# Bitlocker & Time based policy bypass

#### Assumptions :

1. Having the handy Linux live USB
2. Recovery key of the Bitlocker is known.

> Bitlocker recovery key can be known from the official microsoft account website under machine info settings.

***

> Here the user is not able to logon into the windows bitlocker protected system as the password is been forgotten.

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FySGB4onr4Fu0S1Ob96DT%2Fimage.png?alt=media&#x26;token=64930f50-ca14-4619-bcd2-0308a50b4a38" alt=""><figcaption></figcaption></figure>



<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FKjetBdMZe9T6p0rmrZxA%2Fimage.png?alt=media&#x26;token=50e6d466-8065-46f2-b7f4-b08f57ab8a60" alt=""><figcaption></figcaption></figure>

> Opening the system from the BIOS configuration mode to disable the secure boot policy if it is been enforced into the system. Our HP machine was protected by the HP secure boot policy so we have to disable it.

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FELHnpQcPs8Vz19SIJJel%2Fimage.png?alt=media&#x26;token=111a9aa3-53fe-4759-b5a4-9522eed91782" alt=""><figcaption></figcaption></figure>

> Changing the default boot order of the System and loading the Live USB (Linux) to boot the OS

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2F1a5cDbiop4ZKbz4KZW7N%2Fimage.png?alt=media&#x26;token=6bbb9071-1c8f-4474-85d5-23c7c9b3b058" alt=""><figcaption></figcaption></figure>

> Selecting the live USB mode to start the Linux OS

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2Fav6uBCjPQVe2HejZvAd0%2Fimage.png?alt=media&#x26;token=13a43553-f575-4291-92cb-5117a5985653" alt=""><figcaption></figcaption></figure>

> Here are the Bitlocker protected drives where the recovery keys are being known to us so we will be decrypting the drives.

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2F8wFq0AmkXt3rBKuw1o8h%2Fimage.png?alt=media&#x26;token=a3124f17-b53c-4ff0-b6fb-fbe36fd68e5f" alt=""><figcaption></figcaption></figure>

> Entering the recovery keys here and we are able to decrypt the drives.

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FwfNOie20qFmYzsXj0YHK%2Fimage.png?alt=media&#x26;token=effd9884-e291-49a3-9065-b9309d3f5c45" alt=""><figcaption></figcaption></figure>

> here is the directory structure of the windows we are looking for directory :

```
C:/Windows/System32/Config
```

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FFwvf2ODHAP3ditbnwlHf%2Fimage.png?alt=media&#x26;token=ecfc991e-84fb-45fd-bac4-f09319a60c8e" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FmfaIoRNOWUxzn8MXAGmi%2Fimage.png?alt=media&#x26;token=ff93c9fa-7718-433a-ab08-1f1d9464a7f2" alt=""><figcaption></figcaption></figure>

> Using the command "chntpw" to change the user settings of the windows file system.

```
# If the program is not installed into your linux file system
sudo apt install chntpw
```

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FizVxUlziEad5upAmiEoY%2Fimage.png?alt=media&#x26;token=d591dc43-2677-4756-8d5d-ec65abaa3ac7" alt=""><figcaption></figcaption></figure>

> Use the following command to enumerate the users present into the filesystem.

```
COMMAND FOR HELP : chntpw -h
```

```
COMMAND : chntpw -l SAM SECURITY SYSTEM
```

> The "SAM," "Security," and "System" files in the Windows Registry store user accounts, security settings, and hardware information, respectively. They are crucial for system functionality and security. Modifying them without proper knowledge can cause issues.

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FMyrY4YFGe0zBsIADhC0K%2Fimage.png?alt=media&#x26;token=2c9d1990-ea96-4c70-8c1b-f94b1070342a" alt=""><figcaption></figcaption></figure>

> making the command into the interactive mode using the following command given below to get options of the loaded hives.

```
chntpw -i SAM SECURITY SYSTEM
```

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2F9VpG8mWunI1s2IwNu4hg%2Fimage.png?alt=media&#x26;token=6f9ea353-5542-414a-9f62-1d5702a5d438" alt=""><figcaption></figcaption></figure>

> selecting the user in our case 'Temp' selecting the RID : 3ed to select the corresponding user.

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FP7ELATwUzootqmQOw9PT%2Fimage.png?alt=media&#x26;token=54b6a1a4-4ede-4dc0-8dd7-f1d4573b952e" alt=""><figcaption></figcaption></figure>

> Under the user edit menu, select 1 to clear the password of the corresponding username.

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FKVoHHIwMkYS5XYeLYxuH%2Fimage.png?alt=media&#x26;token=631e1189-3503-4881-8cea-25ce78e18bb5" alt=""><figcaption></figcaption></figure>

> There is prompt that the user password is successfully removed.

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FTtwO6gQABTJHUSGRanSJ%2Fimage.png?alt=media&#x26;token=a8fcd72b-bb22-4d90-9af5-d6bf209d0282" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}
```
NOTE : If in your case the issue is only limited to the password recovery then you are good to go !! just restart the system normally and you will be able to log back in.
```
{% endcode %}

#### Section 2 : Removing the time based login policy of the user.

***

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FfLiS79Sdc0kb98yfcaec%2Fimage.png?alt=media&#x26;token=26b7b5ed-fd36-408d-8fad-f7df725c8cbe" alt=""><figcaption></figcaption></figure>

> Here our account has the time based login restriction enforced so we have to open the system into recovery mode.

```
To open the recovery mode in windows opreating system 

Press Shift+Restart option
```

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FRl8bqyyDbxRvahdcqzWj%2Fimage.png?alt=media&#x26;token=e8ae785e-2f3e-4450-9024-1a96820f5d0a" alt=""><figcaption></figcaption></figure>

> Then the pc should boot into this section select troubleshoot option.

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FxOT36wdvRbaJNxCkDV2t%2Fimage.png?alt=media&#x26;token=25f9b3fe-d285-4153-ad21-ee7d0af067da" alt=""><figcaption></figcaption></figure>

> Then advanced options

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2F76W1NrMOAacdgnBbAAkJ%2Fimage.png?alt=media&#x26;token=9accb2ad-bb95-43de-8e0c-c58c01f20582" alt=""><figcaption></figcaption></figure>

> Select the command prompt option here if the bitlocker prompt is there then select skip for now button & boom we got the recovery shell X:windows/system32

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FpUDzKOkpm5fg29q6ZuWg%2Fimage.png?alt=media&#x26;token=67a95861-b3e9-4329-9bb9-5e7862974140" alt=""><figcaption></figcaption></figure>

> on selecting the drive we got the error that the drive is bitlocker protected then we have to disable the bitlocker protection using the following command:

```
manage-bde -unlock E: -RecoveryPassword "mypassword"
```

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FWhmqBBNf0DOBQzA31xlv%2Fimage.png?alt=media&#x26;token=6bb6a099-199f-4d22-8ebc-70df38cb070b" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FQeDwpFT9PmPIARGa9LoQ%2Fimage.png?alt=media&#x26;token=04434901-8679-40a5-a7ed-9a95758117af" alt=""><figcaption></figcaption></figure>

> Yoo we have successfully unlocked the system volume encryption settings.

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2F8jkrqGEj8oEnFCdPGxZL%2Fimage.png?alt=media&#x26;token=858fd0dd-0460-4562-9a9e-fac6adc22e17" alt=""><figcaption></figcaption></figure>

> using the following command to replace the utility function present on the lock screen to open command prompt into the lock screen.

```
1. cd Windows/System32
2. ren Utilman.exe utilman2.exe
3. copy cmd.exe Utilman.exe
```

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FDRRaKS395JfdQO8tSYgR%2Fimage.png?alt=media&#x26;token=c15f85b5-6a1a-4f80-ada6-89891c7a7b04" alt=""><figcaption></figcaption></figure>

> We got the shell clicking the accessibility button present on the right side of the lock screen.

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FljXkhm82RxRMPpmhQPz4%2Fimage.png?alt=media&#x26;token=c0665815-b7b6-43cf-a3df-98c8e8f1e902" alt=""><figcaption></figcaption></figure>

&#x20;listing out the users present into the system, use the following code:

```
net user
```

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FShs9NTBKHYWja7t6jwWU%2Fimage.png?alt=media&#x26;token=3158433c-1194-4e9d-a1e9-7153f2c63d65" alt=""><figcaption></figcaption></figure>

Changing the password of the selected user.

```
net user 'username' 'password'
net user 'username' /times:ALL // This will remove the time based restriction policy
```

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2F62FGYlzAWZnMYW5dZE6T%2Fimage.png?alt=media&#x26;token=0caab438-a77a-4978-bda4-0a64a456edec" alt=""><figcaption></figcaption></figure>

Here we can see that the password is unlocked and the time based logon is set to all time access.

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FuvMgjygworLU6mJ6VJ2O%2Fimage.png?alt=media&#x26;token=32c3dde4-deef-4d95-b204-13d20f8efc6b" alt=""><figcaption></figcaption></figure>

Login back to the system

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FOcwrqVJFoekX5a0pGvmp%2Fimage.png?alt=media&#x26;token=b18603fa-6a18-4a67-99dd-e5841e85bdee" alt=""><figcaption></figcaption></figure>

> We got the system back in. This is how we can remove the time based policy and also disable the bitlocker encryption to remove the password.

***
