Monday, December 30, 2019

AWS EC2 Reset Windows Password

AWS EC2 Reset Windows Password (Win 2008)


  1. Detach root volume from the inaccessible Windows (A) instance to another Windows instance (B) as a non-root volume. Be sure B is running identical version of Windows.
  2. Log into B
  3. Mount the secondary volume
  4. Browse to the secondary volume into \Program Files\Amazon\Ec2ConfigService\Settings\config.xml 
  5. Find the section for "Ec2SetPassword"
  6. Set the "State" property to "Enabled"
    <Ec2ConfigurationSettings>
      <Plugins>
        <Plugin>
          <Name>Ec2SetPassword</Name>
          <State>Enabled</State>
        </Plugin>
    
  7. Replace the file (accept the UAC warning)
  8. Update the disk signature
    1.  Open regedit.exe
    2. Under HKEY_LOCAL_MACHINE, find "Windows Boot Manager"
    3. This should look like "HKLM\BCD00000000\Objects\{XXXXX-XXX-XXXX-XXXX-XXXXXX}\Elements\"
    4. Go to sub-path "11000001"
    5. Select "Element" Value
    6. Find the byte value found at offset 0x38
    7. Reverse this set of bytes (6E E9 36 02)
    8. This is the disk signature that this disk needs to have
    9. Open Admin Command Prompt
    10. Run diskpart
    11. Select the disk of the drive from Windows instance A
      select disk 2
    12. View the disk signature of this drive
      uniqueid disk
    13. If this isn't what was found from step 7, then we need to make it so
      uniqueid disk id=6EE93602
    14. This will cause this volume to come offline
  9. From AWS, detach this volume from B and add it to A as /dev/sda1
  10. Proceed to retrieve the random password as usual

No comments:

Post a Comment

AWS WAF log4j query

How to query AWS WAF log for log4j attacks 1. Setup your Athena table using this instruction https://docs.aws.amazon.com/athena/latest/ug/wa...