pro hacker teaches you how to bypass this!

Bypassing command prompt and powershell restrictions tutorial.
// Membership //
Want to learn all about cyber-security and become an ethical hacker? Join this channel now to gain access into exclusive ethical hacking videos by clicking this link: / @loiliangyang
// Courses //
Full Ethical Hacking Course: www.udemy.com/...
Full Web Ethical Hacking Course: www.udemy.com/...
Full Mobile Hacking Course: www.udemy.com/...
// Books //
Kali Linux Hacking: amzn.to/3IUXaJv
Linux Basics for Hackers: amzn.to/3EzRPV6
The Ultimate Kali Linux Book: amzn.to/3m7cutD
// Social Links //
Website: www.loiliangya...
Facebook: / loiliangyang
Instagram: / loiliangyang
LinkedIn: / loiliangyang
// Disclaimer //
Hacking without permission is illegal. This channel is strictly educational for learning about cyber-security in the areas of ethical hacking and penetration testing so that we can protect ourselves against the real hackers.

[@schooldropout1337]

Kids, remember....do not hack uncle hacker loi 😎.

[@nadjehelhamza3923]

Paid to pinned the comment 😮😮

[@LeafWoT]

@@nadjehelhamza3923 jealous

[@Rockety521]

@@LeafWoT But bro's P2W

[@GoldbergToastyBred]

@@Rockety521 ?

[@ReligionAndMaterialismDebunked]

Hehe. Early in the pinned commer. :3

[@ftwgaming0]

Writing %CD% will write the writing directory into the window. If you use the set command with "%CD%> " instead of "cmd~" then you can see your directory the same way you would in a normal CMD window. If your computer doesn't allow you to use batch files directly, put them in a compressed file and run them from inside it. If that still fails, change the extension of the script file from .bat to .cmd and try the compressed folder.

[@petkov2005]

%CD% works very nicely but sadly %CD%> crashes CMD Still works better than nothing

[@ftwgaming0]

@@petkov2005 It doesn't crash if you have the quotation marks around it, :start set /p cmdin="%CD%>" %cmdin% goto start

[@alif__]

Nice info bro, thanks💪

[@ddeboy002]

like I said 95% of corp networks have this blocked via AD. If you don't you deserved to get cracked.

[@MawTaw]

@@ddeboy002 AD?

[@lantern9817]

As someone who's been coding in batch for years now, I thought this was genuinely clever. I expected the solution to be something simple like editing the registry value of the computer policies but the solution / solutions were very clever. Keep doing what you do!

[@carloautor]

Actually this wont work, because in GPO I also blocked the execution of .bat and .cmd. This all won't work

[@isymbol]

Batch isn't considerated a programming, its considerated commands

[@Alexciaooo]

@@isymbol No. It's called a Scripting language. Bash is. PowerShell is. Heck, Bash and Shell are scripting languages.

[@ReligionAndMaterialismDebunked]

​@@carloautor work./!/...*

[@ReligionAndMaterialismDebunked]

​@@Alexciaooo yeah, Bash is what you use in Linux, and a reverse shell is what you do when you want to use a TCP or other connect to have a backdoor, or consenting access.

[@iongeneral]

People need to realise that he's running CMD etc on a user account on the local administrator group. So of course he'll be able to bypass a restricted command prompt and use admin commands. It doesn't matter so long as the user account's local group is admin.

[@whattachhit]

huh?

[@That_Son_Ofa_Itch]

Even so he shouldn’t have access unless he’s the admin with the admin account. It will show some stuff but will prompt for a password unless you do a literal bypass like shown here. (or you get a request error for the admin to log in)

[@rainbowdoesinfosec]

@@That_Son_Ofa_Itch This is incorrect. There is no elevation of privilege here. He is a local administrator, but is running all of these processes in a low integrity context. Even if he wants to execute an application in a high integrity level (as administrator), it wouldn't be a problem because he is a local administrator. Granted, if UAC required a password he did not know, he would not be able to run the process as an administrator, however, this is not the point of the techniques he is demonstrating.

[@jpvoodoo5522]

@@rainbowdoesinfosec, I agree that there is no elevation of privilege as you said. However, the group policy block was in place regardless of the fact that he was a local admin. The policy restricts the computer, not the user. The only advantage his admin acct gave him is he could have simply disabled the blocking without finding a hack it if he wanted to. But he didn't for purposes of demonstration. He needed the afmin access to show you why cmd was blocked. That s, it was a setting n local group policy that disallowed anyone, including admins from running the command.

[@puerlatinophilus3037]

Back in school I pulled off the batch trick. But what worked for me too was just putting in cmd.exe or regedit into the batch file and it'd open whatever I wanted. So no advanced trickery necessary. One opportunity I missed is that they used network boot, which took forever to boot and was otherwise set up pretty well, so I wish I already had acquired the Linux skills to set up my own Raspberry Pi DHCP + tFTP PXE server. Also one interesting discovery I made: Teachers tend to have unchanged default passwords + nice power tools. What a fun time it was. I learned so much and the teachers were incredibly chill.

[@bestguywhotellsitlikeitis]

For people who actually care about stuff, the "curly thing" is called a tilde.

[@jesjames]

alt+126 LOL

[@Arley_]

@@jesjames or just shift + ` (or shift + # on uk keyboards)

[@Msantor1605]

Yea, he obviously doesn't know French.

[@Bf26fge]

You might as well call it a curly thing or pronounce the L in salmon, because nothing really matters anymore.

[@markylon]

@@jesjames it's there ON THE KEYBOARD LOL

[@Omena0]

Well i dont need to bypass cmd restrictions, since my school / city administration was so smart to block dark mode but not cmd 😂

[@galaxys8-ml]

Why did they block dark mode?

[@Omena0]

@@galaxys8-ml idk bruh it just says its blocked by my organization lmao

[@_SebJ1000]

My school was smart enough to block CMD, group policies settings and Task Manager but totally forgot about powershell and bat scripts so me and my group of friends have been using that to our advantage.

[@Coblasteus]

Your school wants to blind you My high school in Australia, the laptops they give me, they can both run cmd and use dark mode (we can even use Task Manager). All of this stuff was disabled at primary school for some reason.

[@xMdb]

@@Coblasteus EQ?

[@boo5274]

In high school, I would boot into recovery mode, go into the system files copy the command prompt from inside system32 and rename it to the sticky keys app. Then rebooting, I would simply activate sticky keys with the shift key and cmd would pop up in system32 dir. I would have complete control of the system from there.

[@rainbowdoesinfosec]

You're already an administrator, which assumes you have way more rights than you should. This is great if you already have that level of access, however, you have much more capabilities and you could have disabled the GPO if you wanted to. The "bypasses" work, but are pointless if you do not already have Administrative control over the system. This may only be useful if you were able to drop a stage-0 payload onto a machine, elevate privileges, then execute a shell. The only real use case here is being able to execute commands on a system where you have GUI access as an Administrator. Great examples of this are kiosks in public areas, or an open VNC/Remote Admin connection (ex: AnyDesk). Still a very interesting video! Good work! I don't mean to diss the content, just informing everyone of the assumptions you need to make.

[@infinitybrutal]

That's What We Need 🙃 We Don't Need AWS tutorial

[@Miguel-pe]

This batch file is a simple script for Windows that creates an infinite loop that allows the user to repeatedly enter and execute command line instructions. Here's what each line does: 1) The first line "@echo off" simply turns off the echoing of commands to the console, making the script more concise. 2) ":a" creates a label called "a" which is used for the infinite loop. 3) "Set /p comm=cmd~" prompts the user to enter a command and assigns it to the variable "comm". 4) "%comm%" executes the command entered by the user. 5) "Goto a" returns the script to the label "a" to start the loop again. To use the script, simply run the batch file and enter commands as you normally would in a command prompt. The script will keep accepting and executing commands until you stop it by pressing Ctrl+C or closing the command window.

[@revelati_n]

sounds like a chatgpt response

[@Miguel-pe]

@@revelati_n It is, I just copy and pasted.

[@mistie710]

The one thought that comes to mind here is the level at which you start at when you try to do the things in this video. If you are not at the administrator level for your local machine, you may find editing the group policy a bit tricky, especially given that it may be updated as part of the login process, so it reverts to its original settings if that's the way that your domain admin wants it. Personally, what I tend to do is run the command that I need from the Run box, for example if I want to run a directory listing, I'd open a run command (Win+R) and type in cmd /c dir && pause (the "&& pause" stops the output from disappearing). This is especially the case where the domain admin has also restricted using executable files such as batch files, PS2 files and so forth.

[@tooru]

cmd /k dir and no pause

[@joshoneill9676]

My run command is restricted any way to bypass it?

[@Oktokolo]

He edited the group policy to demonstrate how the "restrictions" are enabled.

[@joshoneill9676]

@@Oktokolo yes i know. That isn't what i asked though LOL

[@Oktokolo]

@@joshoneill9676 Wasn't meant to.

[@npsit1]

GP editor only works if the machine user is local. This won't work for domain accounts. Also, there are lots of reasons to block executing programs on computers that belong to an organization. Mostly security. Second, it keeps people from screwing up their machines and causing more work for their IT departments who are probably overworked already.

[@stubro25javee34]

Unless there from India and don't have a clue how to fix or block anything.

[@Synclon]

We need to acknowledge this man, remember he does this For free just to teach us! Thank You Mr Loi And Keep up The Content ❤

[@MrSlosky]

he gets money on videos,

[@ReligionAndMaterialismDebunked]

​@@MrSlosky true. :3

[@JayThaaGamer]

He's still teaching free no matter how you put it, revenue from YT content is just an token of appreciation!

[@daartistboi]

Can't wait try this at school on Monday

[@jackrogers1115]

You won't be a local administrator, so this video is meaningless. Not system admin is going to disable cmd for your profile but leave you a local admin....

[@nittani.]

​@@jackrogers1115 tf

[@godofwisdom3141]

@@jackrogers1115 It still works

[@shadowrl7637]

@@godofwisdom3141yes it will work. What he saying is you have local admin access to the user you’re on. Not any other users.

[@taikomadeitt]

It’ll still work

[@R.B.]

Back in college, some malware had taken over a lab machine and changed the registry so that the computer couldn't open exe files. I used a doc file to open Word. Then I used VBA to open regedit. Finally I was able to fix the regkey and regain access to the machine. Appending something to the end of the exe was a technique I hadn't seen before, but most of these were ones I have used as some point for legitimate reasons. Knowing how your machine works is key.

[@markylon]

Knowing how to NOT get MALWARE is even KEYER!!

[@R.B.]

@markylon sure, which is why I didn't get infected when I used the lab machine myself. I did save off the class files in an inactive format to dissect it later, but it wasn't all that clever.

[@GarfieldIsEpic]

You can actually just enable cmd through the registry by changing a single value. It is much easier than what this tutorial entails and doesn’t require access to the group policy editor. Good video none the less!

[@whohan779]

I don't think an administrator who'd block CMD would allow regedit (though there are of course also exploits & simply third-party programs, so true control is basically only possible through a whitelist [the extreme of that would be an update S-mode that's actually unexploitable]).

[@GarfieldIsEpic]

@@whohan779 Not sure about other circumstances, but I have only managed to enable it through the registry on my school laptop, which blocks almost every single administration program available on Windows. I’ll try it on a different restricted device and give you the results.

[@lightyagami1752]

The option to disable registry editing is right below that for command line disabling. It would be a terrible sysadmin that disabled one but not the other. Besides, registry hacks actually change saved system settings, and you have to remember to undo them to cover your tracks. With this, it's as easy as Ctrl-Deleting shortcuts from the desktop.

[@pyco374]

ive been working on a project on the school computers that uses python to pretty much do the same as this, but add extra commands to access public desktop, C:\ drive etc. and its cool to see how it could all be implented in batch

[@dovyyz]

Or if bios has no password(can reset with cmos but not always will work or remove cmos for a long enough time for conductors to lose power).just boot into strelec and admin password is gone. Also you can modify ease of access button to give you adim cmd or change registry. So many ways to crack a windows user.

[@Waludalf]

That's nice 🙂 Now, teach us how you change all the without having administrative permissions already on the account, would be very interesting :)

[@DDBAA24]

that video really turned a corner at one point, useful more advanced information. Plus you showed a way that would stop most people, good cop bad cop. Not bad.

[@MigProPlayer]

This video remembers me of what I did in IT class yesterday: Booted up HBCD PE from my usb stick created a new admin account, installed some programs, and played around with the settings (my school does not even let me change the desktop background, but cmd is alright 😎)

[@smilyreal]

i managed to do smth similar, if you make a batch file with the commands you want then ass pause at the end, you can easily bypass it

[@ModernSatyr]

You could easily disable the ability to edit that by adding a deny entry for take ownership, and make the keys in the registery deny everything else but read. Additionally you could create a second user group that denys the Backup & Restore Privileges to people in a group, which would override the privileges and since deny takes priority over allow this would be an effective block.

[@Rightly_Divided]

Yup. This is really helpful! As an Admin this is very useful information.

[@shadowi8403]

Still says command prompt is disabled by administrator and also they have it to where you can't view group policy editor

[@OneAndOnlyMe]

Most tools these days have portable installation options. Even Powershell can be installed as a portable install.

[@Grump.y-OldMan]

Hacking is only illegal if you get caught 😅

[@ndongedwin2455]

Hello greetings please can you help me hack an apk

[@ndongedwin2455]

Hello greetings please can you help me hack an apk

[@Nocommentsuwu]

Hack or die poor

[@LitoMike]

@@PH7NTOM yes indeed

[@Gxro_Bo2]

yea, but there is a 50m hacker, probably, and scammers with a pc id changer, which is called spoofer

[@JohnMatthew1]

I'm a huge CMD guy and this is very clever!

[@hold-ulv3552]

thanks for making this video as it has helped me to bypass my schools rules so i don't need to ask my teacher every time i need to install something

[@ravenhoodcat9421]

There are many ways to get around the local group policy to read data. However, it really isn’t of much value on your work computer. Especially as a standard user with those local policies overruled by Active Directory Group policy.

[@reefhound9902]

Of course, bypassing company restriction policies is a good way to get summarily fired.

[@davidayres7973]

The "wiggly line" if My awful GCSE Spanish is remembered correctly is called a Tilde. 😂

[@wombatdk]

And this is the fastest way to get fired. As, every so often, new hires find out the hard way. No warnings, no second chances. Mess with work equipment, find your ass out on the curb.

[@arturhavrylov]

If you need command line/ powershell you probably will figure out how to start using it. If you need command line often you will probably switch to Linux/Mac. If you regular user you will never need these tools

[@francinedematos1145]

Now show us how you elevate all those terminals you showed with a no admin user to do something really interesting.

[@user-ht2rl7rw3t]

Hello.the new style of filming and the background music is Awesome,I like it👊👍

[@davidjonsson7165]

Sweet stuff! Now do it from a user that isn't a local admin on the computer.

[@swager1950]

Wow so much fun and good food for the Brain . Now I have one probelm on window 10 . That is I can not access the ( local group policies ) it send me on a web page that tell me how to do it ..... and them pages look suspicious >.....

[@xanth592]

Pro tip: ctrl key and scroll wheel will change font size quickly

[@deathybrs]

Wow, this is the first time I've even SEEN that.

[@jacesullivan4563]

That curly thing is called a tildar

[@Sadoxx360]

Hey, thanks for this video it showed me I need to reinforce security in my infrastructure. Is this actually something we can mitigate or is it a design problem ?

[@ch3007]

Remember, if this is your work computer, we’ll find out and get you fired. -Your IT Dept 😊

[@BaKa60gaming]

but does this work if you don't have admin right?

[@xnetpc]

How are any of the things you demonstrated considered hacks when you were logged in with an administrator account?

[@BPGHchess]

.bat files are also blocked by administrator including all group policies settings.

[@ftwgaming0]

Place it in a compressed folder and run it from inside the folder.

[@piggynatorcool668]

@@ftwgaming0 no nothing can be named .bat with that setting

[@ftwgaming0]

@@piggynatorcool668 I do it all the time to get around my school blocking it. 1) Create a compressed folder. 2) Create the .bat file normally. 3) drag the .bat file into the compressed folder. 4) Open the compressed folder. 5) Run the .bat file from inside the compressed folder.

[@pessoaanonima6345]

What about .cmd and .ps1?

[@piggynatorcool668]

@@ftwgaming0 somebody already hacked the network and it's costed millions to fix so they cracked tf down and you can't do ANYTHING on any of these computers anymore without admin

[@melomelo420]

school's computer room after i know this: kaboom

[@wheighdeighms]

The thumbnail looks like he's the one who got hacked lol

[@stretchlindsay3547]

I'm an old fella and have had a huge interest in computers and systems. Just never had the time to learn. Would love to know more and learn more. Sad thing is, now a lot of the time some people will need to know how to hack, just to get admin control of their own pc's OS system.

[@Erole]

Fun fact about my school: They blocked cmd but not powershell (and Powershell automatically launch into administrator

[@tejasraman6913]

I tried to block cmd and posh at my old (small private) school (I was the only IT person and a student). I knew this trick, so I blocked running batch scripts altogether :D

[@SOTP.]

you're lame

[@rabbitdrink]

i remember i wrote this but instead of saying cmd~ i used this one variable that always has your current directory (i forget which one) and it would show me where im at

[@SOTP.]

"%cd%>"

[@evanmitchell1587]

This guy is the Asian GarandThumb.😂

[@_tanzil_]

OMG. Such a genius. Now i can get access to my office computer 😜 But there's a firewall they have in their backend server and that's why I can only access limited websites.

[@irbaboon1979]

There’s always a way… :)

[@UserSOF0]

i can accsses the cmd but some codes require admin pwd and i cant edit group policy any solution?

[@victorvarsanyi6702]

I seem to recall bypassing cmd being disabled using msoffice scripting tools and calling it from there.

[@zakariya2011_]

When a hacker shows you how to bypass malware infection XD

[@icebice]

I guess this is why you whitelist (hash) all the necessary applications that the user is supposed to be able to use in a company environment. I could see a workaround of that too by finding ways in those said programs to execute a DLL file but I'm not sure how much you can actually do even if you execute your own code in a guest environment!

[@mabec]

ctrl+mouse wheel to increase/zoom in in cmd :)

[@davthemillionth]

I've been known to bypass this at school using the python subprocess library in thonny on my school's computers

[@Z25O]

"He's a hacker he's a Chinese hacker" "Lumfaow"

[@devuxious]

Racist

[@JustAPersonWhoComments]

Pro hacker teaches us how to hack into our own memories and find all those embarrassing moments we desperately tried to forget

[@devuxious]

Yes you have embarassarment in your childhood Lol

[@Lofote]

None of these hacks will work with a proper domain policy and AppLocker whitelisting however ;)... Of course user mustn't have admin rights and the C: drive needs to be BitLocker encrypted, then you will get a pretty good protection - IF the admin wants you not to use CMD or PowerShell (which I see no problem in anyways).

[@johnmckown1267]

The "curly thing" ~ is a tilde.

[@devuxious]

🤓

[@Hayumakan]

How to check if our phone has been hacked? How to erase or delete? Can it be deleted or restore if we did factory reset?

[@internetparrot9753]

yeah but at my school they don't allow the execution of batch files

[@kirb2423]

my school doesnt even have secuirty for command prompt LOL, all i do is enter my school account and password and IM IN.

[@InsideOfMyOwnMind]

I'm so grateful that I don't have to go through all of these shenanigans to get my PC to do what I want it to do.

[@markylon]

But it's NOT your pc is it?

[@InsideOfMyOwnMind]

​@@markylonAre you 12?

[@markylon]

@@InsideOfMyOwnMind Are you thick? F00l

[@abubackeryt7569]

can u make a vid to bypass admin restrictions on downloading software

[@ExceededTag6048]

somebody save this please so that if KZbin deletes it there is still a copy

[@kjthreehundred8911]

Microsoft would have paid you 6 figures for this. You cold as ice Loi

[@Cosmos42011]

His voice changer is like listening to an Indian professor try to explain math with his thick accent. You just can’t understand.

[@Kryptiical]

So many time's I've been on a server and CMD is disabled for security hardening but powershell is still available.

[@imlohst]

Hey, what if something in the pc makes an application like terminal or settings close instantly before even doing anything. Is there a way to bypass that?

[@Mavo1989]

I got a better way to just take the whole machine... Create a PowerShell profile save it in a default PowerShell $pshome in the profile in the profile give set it to run PowerShell as admin and set the execution policy to bypass Use notepad write yourself a PowerShell DSC profile for the computer with base level requirements of the PowerShell version on the machine generally PowerShell 5 save it as a .mof file and put it in the C:\Windows\System32\Configuration\ with the correct security DSC settings in your config mof you will now be able to control and modify the whole machine...

[@zergo.z1]

my school has blocked EVERYTHING except powershell which always runs as administrator lol

[@WhoWatchesThis]

So... quick question... i tried this and it didnt work on my work computer. (I was gonna report it as an exploit if it worked). Within a couple hours my internet was cut off and by the end of the day they took away my work laptop... they suspended me while they launch an investigation. Additionally, after the exploit failed, i also toyed around with the commands, using something to the effect of net user password {password here |*} several times. It would cause my prompt to close. Is this something that IT would immediately detect and get really spooked by?

[@lilyxenos2380]

When I was younger, my friends and I used to type up scripts that would open itself endlessly until it crashed the computer and then put it in the boot file of school computers. Thought it was funny back then, now I feel bad for the IT guys that had to deal w it

[@pauldeacon6123]

Great stuff but this wouldn't work in a production environment with systems that are provisioned by your IT. Just take this as a knowledge base.

[@wysjen09]

Question: what do i do if i cant access group policy manager?

[@Panacea9]

I actually did figure out how to crack programs myself and knew no one talking to me [on irc] ever knew how to explain it. (I'm not a wise at this though, it is interesting but not my favourite thing. I appreciated people that love it because I saw the creativity) Yes, selling a line and its lack of knowledge is embarrassing and takes confidence in yourself. Presenting yourself as unseeing or having a deficiency in an area you actually love is actually very tough. A big part of you wants to talk about it and wants to share it. You lose a big part of yourself as it could have been your primary way of connecting to others, making it difficult to feel you actually have a relationship to the people you are talking to or wanting to befriend. It is always hard to find other ways to make an actual connection with someone else if you have lost a primary way of bonding with another.

[@Panacea9]

"The better you get, the less people see." Yes. You can apply this statement for coding in backdoors into programs as well as apply it to tricking.

[@WhoWatchesThis]

Interesting stuff but what if local group policy editor says access denied lol

[@realm0dev515]

Me when making a usb full of viruses to plug into other people's computer: 😆

[@kramsterious6182]

I love watching your video it's better than listening shitt at school in 1 day I learned a lot in just watching your video

[@P0LAR07]

My school disallowes running of executables except from specific locations, is there anyway to get around this?

[@ezedjay]

You can also, on some versions of Windows just type command instead of cmd when it's disabled by your administrator. Can't remember which. Prob XP and/or some versions of MS Server Either that or the admin did a bad job 😂and didn't disable command.

[@imlohst]

What if they blocked local group policy application aswell?

[@SamuelKB.000]

Bruh the way he just renames powershell and it became unrestricted lmao

[@SOTP.]

lmao thats so dumb

[@parabolaaa]

him: im a haker also him: *uses windows*

[@MaMo盒]

does any linux distribution have cmd like in windows i think not

[@DinkyDog-hk2ws]

how would i be able to launch task manager this same way, i tried simply replacing "cmd" with "taskmgr" but it only opens a blank cmd panel that you cant interract with

[@lux-music6321]

Lol, I've bypassed this with a batch script years ago already, and it still works.

[@mike_gread]

i actually figured the first back in high school when i was 13 but some commands don't work, idk why

[@raypist123]

how do i give myself administrator role

[@SOTP.]

get root acces, which you can either by booting off a windows pe usb drive, or going into recovery screen then cmd. Replace sethc.exe in system32 by cmd.exd, reboot Press shift 5 times on the logon screen to open a command prompt Type net localgroup /add administrators "username" Enjoy

[@shakhwand4158]

Do a vid abt "Digital footprint!" Please

[@holdulv]

thanks for making this video. i learned a lot by just watching your videos thanks a lot btw i liked and sub

[@VenRoot]

Windows is such a joke lol

[@coderforth6745]

For me creating a batch file with "start powershell.exe" worked, I found this out like 2 years ago at my school and It was amazing.

[@woodwalker6025]

I have an old laptop with windows XP on it. Its admin password is locked. It would be cool to see whats on my teenage laptop. Any help getting in would be much appreciated

[@gamingtsunami6928]

wow the way you explain the art of hacking is just great.