A good password has the problem of being difficult to remember. And sometimes you might need to get in to a system where the root password is long forgotten (or left with the system administrator before you).
Luckily there are ways of getting access to systems without having the password. This is of course in a sense also a security risk. That’s why you should always be aware that having unattended physical access to a computer system means the same as having root access to the operating system. Unless the information on a system is encrypted, it’s only as save as the room it’s in.

The method to use to reset the password if you lost the root (or only) password depends on the configuration of your system. But it mostly comes down to two separate tasks:

- get write access to the root partition

- change the password/circumvent control

Here are some things you can try from easy to more complicated.

1.booting into single user mode from the start menu

Some systems are configured to drop you into root shell without a password if you reboot them in single user mode. If your system has an option called single or recovery mode changes are it will drop you directly to the root prompt or as I know ubuntu does it serves up a menu with ‘drop to root shell prompt’ as an option. Sometimes you have to hit escape at startup to enter the boot menu.
Once in the root shell it’s as easy as typing passwd followed by your username and the passwd program will ask you for the new password. passwd without a name will change the root password.
If you don’t know the username anymore you can do

#cat /etc/ passwd this prints the password text file where every entry before the : is a valid username

or

#ls /home which will give you the username of the users on the system with a home directory (if the default home path is used)

If you have a system which has this boot option and you think this is just a to obvious security risk (don’t want your little sister to change your root password) you can easily remove this option by editing the file /boot/grub/menu.lst (if you use the grub boot loader) or /etc/lilo.conf (if you use lilo)
If you use Ubuntu you can set passwords for the menu options in the startup-manager from the administration menu security tab or remove the option in the advanced tab.
Grub and Lilo both have password options
to password protect grub create a md5 hash of your password ( #/sbin/grub-md5-crypt ) and edit the file /boot/grub/grub.conf add below the line timeout the following line:

password –md5 password-hash-here

grub configuration should be user root group root and 600 permissions.

to password protect boot menu entries just enter lock below the title line in the /boot/grub/menu.lst file

for protecting lilo edit the /etc/lilo.conf file before the first image stanza place the option

password=clear-text-password

2. booting into single user mode when there’s no menu entry at startup

If there’s no single or recovery option in the boot menu you can still boot into single mode by editing the startup entry. To do this in grub, while in the menu press ‘e’ this will let you edit the menu entries. Just append single to the line starting with kernel. press ‘b’ and the system will boot into single mode.
If your boot manager is Lilo you can pass Linux 1 or Linux emergency as boot parameters.
This approach won’t help you on all systems because many systems will ask you for the root password when booting into single user mode.(Debian does)

3. boot to root shell by using shell as init

If the single user mode has been disabled or is password protected just press ‘e’ in the grub boot menu and add init=/bin/bash (or any other shell executable) to the kernel line. Press ‘b’ to boot and you’ll get a root shell because the init process is replaced with bash while booting. This gives you a rather limited shell but it’s good enough, depending on your system configuration you might have to mount the root partition read/write before you can change the password. Do this by entering

#mount -no remount,rw /

After that you can use passwd again as in previous examples.

If your startup manager is Lilo you can give the boot parameters Linux init=/bin/bash

4. boot from alternative file system

This method is much less likely to be available as it requires some kind of “alternative file system” to be available. If you have non-root access and there is a writable partition (/tmp for instance) and you can place a linux file system relative to that partition for instance by downloading a minimal linux distro and unpacking it you can then give the root= option to grub and set the partition where you placed your own file system as root file system.
Executing the mount command will show the available partitions and how they are mounted. This will only work in very specific circumstances though.

5. boot from a bootable usb stick

If you have no way to access single user mode from the boot menu, or if your single user mode is password protected, you can still use an alternative boot medium. Many systems these days provide a boot option for booting from a usb stick. This is actually a very easy method. The access of boot sequence menu differs by system, most systems display a text like press esc to enter boot menu or something like that. Sometimes the system is already configured to try booting from removable medium first. Many systems also allow changing the boot sequence from the bios. Just change the boot sequence of the system to boot from usb or choose that option from the boot menu. This does require you to have a boot-able usb stick of course. There are many ways to make a usb stick boot-able one of them is described in my article about backtrack, which makes a great distro to use for this purpose by the way. Just boot from the usb device, and open a root shell. The next thing you have to do is find out which is the root partition. Use fdisk to list the available partitions:

#fdisk -l

This will show the disks available.
You can mount them with the mount command. First create a directory mkdir /newdir or mount the partition on an existing directory. Then mount the partition you think is the root.

#mount -o,rw /dev/hda1 /newdir

if mount complaints you have to specify partition type, you find the type as a letter/number combination where it says Id. To show a list of partition type name/Id combinations use /sbin/sfdisk -T

in this case use mount with -t option:

#mount -o,rw -t ext3 /dev/hda1 /newdir

check if it’s the right one with ls:

#ls /newdir (should list a root filesytem)

if it is the wrong partition, just do umount /newdir to unmount it and redo the previous steps with another partition from the list.

If it is the right partition use chroot:

#chroot /newdir

this will make the newdir your root dir

and then enter passwd to change the root password and reboot your system.

6. boot from CD

This is basically the same as option 5 but requires you to have a Linux live-cd or rescue-cd. Most linux installation cd’s double as recovery cd’s by giving you a rescue option at boot or some drop to root shell menu option anywhere in the process. You do need to have a cd/dvd player installed to use this option. The method is exactly the same as in option 5. There are a lot more systems that allow booting from cd/dvd (most older pc’s do) than from usb this makes it a more viable approach.

7. boot from network

Difficult to do in many cases, but if you have access to the bios or the system is already configured to try booting from the network, and you have a system which you can configure as a boot server, it’s more or less the same story as 5 and 6. Boot the system into a OS where you have root access and mount the disk, chroot and you are in.

If you can’t access the BIOS to change the boot sequence because it’s password protected, try searching Google for the master password for your BIOS. Or you can try removing the BIOS battery the BIOS battery is located on the motherboard and is there to keep the BIOS memory as the power is taken of the system. Unplug the system, remove the battery and wait for about 120 seconds. Be warned this will flush all BIOS information (configuration) most systems will boot fine when you reload default BIOS settings (not all). Some motherboards have jumpers for resetting BIOS, if you have the motherboard manual you can look it up. Laptops are sometimes equipped with security features which make flushing BIOS impossible or even render the system completely useless when trying to reset BIOS.

8. place an extra disk in the machine

In most cases the BIOS will auto-detect a new disk, so if you place a new disk containing a boot-able OS and make it the master and the old disk slave, you can make the system boot from the new disk.

9. remove the disk and place it in another machine

If you can’t do any of the above you can always take out the disk and place it in another Linux system. Than you can mount it, chroot to the disk and again use passwd to change the root password. Place back the disk and start the machine.

10. Try to gain root trough known vulnerabilities

If the system has been running for a long time (or not running) without anyone maintaining it, there’s a change it’s running a vulnerable service. This would probably take a lot of time to do. Try fingerprinting the system for running network services that have not been security patched. If there is a easy root exploit to run against the machine it might be possible to get in this way.

Securing your system

Securing yourself against all these options is very difficult. You can remove all removable medium drives, CD/DVD, diskette, fill your usb ports with glue, passwords on everything. The only real protection is encrypted disks on every device you can’t keep in a secure environment. If someone gains unattended physical access to your systems they have access to your data.

What you can do is make it very difficult, secure access to your computers as much as you think is appropriate considering the sensitivity of your data. When it comes to mobile devices, laptops netbooks and the like you should carefully consider what would happen if it gets lost or stolen and someone has access to all your data. Very good Encryption programs are freely available for Linux and you can even choose to encrypt your whole system, in some distributions this is an install option.

Think there is more to try? Easier ways? Think there are better ways to protect against it? Mistakes? Leave a comment. It can take a while before comments are published(different time zone)

Src: junctionnetworks.com

• Business owners needing to monitor employees
• Parents needing to monitor children
• People who might need backups of things they type (writers etc)
• Private investigators, law enforcement, hackers, James Bond

Why would someone want a hardware keylogger as opposed to a software based one? Well this question has it’s pros and cons:

The pros are:

• It’s dead simple to install , just unplug the keyboard,plug this device in , and plug the keyboard into the device ,that’s it!
• No need for root/admin level permissions to install
• It can be installed on any system that has a USB port (Windows,Mac,Linux etc)
• Since it’s hardware-based it wont be detected by antivirus/malware programs ever
• It picks up EVERYTHING typed, even bios password passwords and log-ons

The cons are:

• Since it doesn’t interact with the operating system it can’t get the name of windows where the text was typed so it makes it a chore to scan the logs for the juicy information
• Easy to prevent logging by just removing the logger form the computer (which most people won’t be aware of anyhow, who actually crawls behind their computer everyday?)
• Recovery of logs might be more difficult because they are stored physically on the device and not sent to a remote location. But if you were able to install it in the first place , then recovering it shouldn’t that much harder.
• If the person has a PS/2 keyboard you can’t use an adapter because the device needs power from the USB port to work

Recovering the logs from the device can be done on any computer even though they offer the software to recover the logs faster, it’s not needed which makes this device a good tool to have in your arsenal. To recover the logs alls you you need to do is open any text editor (notepad etc…) and type in the password (default password is phxlog) and the device goes into menu mode, where you have a few options to choose
you have open so it’s best to open notepad or wordpad or any *nix/MAC equivalent before typing this. This menu will give you various options for the device ,which are:

1. Partial/Full Log download
2. Erase logs (quick or thorough)
3. Setting the default password (alphanumeric only,under 17 chars)
4. Firmware upgrade
5. Diagnostics
6. Speed (that the logs are typed)

Once you choose read the logs it starts auto typing the logs onto whatever window is open has the main focus (which is why you need to open a text editor).  If you don’t like to wait for it to auto-type (you might have days of saved logs) you can get the software to download it in one swoop. The only problem with the software that as of now it’s only compatible with windows.

Detection of the Device:

Because the device doesnt install into the operating system its pretty much insvisible to the normal user. Only a trained computer expert would notice the device it because the only sign it’s there is that it is seen as a USB hub by the OS. It shows up as a “generic 4 port hub Vid_0451&Pid_2046″ Vendor id of 0451 and a product id of 2046, which comes up as a generic Texas instruments device which wont raise many eyebrows. Because it’s a USB 1.1 hub it is possible that it may be discovered if someone plugs a USB 2.0 keyboard inline with it. (They might get a warning message telling them that their device can perform at a higher speed if they use a different port.) But the chances are slim of someone needing to replace their keyboard.

All in all this device is a stable tool to use, it logged with no problems at all with every keyboard/OS i used with it.  Although the price is a little high for most people, it’s well priceless for businesses who need to keep an eye on employees, or a parent who needs to monitor their children’s internet activity. I want to thank Keycarbon for giving me the opportunity to review and test this device. Check out their site for other devices they offer that I didn’t get to review , but are another great alternative to stealth hardware logging.

I see a lot of howto’s what are based on the same “story”: boot in “single mode” and type passwd to change the password, but are some systems like Debian and probably others what doesn’t let you get in single mode if you don’t know the root password … so the single mode solution it will not work.

First I will describe you the single mode solution, because the start of this solution is very similar with the next solution what I will present you in the end.

How To change the root password in single mode

1. Restart the machine.
2. Press any key while GRUB menu is loading.
3. You will see the Grub Menu with you configured kernels.
4. Choose a good kernel (or the options what is starting your linux) and press e to edit it.
5. Now choose the line that begins with ‘kernel’. Press ‘e’ again to edit this line.
6. Now at the end of the line just add: single
7. Press Enter and after that press b to boot that kernel

After that the kernel will start loading and if you have lucky and your installation doesn’t have password on “single mode” you will can change the root password with passwd utility. If you have the luck to have a password on the single mode just follow the next steps:

Other way to change the linux root password

1. Follow the same steps as “single mode solution” but only until step 6.
2. Replace the step 6 with: Now at the end of the line just add: init=/bin/sh
3. Press Enter and after that press b to boot that kernel
4. Kernel will boot and it will stop in a shell
5. In this shell type: mount -o remount,rw /
6. Now type: passwd and change the password
7. Now type: sync to syncing disk (flush from memory to HDD).
8. After that remount the disk read only: mount -o remount,ro and reboot / Or Ctrl+Alt+Printscr+S, Ctrl+Alt+Printscr+U, Ctrl+Alt+Printscr+B if you have Magic Sysrq keys enable:)

What are MagicSysRq keys ?

Are some keys combination’s what will let you to access some kernel basic commands at low level. The combination’s what I give you above are for:

Ctrl+Alt+Printscr+S – sync the disk
Ctrl+Alt+Printscr+U – unmount the disk
Ctrl+Alt+Printscr+B – reboot

The first step is to extract the username/password information from the relevant files, using the provided unshadow tool:

unshadow /etc/passwd /etc/shadow > /tmp/password.db

After that, john has three cracking modes:
# Dictionary mode, which tests passwords based on dictionary words. You can use the provided dictionary or provide your own, and there’s an option to enable “word mangling” rules.
# “Single crack” mode, which uses login names and various /etc/passwd values as password candidates, as well as applying word mangling rules.

Incremental mode, which tries all possible character combinations and will obviously take a very, very long time to run. You can change the parameters for this via the config file.

You can run one at a time (in which case, try “single crack” mode first), or run all of them consecutively with

john /tmp/password.db

To show results, use

john –show /tmp/password.db

unshadow will produce a password database only on systems that use /etc/passwd and /etc/shadow for login. For centralized systems, there’s a Kerberos5 module available, or the supplied unafs utility extracts Kerberos AFS passwords. There’s also a LDAP module.

Also remember that you can limit cracking attempts through measures such as locking out specific IP addresses after multiple failed ssh attempts or limiting the number of times a user can get a password wrong when logging on.

To enter the BIOS Setup try these keystrokes:

• AMI BIOS:  Del key during the POST
• DTK BIOS:  Esc key during the POST
• Award BIOS:  Ctrl-Alt-Esc
• misc BIOS:  Ctrl-Esc
• Phoenix BIOS:  Ctrl-Alt-Esc or Ctrl-Alt-S
• IBM PS/2 BIOS:  Ctrl-Alt-Ins after Ctrl-Alt-Del

Backdoor Passwords

Many BIOS manufacturers have provided backdoor passwords that can be used to access the BIOS setup in the event you have lost your password. These passwords are case sensitive, so you may wish to try a variety of combinations.

WARNING: Some BIOS configurations will lock you out of the system completely if you type in an incorrect password more than 3 times. Read your manufacturers documentation for the BIOS setting before you begin typing in passwords.

Award BIOS backdoor passwords:

AMI BIOS Backdoor Passwords:

Phoenix BIOS Backdoor Passwords:

Misc. Common Passwords

Other BIOS Passwords by Manufacturer

Toshiba BIOS

Most Toshiba laptops and some desktop systems will bypass the BIOS password if the left shift key is held down during boot

IBM Aptiva BIOS

Press both mouse buttons repeatedly during the boot

Motherboard “Clear CMOS” Jumper or Dipswitch settings

Many motherboards feature a set of jumpers or dipswitches that will clear the CMOS and wipe all of the custom settings including BIOS passwords. The locations of these jumpers / dipswitches will vary depending on the motherboard manufacturer and ideally you should always refer to the motherboard or computer manufacturers documentation. If the documentation is unavailable, the jumpers/dipswitches can sometimes be found along the edge of the motherboard, next to the CMOS battery, or near the processor. Some manufacturers may label the jumper / dipswitch CLEAR – CLEAR CMOS – CLR – CLRPWD – PASSWD – PASSWORD – PWD. On laptop computers, the dipswitches are usually found under the keyboard or within a compartment at the bottom of the laptop.

Please remember to unplug your PC and use a grounding strip before reaching into your PC and touching the motherboard. Once you locate and rest the jumper switches, turn the computer on and check if the password has been cleared. If it has, turn the computer off and return the jumpers or dipswitches to its original position.

Removing the CMOS Battery

The CMOS settings on most systems are buffered by a small battery that is attached to the motherboard. (It looks like a small watch battery). If you unplug the PC and remove the battery for 10-15 minutes, the CMOS may reset itself and the password should be blank. (Along with any other machine specific settings, so be sure you are familiar with manually reconfiguring the BIOS settings before you do this.) Some manufacturers backup the power to the CMOS chipset by using a capacitor, so if your first attempt fails, leave the battery out (with the system unplugged) for at least 24 hours. Some batteries are actually soldered onto the motherboard making this task more difficult. Unsoldering the battery incorrectly may damage your motherboard and other components, so please don’t attempt this if you are inexperienced. Another option may be to remove the CMOS chip from the motherboard for a period of time.

Note: Removing the battery to reset the CMOS will not work for all PC’s, and almost all of the newer laptops store their BIOS passwords in a manner which does not require continuous power, so removing the CMOS battery may not work at all. IBM Thinkpad laptops lock the hard drive as well as the BIOS when the supervisor password is set. If you reset the BIOS password, but cannot reset the hard drive password, you may not be able to access the drive and it will remain locked, even if you place it in a new laptop. IBM Thinkpads have special jumper switches on the motherboard, and these should be used to reset the system.

Use the Debug command

Boot to MS- DOS prompt, run through the below example, this example is perfectly fine to run on any PC Computer running MS-DOS / Windows and will not harm anything.

DEBUG script that will just reset the password only

Type debug and press enter.   (ex.  A:\>debug )

After typing debug you will get “-” as a prompt ,type these exactly how they are written.

o 70 10
o 71 20
quit

Explanation of code:

DEBUG    ; Run DEBUG, “-” will appear on each line then type:
o 70 20     ; Send 70 to address 18
o 71 21     ; Send 71 to address FF
q              ; Quit DEBUG

or you can use this alternate DEBUG script that will just reset the the BIOS

A <ENTER>
MOV AX,0 <ENTER>
MOV AX,CX <ENTER>
OUT 70,AL <ENTER>
MOV AX,0 <ENTER>
OUT 71,AL <ENTER>
INC CX <ENTER>
CMP CX,100 <ENTER>
JB 103 <ENTER>
INT 20 <ENTER>
<ENTER> Note: Nothing is typed on this line
G <ENTER> By pressing G this will execute the above script
Q <ENTER>

Then reboot and you will get a Setup Checksum Error. Go into setup, correct all the incorrect values, time, date…

Alternatively you can use the program WipeCMOS from a boot floppy

Use the Decoding software

CmosPwd by CGSecurity – This is probably the most up to date and popular CMOS decryption tool. CmosPwd decrypts password stored in cmos used to access BIOS SETUP, you can also backup, restore and erase/kill cmos.You will have to be logged in as administrator, run ioperm -i command and then run cmospwd_win.exe

PC CMOS Cleaner – PC CMOS Cleaner is an easy-to-use tool to recover, delete, decode and display the superior passwords stored in BIOS whatever the brand is. It’s an bootable CD that runs on x86 and x86_64 computers. It can display the superior passwords of the BIOS, remove BIOS password(will set the BIOS to default status, need reset date).

Boot Linux into single-user mode

1. Reboot the machine.
2. Press the ESC key while GRUB is loading to enter the menu.
3. If there is a ‘recovery mode’ option, select it and press ‘b’ to boot into single user mode.
4. Otherwise, the default boot configuration should be selected. Press ‘e’ to edit it.
5. Highlight the line that begins with ‘kernel’. Press ‘e’ again to edit this line.
6. At the end of the line, add an additional parameter: ’single’. Hit return to make the change and press ‘b’ to boot.

Change the admin password
The system should load into single user mode and you’ll be left at the command line automatically logged in as root. Type ‘passwd’ to change the root password or ‘passwd someuser’ to change the password for your “someuser” admin account.

Reboot
Once your done, press ctrl-alt-del, or type ‘reboot’ to restart into your machine.