, do anything else you
7:37might particularly want to. Now, I've
7:38tried to experiment with this. I've
7:40wanted to use like alt space to open the
7:42context menu, and then alt space m to
7:44try and move it. You can see my cursor
7:46jumped, and I tried to drag that around,
7:48but it's still just stuck behind the
7:50scenes. Maybe alt space x to maximize it
7:53or alt space n to minimize it and then
7:55try and bringing it back. It doesn't
7:57seem to work. I've even tried to close
7:58that Microsoft account. So nothing else
8:01really changes. Just now that window's
8:03gone apparently, but you can still type
8:05in execute run commands. How could we
8:07get this to the foreground? I don't know
8:08if you always need to, but remember we
8:10were discussing shift F10. That might
8:13not always be available, but if it is,
8:16let me show you. We could close out of
8:18uh the magnifier and then try to close
8:20out alt space c for our command prompt
8:22there. Now clicking into obe the regular
8:25out of boss experience if I did that
8:27shift f10 obviously administrator
8:29command prompt opens and I can run who
8:31am I here you'll see we are the user
8:34default zero which is currently in the
8:38net user administrator groups. We could
8:40actually go take a look at that. net
8:41local group administrators default user
8:45zero will give you the admin access
8:46right then and there but now that we've
8:48opened this window if I were to try to
8:50use the windows key and R the run
8:52dialogue box is completely visible and
8:54any subsequent things that we open like
8:56another cmd.exe exe will be displayed in
8:59the foreground because I guess the shift
9:00f10 terminal lets us bring that there
9:03and Windows is installed. You can see
9:05our prompt in the command prompt is a C
9:07colon drive no longer the X colon drive
9:10like you saw before we had installed cuz
9:12it was on the disc. So we could do
9:14anything on the Windows system. Neat.
9:16Cool. I hope that's just neato. And
9:18again maybe some of you are thinking
9:20like okay so what this only happens when
9:23the machine is being provisioned or just
9:24set up but I want to talk about that. I
9:26also want to discuss and chat a little
9:28bit more about the Shift F10 old school
9:30option. Please let me give credit where
9:32credit is due. This was seen, found,
9:34discovered, shared, and publicized just
9:36a bit ago, uh the 12th of August by an
9:39individual, another security researcher
9:41or folks doing this stuff with the
9:42handle BKA. The about section here, he
9:45discusses how he writes about it and
9:47security and in-depth technical stuff.
9:49He's on Blue Sky X or LinkedIn. So, big
9:51shout out, credit, kudos, props, all the
9:53things that reserve for Bastion, senior
9:55security consultant at SSSE Secure in
9:57Germany and handle BKA. I'll be sure to
10:00put his link, his blog, all the
10:01references in the video description.
10:02Now, he discusses the Windows OBE or out
10:05ofbox experience breakout, discussing
10:08how we can get into that default user
10:10zero admin command prompt. And then he
10:12sets the stage, you know, telling
10:13everyone that the Windows out-of-box
10:15experience is everything that we're used
10:16to. You could end up using that with CIS
10:19prep. So if you're preparing golden
10:20images, maybe you steamrun roll over
10:22that, maybe using the initial
10:24configuration for the settings or it
10:26could just be brought up with any sort
10:27of machine management like intoune. When
10:30shift F10 kind of was hitting the
10:32streets as folks were able to use this
10:34to do whatever they might want to even
10:36when the Intune company portal had
10:38machines get reset, then they could do
10:40anything from there. But if the shift
10:43F10 hotkey were not desired, you could
10:46end up removing it or disabling it by
10:48placing an empty file with this specific
10:50name in this specific folder. There's
10:52another blog or link to be able to
10:54discuss that. I think this is uh Rudy
10:56who is putting this out and discussing a
10:58lot of things that would be handy and
10:59helpful to do and have here. And then he
11:01uncovered that with that specific file.
11:03So again, link in the video description
11:05if this is interesting or helpful for
11:07you. But now with shift F10 out of play
11:09and hey, we need some other potential
11:11alternative. Is there a way to do a
11:13breakout? He's thinking, you know what,
11:15this is simple. This is easy. Just use
11:17the run dialogue box and you aren't
11:19relying on shiftn. You can still run
11:21commands while you use that magnify.exe
11:24and the rest of the regular Windows
11:26tricks. He's got a sweet gif here or a
11:29little animated gif, however you weirdos
11:31like to pronounce it. Now, he uses the
11:33onscreen keyboard, which I think is
11:34handy. You can use that, but I did want
11:36to demonstrate pressing the keys
11:38naturally on your keyboard. Once you
11:39have the magnifier open, it'll just
11:41work. Obviously, this could be used and
11:43abused to create backdoor accounts or
11:45manipulate the system, do whatever you
11:47would like. And Microsoft doesn't
11:49consider that really a security issue
11:50because OOB is going to naturally run an
11:53admin session and leaving the new device
11:56unattended during the setup is like
11:58leaving the machine unlocked. Totally
12:00true. He gets into a little bit more
12:01Intune specific stuff that I hope might
12:03be helpful for some of you. Granted, I
12:05don't think I am too smart on that. I do
12:08want that to be available though. So
12:10again, links in the video description.
12:11And I think it's another neat little
12:14thing just to be able to pop open that
12:16admin command prompt.