Kon Boot: Getting into a Client’s Computer without using a Portal Gun

Okay, here you are again. Another computer from another (self-proclaimed) client for you to fix. So, let’s boot this thing and see what’s wrong with it this time. Okay, first obstacle; logging into the client’s user account. Now for me, repairs would usually pause here while I’m waiting for the moment I can get a hold of my client and ask him or her for the correct password. Annoying…

The tools for the job

Now of course I could use fairly established tools such as Offline Windows Password & Registry Editor (also known as ntpasswd for you geeks out there) or Ophcrack. But for multiple reasons, those tools just don’t seem to cut it for me.

While they do their job brilliantly and have both saved me on numerous occasions, they have drawbacks. ntpasswd allows a user to reset the password of a user account by booting from a special boot disk. Although this is very useful, it leaves traces; my client has to reset his or her password and actual changes are made to the Windows setup.

Ophcrack does a fine job cracking Windows password hashes using so-called rainbow tables. Basically, Windows stores your user password in a hash, a seemingly arbitrary series of numbers and letters. Hashing is a way of storing passwords without having access to the plain password, which is much more secure than just storing the unencrypted password.

Now what is this hashing you speak of?

The below YouTube clip does an excellent job explaining how encrypted communication works and in the process it also shows how hashing works. Just substitute “The original colours” with “The user password” and you’re good to go. The part you’ll want to take a look at to understand hashing is from 0:40 to 1:05.

Ophcrack basically knows (in some cases, not all) which original colours (passwords) are mixed into the end colour (the hash). These colours and their end products are stored in a table, a rainbow table. Now this works well with passwords that are easy to guess but if the passwords are more complicated, Ophcrack will take way too long at guessing the password — or it won’t find it at all (at least not within our lifespan). If you would like to know more about cryptography, then I invite you to watch the entire YouTube video. It’s worth it.

Enter Kon Boot

Back to our password problem. This client’s really hard to get a hold of, won’t answer his phone and won’t reply to texts or email. Annoying… 

Until recently this meant having to wait and wait and wait, having the client’s machine just taking up space in the room. Then Kon Boot drew my attention. Where ntpasswd and Ophcrack help you login with a legitimate password, Kon Boot simply hooks onto Windows’ kernel and tells it to disregard the authentication of the password entered, correct or not. Doing this, it allows you to log into any local user account using any (or even a blank) password you enter into the password field. Windows will accept anything you input as the correct password, even insults. (No really, I tried “Windows sucks, Linux FTW!” as a password — it didn’t seem to upset Windows at all.)

Now I can hear you thinking, “It can’t possibly be that easy?”. Guess again, it’s probably even easier than you imagine it to be right now. Kon Boot can be run from a CD, USB drive or even a good old floppy disk. You boot into Kon Boot, Kon Boot will boot into Windows and that’s it.

Some popular BootCDs (like Hiren’s BootCD) even include the free version of Kon Boot saving you from having to create your own bootable disk image. Just burn the ISO to a blank DVD or put it on a USB drive following the clear instructions.

Kon Boot has a free version that handles virtually all 32-bit versions of Windows except Windows 7. If you do decide to pay for this awesome piece of software, you’ll get a version that adds Windows 7 and 64-bit support. Check out their website for pricing.

What Kon Boot won’t do

Now because Kon Boot doesn’t actually know the password to the account, it is unavoidably inhibited in performing certain actions. The most noteworthy are:

• Kon Boot does not allow you to change the password of the account used to log in. However, changing the password of other local accounts is possible.
• You can not use the private keys stored in the Windows certificates store. These certificates are used to decrypt encrypted email, websites and other connections.
• EFS (Encrypted File System) encrypted files can not be accessed because they are encrypted with the real password. An “access denied” message is displayed by the system.
• Kon-boot does not allow you to bypass the authentication on an Active Directory domain. Only locally stored accounts can be accessed. However, cached accounts seem to be accessible in certain cases.

Pretty scary stuff

Kon Boot seems to be the nightmare of any system administrator who wants to keep unwelcome guests out of their files and settings. Countermeasures can be taken though:

• Disable USB and Firewire booting in the BIOS.
• Change the boot order to make sure the computer won’t boot from any CD or DVD.
• Disable any other boot methods your BIOS may allow you don’t need (such as network boot).
• Encrypt your files by using e.g. EFS, Truecrypt, etc.

Other than that, there isn’t really much you can do about it. The bypass has been there since 2009 and it seems unlikely Microsoft will release a patch after three years. I have tried have Kon Boot on several of my PCs running different versions of Windows and Kon Boot allowed me to log into all of them like a charm.

Although Kon Boot seems like a pretty scary tool, I believe it can be put to good use by underpaid tech fix guys as ourselves. I’m sure I needn’t remind you; using Kon Boot to grant yourself access without permission is illegal and may get you in trouble.