Privilege Escalation bypass security dog user restriction

Are you still worried about having a safe dog and not adding users? Please refer to the following link for more information ~ In three steps, how can I use guest to obtain the logon permission when the latest server security dog 4.0.05221 account is fully protected ~ The server security dog cannot add users when the account is fully protected. However, it does not restrict the permission to view and modify passwords. This is undeniable, even if you cannot change the password, you can also read the plain text of the iis user password. Therefore, the dongle account restriction is just like a false one ~ First, use guest to demonstrate how to use the registry to tamper with the F value of a user under sam so that the user can access the management permission. first, you must have an Elevation of Privilege exp to grant the system permission to yourself. As we all know, the administrator value is 1F4 and GUEST is 1F5. If there is an exception, we will discuss it below. The steps are as follows: 1. use net1 user guset 1 to reset the guest password to 1. You do not need to ask whether to disable 2.reg export "HKEY_LOCAL_MACHINE \ SAM \ Domains \ Account \ Users \ 000001F4" "x: \ 1.reg" export the administrator's registry value to a certain path, modify the content, delete the "V" value, leave only the F value, change 1F4 to 1F5, and save. 3. Use regedit/s x:/1.reg to import the registry, and log on with guest password 1. The dongle said: What if I cannot change my password when my account is fully protected ?! What if I cannot change my password? Use vbs to view the iis user password, and then use reg export "HKEY_LOCAL_MACHINE \ SAM \ Domains \ Account \ names \ User Name" "x: \ 2.reg" to view the corresponding value, repeat steps 2 and 3 and log on to the dongle with the displayed plaintext password. "If you cannot change the password, Is it forbidden for iis users to log on to the Remote Desktop? Method 3: Right. What should we do? Continue to listen to me. We all know that guest is an empty password, so we can log in with a blank password. Execute reg add HKLM \ SYSTEM \ CurrentControlSet \ Control \ Lsa \/v limitblankpassworduse/t REG_DWORD/d 0/f to change the value of limitblankpassworduse to 1. Repeat Step 2 and continue logging on. Oh ye ~