The vulnerability already exists in VISTA. I don't know why I still haven't completed the vulnerability in WIN7. Although some restrictions are imposed (DENY appears when you delete an OSK file in CMD and the words "access is DENY" are denied), the brute force deletion tool can still be used to delete the file. After that, replace it with another one. The deletion will not cause any problems. DENY completely disappears.
It seems that Microsoft has not paid much attention to this vulnerability. The following is a tutorial:
Preparation tool, deep WINPE 3.0
Enter the CMD command prompt mode and copy OSK. EXE and CMD. EXE to other places.
Install WINDOWS 7 on the Elastic Compute Service (e) disk. Modify the disk as needed and run the following command:
Copy e: windowssystem32osk.exe e:
Copy e: windowssystem32cmd.exe e:
Then, use the Unlocker tool that comes with deep WinPE v3.0 to delete OSK. EXE (it cannot be deleted in CMD, and WINDOWS 7 has system protection)
Then, copy cmd.exe to the SYSTEM32 directory and name it OSK. EXE.
Copy e: cmd.exe e: windowssystem32osk.exe
Restart the computer
On the logon page, click auxiliary tools in the lower left corner and select On-Screen Keyboard.
The command prompt appears. Use the Net User command to change the User password. The format is as follows:
. Net user username and password
In this way, the user name and password are changed again.