Meltdown: Deep Freeze Password Recovery

Introduction

This tool exploits several design flaws in Faronics DeepFreeze products and allows user gain access to DeepFreeze configuration interface. Full source code is provided, feel free to use it and abuse it in any way you like.

What is DeepFreeze

Faronics Deep Freeze helps eliminate workstation damage and downtime by making computer configurations indestructible. Once Faronics Deep Freeze is installed on a workstation, any changes made to the computer - regardless of whether they are accidental or malicious - are never permanent.

Using Meltdown

Just run it! It's that simple. Meltdown will automatically detect if DeepFreeze is installed, which version it is and whether it is Standard or Enterprise edition.

Standard Edition

When Meltdown detects DeepFreeze Standard Edition, it will automatically determine and show DeepFreeze password.

Enterprise Edition

When Meltdown detects DeepFreeze Enterprise Edition, it will try to locate dfc.exe which is installed in SYSTEM32 folder. Then it will extract "Customization Code Hash" - 32bit integer that uniquely identifies Deep Freeze deployment.

The Customization Code is a unique identifier that encrypts the Configuration Administrator, the Enterprise Console, the computer installation files, the One Time Password Generation System, and Deep Freeze Command Line Control.
Once Customization Code Hash is recovered, Meltdown will be able to generate One Time Passwords. To do that:
  1. Open DeepFreeze Client:
    If the Deep Freeze icon is shown in the System Tray, hold down the SHIFT key and double-click the Deep Freeze icon. If the Deep Freeze is running in Stealth Mode and if the Deep Freeze icon is not displayed, the keyboard shortcut CTRL+ALT+SHIFT+F6 must be used to access the logon dialog.
  2. Write down OTP Token:

  3. Enter OTP Token in Meltdown and press Generate. Meltdown will generate password for you:

System Requirements

I tried to make it as compatible as possible with different systems and keep it user-friendly at the same time. Unfortunately, compatibility requires some sacrifices..

Recovering permanent passwords for Enterprise edition is not supported (as it would require recovering Customization Code Hash anyway). Use the provided One Time Password generator instead.
Some older versions of DeepFreeze (7.00..7.20) check process name. Meltdown executable must be named MeltdownDFC.exe to work properly on those systems.

Credits

I would like to thank previous researchers who published their findings: