Hacking Windows TrustedInstaller (GOD MODE)

[@_JohnHammond]

big yikes anyway speaking of cool things take a look at jh.live/training for more education and my newsletter at jh.live/newsletter i guess lol

[@dirtnoise0]

I've bricked my vm windows install 3 times this year since I found this channel, excellent video!!

[@vidal9747]

If you use Linux, it is easier to brick your system! Give it a try lol.

[@joselozano7585]

[@Haydatsanime]

​@@vidal9747this is the way

[@ChrisWijtmans]

@@vidal9747 its also easier to fix.

[@Corteum]

@@vidal9747 If your'e bricking anything, then you just dont know wtf youre doing isnt it lol

[@petersmythe6462]

User: "can I uninstall Edge?" Windows: "absolutely not." User: "can I uninstall the Kernal" Linux: "Let's find out!"

[@bluelinden]

linux, afterward: "Welcome to systemd emergency mode!"

[@KCKingcollin]

I want to like this fun and interesting content about getting back control of Windows, but at the same time I just see this as a bunch of BS steps to get around something that shouldn't have been in the way in the first place, it's so hard to be unbiased about OSs when Windows is this bad lol

[@SleepTime-Dark]

​@@bluelindenSystemd? More like grub recovery shell!

[@SleepTime-Dark]

​@@KCKingcollinIt's incredibly that in old machines, Linux LITERALLY GIVE YOU PERMISSION to destroy the BIOS of the system, that's how powerful it is.

[@KCKingcollin]

@@SleepTime-Dark That's actually something I didn't know, that's kinda cool, but also sounds dangerous lmao

[@itzspiro6047]

Now imagine deleting every single internet application apart from teamviewer and anydesk and calling tech scam call centers.

[@Nekomosh004]

Amazing idea 😆

[@korekd6524]

That shit would be hilarious

[@real_Hinoe]

we do a little trolling

[@AjarnSpencer]

why imagine when you can do?

[@itzspiro6047]

@@AjarnSpencer because I do not have the time, skill or patience to do it.

[@EricParker]

Reminds me of how on XP you could actually become System, complete with XP startmenu identifying as system.

[@HoneypawsModsDE]

Windows XP were the golden days of computers... I still have a VM on my PC where Windows XP Professional 64-Bit is installed... I even copy-pasted the Pinball Game into Windows 10 AND IT STILL WORKS despite being soooo goddamn old... Also, you make great videos, i love them ❤

[@addas4]

This to this date can happen if you run explorer.exe as TI or "NT Authority\System" I think he didn't GUI of notepad.exe on 13:28 because he wasn't running explorer.exe as "NT Authority\System" (He ran privileged command prompt from Sysinternals as System)

[@kipchickensout]

I didn't know that :o Man I *just* came here after watching one of your videos xd

[@kipchickensout]

@@HoneypawsModsDE I think they just scrapped it because they couldn't make it run native x64 in time and didn't want to use WoW64 🤔 One beauty of Windows, the backwards compatibility

[@_JohnHammond]

Great to see you here Eric, I have been loving all your recent videos! 😁

[@maxmyzer9172]

3:06 what stackoverflow is like now - Q: "How do I do X" A: "Why would you do that? dont do that." (if your lucky they give an alternative) What it should be: "You *can* do that by doing this, but you this is the better way"

[@artemisDev]

The problem is the commenters don't know how to do it themselves. And if they don't know something, no one should do that, right? ; )

[@elijahjflowers]

gpt for the win | in this case

[@boltez6507]

@@elijahjflowers GPT is only good for surface level stuff,i.e. questions that are already answered somewhere on the internet. It's basically useless for any questions that aren't in some way already answered.

[@BillAnt]

​@@boltez6507 - GPT = a web-scraper mostly from Wikipedia, which you could do yourself in seconds with better focus. lol

[@LuizDahoraavida]

That's known as a X Y problem

[@MisterDevel]

Redditors are so aggressive about being wrong that it's quite comical.

[@nullifier_]

the single worst thing about reddit is that you get suggestions and advice instead of answers when you come there with a question. I DO NOT ASK HOW BIG IS THE ROOM I SAID "I CAST FIREBALL"

[@Klaus293]

I found Reddit to be an absolutely creepy place. Tried it for a short while…nope, not for me.

[@KK-eg3em]

Reddit is a hivemind of group think. You made a great decision.

[@lemau8458]

The entirety of the site is like that, everybody thinks they know everything and are aggressive as shit about everything. That's why I stopped using it.

[@NoshLambeaux]

Classic behavior.

[@CyberDevilSec]

Every single time i watch Jhon Hammond i look at myself and say : I'm a noob in IT even though i was that strange kid that was obsessed over computers out of curiosity. I was the only kid who hacked my school and sold wifi passwords for admin privilege at my first year of high-school. I fixed my first laptop (from a friend) replacement with hardware when i was 11 but yet Jhon Hammond reminds me the learning curve in IT is ENDLESS! *GOD I LOVE THE ENDLESS LEARNING*

[@gacekkosmatek]

There is a plugin for Process Hacker which allows you to start any process with TrustedInstaller permissions and even run GUI apps like cmd.

[@Mavendow]

PSExec can do it via command line.

[@JBSbass]

@@HEXiT_ triggering a dumb AV program is simply an elevated permission state. Get your plugin from the dev and you can turn AV off and just use MB's who are more than aware of Process Hacker. Anyone with a modern PC should be using a VM to run Process Hacker on first anyway and if you aren't already then you haven't learnt that lesson yet. Image your OS into a VM, test and then decide. Only kids run exe's or scripts on their gaming machines.

[@NameThievery]

cmd is the exact opposite of a GUI app. It's descended of MS-DOS and was the equivalent of a Linux shell or...whatever BSD derived thing iFruit computers use. You have limited scripting and access to MS-DOS operating system executables like COPY, DELETE, etc. Up to Windows 98, in fact, MS-DOS, or that same command prompt, bootstrapped Windows, and there were MS-DOS configuration files for Windows that probably caused a lot of headache for Microsoft, leading to what has been a slow, slow move away from it, starting with XP. It remains as a useful artifact of the past, but if you use Windows Terminal in Windows today, the default tab will be a Powershell prompt. Anyway, GUI stands for "Graphical User Interface."

[@IsaacShoebottom]

​@@NameThievery CMD by default opens as a terminal emulator and a shell. A terminal emulator is a GUI app. CMD is a GUI app.

[@LitheInLitotes]

​@@HEXiT_ that could be said of anything. Stuff the fear mongering. Windows is literally spyware

[@stamdar1]

13:45 Notepad.exe is not a service binary. "Service binaries are different in the sense that they must “check in” to the service control manager (SCM) and if it doesn’t, it will exit execution." -specterops, Offensive Lateral Movement

[@H3_remix]

I really enjoyed the way you broke this problem down. Add this to the list of follies that is Windows OS. Once Linux is fully able to boot whatever games I want I will fully drop windows. It’s so annoying to have to jump through so many hoops to delete programs from your own PC.

[@akosv96]

The fact that this is denied by Microsoft as a vulnerability, instead they call it "normal behavior" raises all kinds of red flags to me. Not that Windows in itself wasn't one huge backdoor already... for all that matters I cannot check for myself as the OS is proprietary. Fixing this exploit would probably put a lot of "cheap and easy" backdoors out of service as privileges would work much better.

[@revival_of_the_canned_justice]

I will only switch to Linux when le terminal™ is no longer used for everything (even the most basic thing), but that will never happen, which is bad because the only good thing it currently does is shutting down in less than a minute

[@friker9236]

@@revival_of_the_canned_justiceThat is incorrect, you can do everything without using terminal.

[@amongsussyballs]

@@revival_of_the_canned_justice have u actually tried linux

[@orngjce223]

Steam's work on Proton has greatly enhanced game compatibility on Linux in the past few years; if you last checked for compatibility before the release of the Steam Deck it may be worth taking another look.

[@_JohnHammond]

James Forshaw's blog: www.tiraniddo.dev/2017/08/the-art-of-becoming-trustedinstaller.html I love seeing the sentiment for "just run Linux", or "just boot into Safe Mode", or "just attach a recovery USB", etc., but I think in the case of leveraging this for a penetration test, red team engagement, or offensive security work, if it is a remote Windows target (where you can't change the OS or have physical access) you have to live off the land and the constraints of the environment. This process should be valuable when you've got initial access, escalated privileges, and can do further post-exploitation to do damage or set up some sneaky persistence -- you can't as easily make changes, but you can sure as hell run PowerShell code. Just an option and one of many ways to skin a cat :)

[@daanmageddon]

Cheers, was checking the comments for the link, wanna check it out myself and get some more context. Maybe pin it to the top (atm its somewhere down your own page)? Great vid, cheers man.

[@_JohnHammond]

@@daanmageddon Hmmm, it should be a pinned comment, and is now in the description -- sorry I hadn't had it there earlier! Thanks so much for watching! 💙

[@boltez6507]

Challenge for you, try disabling the delivery optimization service without touching the registry. (i don't know about windows 11 but its pretty tough on windows 10).

[@ReligionAndMaterialismDebunked]

:3 Shalom.

[@ReligionAndMaterialismDebunked]

:3 Reddit is thankfully just 200+ million Google Play downloads for how toxic it gets. Cesspool, indeed. I almost entirely avoid using it. A lot of inaccurate info, down voting anything they don't like, getting banned by groups easily, far-left cancer, far-right cancer, etc.

[@xxlibarat0rxx280]

Amazing how people on Reddit will just bash you over and over for asking a simple question, on a tech forum nonetheless. Absolutely ridiculous behavior from these people

[@YTDeletes90PercentOfMyComments]

They're fake idiots farming karma. None of them would exist on a real hacking forum.

[@throwaway6478]

To be completely fair, the number of people I've seen complaining "hurr durr winblows bad because something broke while i was randomly changing registry values/acls/system files" over the decades suggests there is a huge number of Dunning-Krugers out there who really have no idea what they're doing. Feel free to run out in the middle of the highway and play in the traffic, but don't expect me to help you.

[@laljaka]

@@throwaway6478 I'll help you play in the middle of a highway :)

[@kintustis]

sounds like rtfm neckbeards

[@tannhausergate7162]

All the real people left Reddit over the years, now it's a ton of marketers and political activists trying to create a false reality for casual observers who are looking for information.

[@leventekovacs1441]

Guess what, recently Windows started harassing me with the win11 update by installing a program called RUXIM, and every time i deleted it windows just installed it back. So i changed the privilige from system to me, and i denied write access for system :d

[@leventekovacs1441]

I actually pulled an uno revers card on the system. " If I can't touch your files, then you can't touch mine"

[@Corteum]

Yes. Ruximics exe > Properties > Security tab > Advanced > Change Owner (from SYSTEM or TrustedInstaller to your user name) > Apply > Edit permissions > Deny ALL

[@Mario583a]

So... let me get this straight: RUXIM helps keep Windows updated and performing well by scheduling and delivering necessary updates.. Why delet?

[@virgo113]

It doesn't do that. It pesters you to upgrade to 11. wuauclt.exe along with several other binaries handles system patches.

[@itsarian.]

​@@Mario583aaverage reddit comment

[@NameThievery]

Fixing the family computer when my dad broke it when I was a kid is what started my hacking journey and a lifelong love of computers. Break all the things!

[@Padgriffin]

Mine was breaking my dad’s XP install on his laptop by writing batch files and him making me fix it lol

[@TinyDeskEngineer]

"You have unlocked god mode." "For more information on this issue..."

[@the_boogey_man0]

Jesus loves you

[@NathanOsman]

The reason you're getting the error when setting binpath for the service is because there are certain requirements for executables designed to operate as Windows services, one of which is to respond to queries from the service control manager. Obviously tools that aren't designed this way (like cmd.exe) don't respond and the service control manager thinks "this service is not responding and didn't start correctly." The reason you still see the executable being run is due to a small timeout that the service control manager uses to wait for the service to initialize. The reason you can't see graphical applications like notepad is because services don't run under the local user session and don't have access to the desktop.

[@rocco.uploads]

I absolutely love how cool this is and how much work went into this when you can just change the owner and delete the folder all within the Security tab 🤣🤣 You do amazing work John, it's always a pleasure to see your videos or guest appearances with others, keep it up 🔥🔥💪 (I also hope KZbin doesn't come for you for mentioning TrustedInstaller like they did with Enderman... 😶🤫)

[@byteafterlife]

In other words, removing bloatware with the equivalent of Linux sudo

[@ilekpilek]

fr hahaha

[@generalfishcake]

Or delete the windows stuff through a secondary Linux os

[@Alfred-Neuman]

I'm pretty sure it could also be used by a malicious software to remove the current antivirus and then install itself as TrustedInstaller to incrust itself into the system... Even better would be to replace the AV by a fake one so it takes more time for the user suspect anything wrong.

[@Lofote]

You can remove that stuff without such tricks in official ways you know.

[@Lofote]

@@Alfred-Neuman You don't need TrustedInstaller for that. An administrator can set the AV program without any additional rights. In fact every AV installer does this: register itself as the main antivirus program by setting a simple key in the registry, that is writeable by an admin.

[@HopliteSecurity]

Whoa, this was a great video with some even better enthusiasm! Thanks for sharing this, I learned several new things and I have some new ideas for setting up security policies around the trusted installer or attempts to a abuse it. 🙏🙏🙏🔥🔥🔥

[@dunngunkadoid]

I barely use that joke of a website but every time I've had to because there was no other option, 99% of my experience from reddit has been almost exactly what you showed in the video. Armchair redditors answering everything besides the question you're asking and in the most condescending way possible. I unironically have more competent conversations with people on /b/ than anywhere I've been forced to go on reddit. Great video btw

[@KennethKrueger-p4i]

Ublacklist lets you remove reddit or any other crap from coming up in searches.

[@hgbugalou]

You should be able to run a GUI app, you just need to flag the service to interact with the desktop. It's been a while since I have messed with with, but its an option for launching a service somewhere.

[@stanislavpetkov7408]

You can not do this past windows xp (early 7). Session 0, can not have window (CreateWindow does not work)

[@kipchickensout]

@@stanislavpetkov7408 Yeah I think I wanted to have a gui app run as a service in win10 and was sad after my research

[@shantilkhadatkar1195]

I think I saw a video of enderman just doing that. Gui apps all worked except for explorer.exe if I remember correctly

[@Lofote]

It was possible in NT4 and 2000, because there the interactive user was on window station session 0. THis is now randomized and so this was intentionally killed.

[@hgbugalou]

@@Lofote really? I could have swore I have done it in XP and Win7 back in the day.

[@SebastianTheNovice]

It might also be worthwhile noting that any process run in "Session 0" will always result be in a non-gui context. AFAIK "most" services are run as Session 0 meaning they will never have a GUI to interact with.

[@KeritechElectronics]

"...for I have become TrustedInstaller, destroyer of Windows." --Barbara Millicent Roberts-Oppenheimer

[@dahahaka]

14:00 notepad isn't showing up because services are started in Session 0, it's a special windows session (like being logged in as another user that would also be a different session), you can even see it in process explorer :)

[@giganetom]

Hahaha, this thumbnail aged like fine wine :D

[@ghfgh_]

How it was uploaded 8 days ago it doesn’t have time to age

[@poatatoooo]

Wait i dont get it

[@Plane_Person]

?

[@SteveQuizal-l9g]

FyViRS6000mosixwablEatSDineroRobertsWaiDioReilyJSubJoustesPerAnt0!!

[@AndreaBorman]

You can install Take Ownership which lets you take ownership of the file so you can edit or delete it. I used to do that on Windows 7 and 8 when I was using it. You could also unlock God Mode by editing the Windows Explorer file by typing in a registry key. I don't know if that's changed on Windows 10 because I am using Linux now.

[@KeinNiemand]

you don't need to install anything to take ownership you can do it from windows explorer or the command line already

[@fellipec]

So MS trying to transform Windows in a smartphone again and locking the admin from his own files. Miss the old days of NT4 where being part of Administrator's group already gave you all this, like Dave Cutler wanted.

[@connecticutaggie]

Probably what happened when you ran notepad as TrustedInstaller is that is started but it started under "session 0" that does not have a visible UI. I ran into this same problem with a service we wrote to run instrument drivers and one of the drivers used Active-X to interface to an application that talked to the vendor's hardware (the only option they provided). In this case sometimes their application would ask me to say "OK" but because the app was launched from the service, the UI was hidden and we could not see the error. Running the app locally allowed me to answer the question and not to ask again and the problem was resolved.

[@乂]

Great video, very informative! Thanks for sharing your knowledge!

[@EpicNoobx]

get out

[@zer0synd1cate]

thank you chatgpt

[@AlphactoryAT]

I did a lot of this research a few years ago and got stuck where you were at like 12:45. This is awesome, seeing the next steps I could never quite get. Will be removing windows defender from my computer as soon as I get home

[@VIVEVIEV]

It’s seems like every new video John’s hair grows larger and flows further up and to the left maybe one day it will look like Johnny Bravo’s

[@Mario583a]

Last I checked, Johnny Bravo did not have a beard nor a mustache. Edit: I doubt Mr. Hammond will shave them off.

[@VIVEVIEV]

@@Mario583a​​⁠meant more the height of his hair

[@salat]

14:21 You would have to enable "Allow service to interact with desktop" in the service configuration..

[@thegameraudi3687]

0:39 you could use iobit unlocker and unlock and delete it

[@cb9781]

I like plain old simple unlocker. Iobit software with all their boosters and stuff feels like something that might end up on a ctf machine because it has a vulnerable service.

[@LadysMan217]

This a comment about the responses to the reddit posts in the video. It is more of an anecdote, really. The year was 1992 and my parents surprised me by giving me my own pc. It was by all means barebones, even in those days. It was a AMD 80386DX 40 mhz with 4mb of RAM. There was no sound card or CD-ROM. And of course no modem or network. And the hdd was only 120 MB. My dad being the computer guru he was, had setup MS-DOS 6.0 and Windows 3.1 along with a carefully selected Word processor ( my teachers at the time were very leary of me wanting to type out my assignments on a computer. So my dad heard out their concerns and chose a very basic wysiwyg word processor - dos based, of course). My dad also installed a menu frontend and passworded it. I couldn't exit or use the only game on the system ( a shareware copy of Tank Wars) without it. I also could not access the command prompt or windows. But.... Guess what.... It took all of two minutes to break out of the menu front end. Lol. So I began exploring my new PC. Back then security was pretty non-existent in windows. So my explorations pretty quickly made windows start malfunctioning. It started doing weird things.... Clicking any icon to open it in program manager would cause the program icon to duplicate. Things like that. I did not know what I was doing.... Any ways, things kept going like this, and my dad ended up having to reinstall dos and windows several times, until he told me if I screwed up my system again, then that was it. Naturally, being 12, I ignored him and his attempts at locking things down even further. I ended up with a big pc sized paper weight for 6 months. Then my mom finally got involved. She convinced my dad to make a copy of the dos and windows disk ( three dos floppy's, and 6 windows floppies) and gave them to me. He told me that if I screwed up the floppies, then that really was the last time, and he would even take the PC away. I didn't screw those up. But I did end up reinstalling the os multiple times before too long. Eventually it got to where I only screwed things up and needed a reinstall maybe once a year. These days the interval is much longer. Anyways.... Some people learn by doing. No amount of warning or telling will do any good. I think the poster asking about how to become a trusted installer just needed to experience his mistakes to learn that he shouldnt do that. And if he needed to reinstall Windows as part of the process, the isnt that just a part of the process? FYI... I would have posted this on the the reddit, but the thread was locked.

[@mrfriendly9956]

Always fun John, thanks!

[@TuruMas-b3r]

Finally you upload John

[@roboverholt9959]

I was on the path to be a programmer, but I got kicked out of computer science in high school for getting caught having full access to the hd, bypassing the name/password.. I didn't keep up with it. I became a musician for the last 25 years and became really good at that, realizing now, If i would have continued my computer programming path, I'd be smart enough to follow all of this video, but now it's over my head.. lol.. The way he talks as if it's obvious to do this and that.. Shake my head and smile, the world is in the hands of people far smarter than I ... :)

[@MattExzy]

That reminds me, but not as technical... I forget how I did it, but late 90s high school computer class, I made the login window on NT 4.0 show up as porn. On all 30 computers in the lab. I was on the shitlist from then on.

[@roboverholt9959]

@@MattExzy I also guessed a student in another classes password, but they thought I hacked everyone's, so they made an announcement that everyone including the teachers all had to change their passwords... lol I told them the truth but they didn't believe me..

[@LabelsAreMeaningless]

It's not about being smarter, it's about taking the time to learn. Your choice if you do it or not. Sometimes it's harder for intelligent people to learn things because they're not used to hitting barriers/hurdles, so the moment they do they simply stop. Those who are used to struggling often get further because to them hurdles are the norm.

[@noanyobiseniss7462]

@@roboverholt9959 In college I was not happy that they would not give me privileges on the lab computer I worked on (6 months from my CE) and thought a simple boot locker was sufficient to secure the systems so as a joke I accessed the boot locker and turned on the screen saver function and used "Micheal Angelo at Work !!!" as the bouncing text and came back the next monday to find out they had low level formatted all the internal systems at the school! LOL what a bunch of idiots.

[@noanyobiseniss7462]

@@LabelsAreMeaningless Its more difficult for more intelligent people to learn things that do not adhere to logic such as languages. When contradictory information just boils down to rote memorization the more intelligent among us will go off on tangents to find out why and how to fix the problem rather than just memorizing and moving on. And when they figure out how to fix the problem they will find out they are running into entrenched established institutional monoliths that will fight them tooth and nail rather than admit any wrong which is the first step to addressing change.

[@logiciananimal]

At 14:00 or so - you need to presumably have to start something that will either act as a service or will do something before the service controller kills it. I thought services had a different entry point than ordinary applications, so I was surprised this approach worked.

[@l.m.892]

"Complete and unrestricted access to the computer" is not the same as "complete and unrestricted control over the computer."

[@vinzzbe]

You should be able to launch UI apps from a service (eg TrustedInstaller) when you configure the option 'allow interaction with the desktop' on the service. Windows will then ask you to open a separate user interface which in turn will show the service app on screen.

[@bastintripletroubleboys2101]

As admin you can take ownership of the folder and then remove "Trusted installer" from the permissions, add yourself as full control and then delete the folder. Alternatively I removed trusted installer as a user from the local account, which breaks all the permissions, you can then take ownership of the whole drive, obviously this is a massive security risk though. This was on the first release of windows 10, this may be harder or impossible now. The other thing this does is prevents the os from doing updates as it no longer has permission to save updates to the staging folder it uses, so if you want an update you need to do it yourself

[@djchaznyc7709]

Here specifically to spite KZbin not letting you get ad dollars on this. Great content as always. It's a nice break from my web app pentest studies

[@MrChrisRP]

Penetration testing doesn't matter when you give away the credentials or other valuable information directly in the software. Keep it in mind and keep on keeping on. Best to ya.

[@djchaznyc7709]

@@MrChrisRP I appreciate that got a code injection that allowed me to etc/passed the other night and it made me extatic

[@privatechannel1272]

There are also the "Network Service" and "Loacl Service" users, I saw that some of my services were running at those "accounts", so what are those?

[@haraberu]

"SYSTEM" has full admin privileges "Local Service" has privileges similar to a regular non-admin user "Network Service" has the same privileges as "Local Service" but it can use the computer's identity. This one is a bit complex: First off, if there is no central password management server, "Local Service" and "Network Service" are the same. Otherwise... Assuming... * You're in a university with an "Active Directory Domain Controller" server that manages the users and passwords for the entire network * There's a shared network folder Z:\ * You are logged on as user "Steve" on the PC "Library-01" Then... * GUI programs on the desktop will access the shared folder as "Steve" * "Local Service" will try to access the shared folder as a guest with no password * "Network Service" will access the shared folder as "Library-01$" Hope this makes sense.

[@privatechannel1272]

@@haraberu Thanks for the explanation 😛 Even though I didn't understand 50% of it the first time I read it, but I quess these "accounts" just exist because some software requires these special properties to work.

[@KennethKrueger-p4i]

so...if I scroll to the end of the video will I get the answer without all of the foam?

[@spicybaguette7706]

Windows: "Noooo you can't uninstall critical software it will brick your installation noooo!!!" Linux: "Hahah rm -rf / go brrrrr"

[@revival_of_the_canned_justice]

The only reason anyone would type that is if the FBI came knocking on your doors (that says a lot about you guys, honestly 🤨)

[@Surr3alD3sign]

​@@revival_of_the_canned_justiceits called a joke bruh 😐 its funny because WE all understand that unlike you apparently

[@revival_of_the_canned_justice]

@@Surr3alD3sign I know what it does, you fanboy

[@Rockethead293]

​@@revival_of_the_canned_justice they were talking about what a joke is not rm rf you unfilled water bottle

[@mikami5799]

I thought this is today’s video, you actually time travelled!

[@Zaro2008]

I think the reason notepad did not display a window because it ran in session 0 (as seen at 13:55) I wonder what would happen if you tried this in Windows 7 where interactive services session was still a thing

[@AlexLP_YT]

With windows you use the OS with linux,you *own* the OS

[@cr_cryptic]

John, I love you bro -but, I’m a little sad. Why didn’t you show them how to unlock the REAL Microsoft God Mode that comes with the OS? It takes like two minutes & everything is “on/visible” view. 🤣

[@n-i-n-o]

Or just run NSudo and run the process with TI priv

[@kristofdeconinck2917]

@John Hammond how do you do that scrolling-thingie @1:48?

[@cram000]

so it was you

[@RAZR_Channel]

"It can only be attributable to human error. This sort of thing has cropped up before, and it has always been due to human error." - HAL 9000...

[@privatechannel1272]

Does the SYSTEM and/or TrustedInstaller privilege thing run at the kernel level, or just a very high privilege level outside the kernel? 2nd Question: Are all kernel drivers and other kernel software running *in the ntoskrnl.exe process* OR *outside the ntoskrnl.exe process* in a service or something?

[@xorgfx-y4l]

for 1) trusted installer is just a dummy privilege used to own system files (think component store/winsxs and msstore) to prevent malicious modifications and accidental deletions. it isn't a security boundary and is unrelated to the kernel. ill leave 2 for someone with more expertise regarding the kernel.

[@Mavendow]

Kernel mode drivers run in the same context as the kernel, and on windows, they generally use the native Windows API. But they do not necessarily need to interact with the OS. If they're launched via a UEFI bootstrapper they can technically run entirely platform independent. They can directly interact with hardware through interrupts, PCI lanes, and unvirtualized memory addresses. They don't _have_ to, but they can. Therefore, they're not resident in any specific process unless injected. They do often operate on Windows via svchost as a service, though, since this is a simple way to manage such low-level drivers. This is why the SC command is typically used to launch them. However, note that services and kernel mode drivers are not the same thing! The kernel mode driver has far less restrictive permissions. Therefore, the service needs to be specifically configured to launch such drivers in the proper context.

[@privatechannel1272]

​@@Mavendow Thank you for the VERY detailed explanation of the second question ❤ I didn't know that drivers could be launched via a "UEFI bootstrapper". I thought that the only task for the BIOS/UEFI relating to the OS was to launch the "OS boot instruction code" (or BOOTMGR for the Windows OS), but from what I understood from your speech, there are other capabilities as well such as loading drivers.

[@Mavendow]

​@@privatechannel1272 Yes, this is how the LAN and USB works in some modern UEFIs. It would be a hassle to hardcode every individual motherboard's configuration. Drivers basically expose hardware properties to specific memory addresses that other firmware or software can hook, therefore a driver written without proprietary code can technically work in any context. Though, in the case of Windows, DLL/SYS itself is proprietary. More often these will be compiled as SO or shared objects.

[@privatechannel1272]

@@xorgfx-y4l Thank you for clearing up my ignorance 👍

[@stanislavsmetanin1307]

Always something to learn. Great job, John. Thx.

[@CoenBijpost]

That thumbnail was kind of prophetic, it seems 😂

[@NoahHornberger]

a bored guy at crowd strike followed the tutorial, I suppose

[@DaniMartVTen]

I have a legal question: (Note: using analogy here, no demand for accuracy is required to make the point.) If "Trusted Installer" is the Windsows OS owned by Microsoft, akin to an OS installed on an electric app-capable vehicle owned by the same vehicle company, the subscription service to make the car's computer work is what makes the vehicle function, the lease or owner has a no-right-to-repair clause because both the vehicle and the OS are proprietary, the same we would expect of a Microsoft computer running Windows, just like Google runs Chromebook. Ok, so just like we'll never see a truck OS on a jeep vehicle, we won't see Windows on a Chromebook, not without extensive modification and agreement between companies for such, so an agreement-to-modify exists. So....why is Windows operating a Trusted Installer limitation on non-Microsoft computers where it doesn't have authority to compel an owner to operate their computer to OS standards not designed explicitly for it? The OS must match the device for it to function, be it a vehicle or computer, in order for tangible operations to match digital limitations, whereby the digital is limiting the tangible, like how Windows wouldn't be compatible to a Chromebook inherently, the agreement to modify must prevail, with or without license? I say this because purchasing Windows OS is not requiring a Microsoft computer explicitly.

[@Surr3alD3sign]

You are, and i mean this as close to literal as possible, comparing apples to oranges here... first off trustedinstaller is not the OS, it is just a brick wall within the windows os designed to keep idiots from bricking their system and has been used to also protect their bloatware. And second do you remember the part of your windows installation where it said something to the effect of "terms and conditions" you are literally agreeing to everything they do, and a chromebook is infact designed to run on the windows os idk what tf you think it runs on, so that part of your "point" literally meant nothing. And to rain on your parade some more, if you own a computer of any kind, odds are microsoft owns some part or all of it bc they own like 90% of all computer technology atp bc they just buy out any competition. Go ahead and look up who owns all those different companies that make the parts in your computer and youll notice, unsuprisingly, that microsoft either owns them or owns a major part of their company and thus more or less owns them anyway. And imma just absolurely rip on you now for that last part "the os must match the device in order for it to function" factually incorrect as the os and the hardware are 2 VASTLY different and incomparable things, the hardware provides the body and the os provides the brain (see THATS how you make an analogy that makes sense in this context btw) the reason vehicles work differently is bc each vehicle company functions ENTIRELY inpdepandant of one another where as consumer use computers are made by many different companies all working together (and still ofc microsoft owning an uncomfortable majority of them bc they are a monopoly) so to attempt to actually answer your question is pointless bc you have a general misunderstanding of even the base concept of software versus hardware and have failed to make a question that makes any form of sense, itd be like if i asked you what your favorite color of the alphebet is, it doesnt make any sense bc thats not even remotely how either of those things work, does that kinda help guide you towards the general idea of what im trying to tell you?

[@M4N14C4L]

it's your fault, wasn't it john?

[@Jxhsxn]

why do i keep seeing these comments?? i dont get it

[@rqxk]

@@Jxhsxn we know what you did.

[@AdrianneDickenson]

@@Jxhsxnidk but based on the user of the username of the commenter, it’s a bot. And for the person who replied to you, probably just a troll

[@BenSmith-jw8zy]

i think im ben, not john smith in this tangent man...

[@AtticusF27]

Good to see you're back.

[@bohs2000]

this thumbnail has not aged well 🤣

[@CoenBijpost]

Or amazingly well!

[@WarLightning042]

what happened? I've been living under a rock.

[@saltysalt397]

@@WarLightning042watch his most recent video

[@bjangles8718]

Global computer/server outages due to solar winds endpoint security update causing BSOD on all windows machines it was pulled to. Hospitals, airlines and other critical infrastructure affected worldwide

[@khalidck17]

Crowdstrike not solar winds​@@bjangles8718

[@sent4dc]

The reason your Notepad didn't show up on your desktop is because you were running it from the "session 0" which does not have a desktop. So it was running, but couldn't display it's GUI.

[@boltez6507]

Challenge for you, try disabling the delivery optimization service without touching the registry. (i don't know about windows 11 but its pretty tough on windows 10). Also I don't even know why it can't be disabled even after taking ownership of its parent service i.e. the infamous svhost.

[@KCKingcollin]

Meanwhile in Linux the root user is all powerful, and requires none of this weird working around

[@SleepTime-Dark]

Yeah, any admin can just do "sudo su" and tad-dam! Full system acess granted, i can even delete Windows protected files mounted on Linux.

[@Spiderfffun]

@@SleepTime-Dark any way i can use rm -rf to remove depression?

[@gregorymorse8423]

The reason the service timeout errors occur is that you are running applications and not services, where service executables handle events and ate stateful based on them e.g. start, stop, pause, resume, etc

[@MotFPS]

reddit used to be a cool place to get help and meet great people. Today it's complete garbage, highly politicized, and just down right filled with wrong information. I miss old reddit before mods ruined the site.

[@christopherclea1]

Cool video I always wanted info on Trusted Installer.

[@saumyacow4435]

Windows is an absolute unfixable disaster.

[@KK-eg3em]

It's fine for plebs like me.

[@Oyakinya-Izuki]

​@@KK-eg3em Until they blue screen you or use the recall feature ;)

[@Thph793]

Bro has never heard of Advanced Run...

[@chapol2020]

Great. Had some issues with TI and at the end I forced to reinstall windoes but the path for beging forced to delete my windows was actually educative.

[@1ts_Neo]

well well well

[@mabell01]

It's a deep subject! 🙃

[@CU.SpaceCowboy]

as an admin, you could also inject your payload into a system owned process like lasass or printspooler to get nt system shell without psexec

[@uuu12343]

Classic reddit bullshit > Tries to ask how to do this to learn for education ONLY > Cue the cesspool of bullshit "DO NOT DO IT, IT WILL DIE" People, PEOPLE WANT TO LEAAAAAARN

[@x7upsuperstar]

There’s a way easier version of this. Take Ownership. There is a registry hack you can download (at your own risk), which installs a registry key that adds an extra context menu to the right click action. Right click on any file or folder and now you’ll see a “Take Ownership” button. Click it, and it strips the security permissions from the original owner (system, trusted installer, admin, whatever) and replaces the owner with your current user. This gives you full control of the file or folder without exception.

[@privatechannel1272]

That "GOD MODE" probably got many people clicking on this video :D

[@Corteum]

As you can attest! Lol

[@𠀖fecal]

this is much cool. A long time ago I found out about a process hacker addon that allowed me to run stuff with the permissions of trusted installer. It required admin access and had something to do with services. I mainly used it for tampering with old Windows drives with total commander, because my host os refused to let me into the user folders and taking ownership was not ideal. I wanna try making my own automated powershell script now

[@whiplash..777]

Linux, Linux and Linux

[@Sasquatchbones]

Parrot OS and Mint are fantastic

[@nullkv]

Tetris , tetris, and tetris

[@atorik1076]

Too many bugs and insecure asf. all hobby projects. For serious stuff NO. For fun def yes

[@KizukiKotataki]

@@atorik1076 it's fine to be ignorant on the internet, but hopefully not irl. If Linux were really to be a hobby project, it shouldn't be used as servers by Microsoft itself. RedHat literally exists, that's a hobby project?

[@vonexploits3925]

@@atorik1076how to sound like a moron

[@kriz5652]

TrustedInstaller is so called Well-Known Security Principal, it is not visible in the local SAM database and is built-in the OS

[@omegaprime516]

Your voice is amazing. You would be killer in sales.

[@SumNumber]

The way I get rid of ANYTHING I want on windows is to boot from the usb recovery disk offered by windows and then drop to a cmd prompt. I can then dir/delete/move etc anything and that includes hidden and system files as well. A great utility for browsing the windows hard drive from DOS is called Q-Dir and that would be the portable version. Another trick to have complete control of all windows files is to boot up a live Linux system from usb and browse that way with the sudo. In some instances when trying to access the windows hard drive from a Linux boot disk the windows disk will be locked and you cannot work with it. The fix , trick, is to do a restart from windows and when the screen goes blank showing windows is shut down press and hold the computer off button until the computer completely shuts down. Now boot up into your Live Linux and mount the windows hard drive . Using the root option then browse windows and do what you like! I like using a gui interface like Linux when doing operations on windows files because of all the file utilities available. :O)

[@owlsmol]

yeah I noticed. I WAS expecting a seperate video but this is perfect. Thanks.

[@Margen67]

Owls need HUGS

[@owlsmol]

@@Margen67 Indeed. :D

[@KingJeffKiller]

Could you please show us how to completely delete trustedtinstaller ?

[@naso_g]

Liked, commented and subscribed. Nice video, thank you.

[@ctr0n675]

Didn't watch the full video yet, but. If you right click your windows drive, go to security write and read, set your account to full access, you can do what ever you want with your files. hope this helps.

[@johndafuni]

THANKS FOR TEACHING ME THIS POWER, FELLOW JOHN!!

[@tarushchaturvedi]

You can't run interactive shells or gui apps because services run in session 0 which to my knowledge can't be accessed anymore.

[@Shard113]

This is sooo Microsoft. They have a long history in practically every product where admin isn't admin, removal doesn't remove, hidden and then there's extra hidden, etc.

[@GuildOfCalamity]

You can't run/launch GUIs from a service as all services are owned by terminal session 0. If did have access to that desktop/terminal then you would be able to see them, but ever since newer versions of Windows they have removed this feature since it was a security concern (there is also a registry hack you have to perform).

[@kennystrawnmusic]

Used this trick to spawn a reverse shell as TrustedInstaller on the HTB Academy WINLPE-SRV01 box. Should be interesting to see if this is allowed on the CPTS exam…

[@RomanianProductions]

If I’m not mistaken, the reason why notepad didn’t appear is because services run in a separate desktop/winstation in session 0

[@Ikmauki]

why was this so fun to leave on the background

[@Dragiux]

14:29 That's wrong. Notepad.exe doesn't implement the services interface. Same with cmd.exe, hence why you're getting the weird errors.

[@lilmaple072]

To think this is basically the Windows equivalent of logging in as sudo, yet Reddit gets so agrressive about it because you can damage shit like. Yea that's the type of file access we're looking for-

[@clarkesuperman]

I go around TrustedInstaller on systems that are low on disk space, so I can relocate the Windows Update folders to a secondary drive. The LCU and SoftwareDistribution folders can fill up very quickly and the computer will cease to update. It’s nice to be able to move those around as needed.

[@autohmae]

14:31 isn't that just hte "Interactive service" / "allow to interact with desktop" check box ?

[@timseguine2]

I actually used some of this one time. I had installed the SSD from my old laptop as a second drive in my new laptop. I had some large and important media on it so I didn't want to reformat it, because I didn't have enough spare diskspace to copy it to first. So figuring out how to dupe TrustedInstaller entries in the ACL was the only way to make the hard drive look like a normal secondary harddrive.

[@frodo4503]

Actually during windows install when you see preparing setting up services youre actually trusted installer for a moment (with mouse and keyboard suspension tho) and oobe where you setup your first account is run as NT authority/system. With right knowledge you can create account as trusted installer during preparation which leads to stealing sid and registering it as normal user. Full control over files despite a lot of bugs and apps not working correctly but a fun experiment to do.

[@throwaway6478]

You're actually LocalSystem for the early parts of OOBE, then in Windows 10 and later, it switches to defaultuser0 for the question panels. At no point are you interactively TrustedInstaller.

[@andrewphelps-q4j]

if you want to uninstall folders/files that are blocked by trustedinstaller, you just need to right-click on the file - security - advanced - then hit change next to "owner"

[@abo1428]

13:30 What if you would start it with psexec in interactive mode?

[@sumedh-girish]

The smiling blue screen isn't real, it can't hurt you. *This thumbnail*