Hacking Windows 10 Administrator Password using Kali Linux Operating System, Based on Few Simple Steps! Will Surly Works Fine! If still needs help Don’t forget to Comment below!
Step 1: Launch Any OS That Allow Full Access to the Windows Folders
In this case, I am going to be using Kali. Although you can use many different linux distros or even a windows disk/usb, as long as you can access the terminal/command prompt your good.
Also Read: Password Cracking Series
Step 2: Navigate to Sys32
I’m going to infer you know basic navigation and be able to navigate to the Windows partition.
In my case, im currently writing this on my laptop rather than my desktop, so my Windows is known as BOOTCAMP, as I am on a macbook with Windows dual booted.
Step 3: Rename osk.exe to osk.exe.old
oks.exe is the name of the ease of access ‘On screen keyboard’ file. Rename this using whatever your systems rename command is, in Kali the command would be: mv osk.exe osk.exe.old
Step 4: Rename cmd.exe to osk.exe
Now I’m sure you see how this works, but ill explain it anyways. Basically, when you press ‘on screen keyboard’ in the ease of access terminal, Windows launched osk.exe, which normally is the on screen keyboard application. But we changed it to launch cmd instead. Like magic.
Command: <system rename command> cmd.exe osk.exe
Kali: mv cmd.exe osk.exe
Step 5: Launch Windows and Select ‘on Screen Keyboard’ in Ease of Access Menu
I found this picture off of the interwebs, but what you normally see should be something like this. After going through all the steps above, you should instead see a command prompt.
Step 6: Resetting the Password
Also Read: Windows – BIOS Password Hacking
The Command: net user <USERNAME in quotes> <PASSWORD>
Example: net user “Admin” temppass
If you don’t know the password type in net user and locate it there.
Net User – More Info Here
Step 7: Finished! You Can Login Now!
Viola, you can now login with whatever password you typed in. If you want to reset it simply go back to Kali and redo what you’ve done! Rename osk.exe to cmd.exe and rename osk.exe.old to osk.exe