Re: Article: Windows XP Wide Open Using Windows 2000 CD-ROM

From: Petter Nordahl-Hagen (pnordahl@EUNET.NO)
Date: 02/20/03

  • Next message: Thomas Kristensen: "Re: Article: Windows XP Wide Open Using Windows 2000 CD-ROM" 
    Date:         Thu, 20 Feb 2003 15:19:38 +0000
From: Petter Nordahl-Hagen <pnordahl@EUNET.NO>
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    On Wed, 19 Feb 2003, Donovan Bernauer wrote:

    > There's a vulnerability in Windows XP that allows anyone who can modify
    > the BIOS to boot from the CD (or to the NIC for RIS/BOOTP systems) and use
    > the Windows 2000 cd-rom version of the recovery console to freely access
    > the files on an XP box, regardless of most of the configured system
    > security.

    The reason win2k recovery console just allows access when tried on a XP
    system is that there are differences in the registry file format.
    XP has a more true hashing of the key indices in the registry than 2k has
    (NT4 and 2k use simply the first four characters of the name as the index
    "hash") I discovered this when working on support for XP registry write on
    my regedit library for linux.

    Recovery Console, by design, will let you in with full access if it
    can't read the registry and the SAM to get at the admin password.
    So recovery console 2k on XP system thinks the registry is corrupt, and
    continues to let people recover their system.

    I personally think a recovery tool should do just that, "hey, something is
    wrong here, oh well, let the user fix it instead of assuming something"

    Also, try to load a XP registry hive into regedt32 in 2k, it won't work,
    at least not in the original 2k release. 

    --
Petter Nordahl-Hagen, pnordahl@eunet.no
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
Delivery co-sponsored by TruSecure Corporation
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
TICSA - Anniversary Special - Limited Time
Become TICSA certified for just $221.25 US when you register before 3/31/03
with PROMO "TS0103" at www.2test.com.  NO membership fees, certification
good for 2 years. Price for international delivery just $296.25 US, with
this offer.  Offer cannot be combined with any other special and expires
3/31/03. Visit www.trusecure.com/ticsa for full details.
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo

    Relevant Pages

    • Re: ntoskrnl.exe problem HELP
      ... 1- Use something like BartPE http://www.nu2.nu/pebuilder/ with a registry editor plugin http://sourceforge.net/projects/regeditpe/to edit the registry. ... 2- Mount the disk in another Windows NT type computer and use the "Load Hive" feature in Regedit or Regedt32. ... 3- Access the broken installation via a "Parallel" or proper "Dual Boot" installation on the same computer and use the "Load Hive" feature in Regedit or Regedt32. ... I've been using the Windows XP CD, but that only gets me to the recovery console, which thusfar hasn't done me any good, but if I can expand to the right thing from the CD, that sounds logical. ...
      (microsoft.public.windowsxp.help_and_support)
    • Re: Corrupted registry, no floppy drive for regchk
      ... The registry backup process is a manual one so you won't have one unless you run the backup process initially, then periodically thereafter to keep it current. ... To start the Recovery Console, start the computer from the Windows 2000 Setup CD or the Windows 2000 Setup floppy disks. ... If you do not have Setup floppy disks and your computer cannot start from the Windows 2000 Setup CD, use another Windows 2000-based computer to create the Setup floppy disks. ...
      (microsoft.public.win2000.general)
    • Re: Reduce the Registry Size in Windows 2000
      ... If you see an improvement in size then you can replace registry hives from ... To start the Recovery Console, start the computer from the Windows 2000 ... Setup CD or the Windows 2000 Setup floppy disks. ...
      (microsoft.public.win2000.registry)
    • Re: How do I restore or recover my system to out of box state?
      ... Now use your WinXP CD or diskettes to access the Recovery Console. ... What it is getting you to do is to copy and rename your existing registry ... security patches released since SP2 came out in 2004. ... > after the cows have all run off and have tried to restore my system to any ...
      (microsoft.public.windowsxp.help_and_support)
    • Re: Text of KB Article Included - From error to missing system file
      ... This article describes how to recover a Windows XP system that does not start because of corruption in the registry. ... If you use the procedure that is described in this article, you may not be able to log back into the recovery console to restore the original registry hives. ... In part one, you start the Recovery Console, create a temporary folder, back up the existing registry files to a new location, delete the registry files at their existing location, and then copy the registry files from the repair folder to the System32\Config folder. ...
      (microsoft.public.windowsxp.general)