66 Windows Sticky Keys Attack
Braedyn Case
Sticky Keys is a Windows accessibility feature that lets you press keyboard shortcuts (like Ctrl + Alt + Delete or Ctrl + V) one key at a time instead of holding them down simultaneously. When you tap a modifier key (like Shift, Ctrl, or Alt), it “sticks” electronically until you press your next key. The Sticky Keys attack is a technique used to gain system-level access without a password. This attack is well-known and fairly old; it can still be used to gain unauthorized access to many modern machines today.
This lab involves using the Windows command line, and incorrect commands can permanently damage your VM so please proceed with caution!
Phase 0 – Professional Alignment
Enterprise security depends on protecting both logical and physical access to information systems. In this chapter, you will examine the Windows Sticky Keys attack, a historical privilege escalation technique that demonstrates how physical access and operating system recovery features can be abused to bypass authentication. These activities reinforce the importance of securing endpoints through full-disk encryption, secure boot processes, physical security controls, and system hardening to prevent unauthorized administrative access.
DCWF Work Roles
The knowledge and skills developed in this chapter align with the following Department of Defense Cyber Workforce Framework (DCWF) work roles:
- 451 – System Security Analyst
- 541 – Cyber Defense Analyst
- 531 – Systems Administrator
NICE Work Roles
This chapter supports competencies associated with the following NICE Workforce Framework for Cybersecurity work roles:
- Cyber Defense Analyst
- Systems Administrator
- Vulnerability Assessment Analyst
Professional Skills
By completing this chapter, you will begin developing the ability to:
- Evaluate operating system authentication mechanisms for security weaknesses.
- Demonstrate a historical privilege escalation technique within an isolated laboratory.
- Assess the security risks associated with physical access to enterprise systems.
- Identify operating system features that can be abused to bypass authentication.
- Recommend security controls that mitigate local privilege escalation attacks.
- Document security findings and mitigation strategies to strengthen enterprise endpoint protection.
What You’ll Be Able to Do
After completing this chapter, you should be able to:
- Explain how the Windows Sticky Keys attack bypassed authentication on vulnerable systems.
- Demonstrate the attack within an authorized laboratory environment.
- Analyze why unrestricted physical access increases enterprise security risk.
- Identify operating system and hardware protections that prevent this class of attack, including full-disk encryption and secure boot technologies.
- Evaluate the effectiveness of modern Windows security controls against local privilege escalation techniques.
- Recommend enterprise hardening measures that reduce the risk of unauthorized physical access attacks.
LEARNING OBJECTIVES
- Explore weaknesses in the Windows Recovery feature.
- Gain system-level access without a password.
PREREQUISITES
DELIVERABLES
- Research and write a few sentences about how to defend against Sticky Keys.
RESOURCES
- What is Sticky Keys?
CONTRIBUTORS AND TESTERS
- Antionette Hults, Cybersecurity Student, ERAU-Prescott
- Mathew J. Heath Van Horn, PhD
NOTE: This lab exploits the out-of-the-box weaknesses of Windows 11 HOME; it will not work on Windows 11 Pro. To make sure that you can complete this lab, please make sure that you are running Windows 11 HOME by clicking the Windows Key + R and typing winver to check your Windows Version inside your virtual machine. If you want to use Windows 11 Pro, or can’t get access to a Windows 11 Home virtual machine, ensure that BitLocker is disabled on the target virtual machine.
Phase I – Prepare the lab
Enter the Microsoft Windows Recovery Environment.
- Start with a Windows Home VM running in VirtualBox,
- Start the Windows VM
- From the Windows lock screen, go to the bottom right corner and click on the power icon
- Hold Shift and click Restart to enter the Recovery Environment
NOTE: Sometimes when entering the Recovery Environment in VirtualBox, the VM gets stuck on a black screen. If this happens, go to the top of the VM window and click Machine > Reset to proceed.
Figure 1 – Restarting from lock screen Phase II – Exploit a windows weakness
Use the Recovery Environment Command Prompt to exploit a weakness in Microsoft’s Accessibility tools (In this case, being sticky keys).
- Once in the Recovery Environment, click Troubleshoot> Advanced Options > Command Prompt
- Once in the command prompt, enter the two following commands
- When prompted to overwrite C:\Windows\System32\sethc.exe type Yes
Figure 2 – Entering commands in Recovery command prompt NOTE: Windows Pro has BitLocker enabled by default, which would cause these commands to fail because the disk is encrypted. Windows Home doesn’t come with BitLocker by default, making devices running Windows Home vulnerable to this attack.
- Type exit to leave the command prompt
- Once out of the command prompt, click Continue to go back to the Windows lock screen
- Once on the lock screen, press the Shift key 5 times and wait for the pop-up to appear. You will notice that instead of the normal sticky keys prompt, a command prompt will open
- type whoami into the command prompt “nt authority\system” should appear
Figure 3 – Command Prompt in lock screen Phase III – Create a new user
We will now use the system account nt authority\system to create a new user and grant them administrator privileges, providing us with full access to the virtual machine.
- In the open command prompt type in the following commands to create the new user “Sticky” with the password “Test” then assign them as a system administrator
-
net user Sticky Test /add
-
net localgroup administrators Sticky /add
- Type exit to leave the command prompt
Figure 4 – Entering commands in elevated command prompt
-
- Restart the Virtual Machine by clicking Machine > Reset
Figure 5 – Restarting VM - Once the Virtual Machine restarts, go to the login screen; in the bottom left, there should be a new user called Sticky—click on Sticky and sign in using the password Test
Figure 6 – Login as Sticky - Upon sign-in, follow the Microsoft Out-Of-Box Experience until you arrive at the Desktop, then navigate to Settings
- From Settings go to Accounts, the user Sticky will show as an Administrator giving full access to the virtual machine
Figure 7 – Newly made Sticky user with Administrator privileges Phase IV – Restoring the system to default
Restoring the Stick Keys’ default behavior.
NOTE: This is the end of the Sticky Keys lab exercise. The next steps are only to restore sticky keys functionality and aren’t a part of the attack.
- From Settings, go to System > Recovery
- Find the option called Advanced Startup and click on Restart now
- Once in the Windows Recovery Environment click on Troubleshoot > Advanced options > Command Prompt
- Type in the following Command to restore sticky key functionality
- When prompted to overwrite C:\Windows\System32\sethc.exe type Yes
- Type exit to leave the command prompt
- Click on Continue to go back to the Windows lock screen
- Spam the shift key 5 times and the normal stick keys pop-up should appear
Figure 8 – Normal Stick Keys pop-up
Career Connection
Understanding historical attack techniques helps enterprise security professionals recognize why modern security controls exist and how they should be implemented. Systems administrators, cybersecurity analysts, and incident responders routinely evaluate endpoint security configurations to ensure that authentication mechanisms cannot be bypassed through physical access or recovery tools. The skills developed in this chapter reinforce the importance of combining operating system hardening, encryption, firmware security, and physical access controls to protect enterprise systems from local privilege escalation and unauthorized administrative access.
End of Lab
