Well, there’s no reason why you’d really want to do this, unless you were up to no good, or are a security engineer. But we don’t agree that knowledge is bad, we agree that the people that use it for wrong are the ones to blame =).
So if you will do bad or break the law by reading the following, then it is entirely your own fault! We take no blame.
Any way, what this exploit does is allow any user (Including the Guest account) to get logged on as the SYSTEM account. The SYSTEM account is above even administrator. Once in you can change passwords, see all files etc etc. The problem with this is that it only works on XP, it has been fixed for Vista.
All that you will need for this exploit is access to command prompt (Or really, to execute commands, which can be done easily), and access to the at command.
Now, for the record, I’m logged on as “Administrator” for this tutorial.
Step 1:
Click “Start” >> “Run“.
Step 2:
In the Run command Textbox, type “cmd” to bring up the Command Prompt window.
Step 3:
In the Command Prompt window type:
at time /interactive “cmd.exe”
Where time is the time plus one minute. So in my example the time is 4:16PM, I typed into the Command Prompt Window:
at 4:17PM /interactive “cmd.exe”
Since 4:17PM is one minute after 4:16PM.
If you get the error “Access is denied” then you’re out of luck. The network administrator has disabled the at command.
Step 4:
Close Command Prompt and wait…
…
When the time that you set has come, you will see another Command Prompt Window come up.
You will notice that the title is no longer “c:\windows\system32\cmd.exe” but instead “c:\windows\system32/svchost.exe“.
This is good!
If it hasn’t come up then go back to step 1.
Step 5:
Almost there, this is the fun bit!
Without closing the new Command Prompt window, press Ctrl+Alt+Del and bring up task manager.
In the processes tab you will see a process called “explorer.exe“. Right-Click that and select “End Process Tree” from the menu.
Everything should now dispear, including the start bar, everything! Except for one thing… The Command Prompt window.
Step 6:
Simply type “explorer.exe” into the Command Prompt window and press enter. The start bar, and everything else should return.
Step 7:
Once everything has come up, click on “Start“. You will notice something very awesome…
You are logged on as SYSTEM! You have full system rights too (To that local computer).
Enjoy!
Mail this postPopularity: 35% [?]
Posted under Hacking, Security, Tutorials
This post was written by Slyke on October 21, 2008












