Escalate self to system (XP Only)

Well, there’s no reason why you’d really want to do this, unless you were up to no good, or are a security engineer. But we don’t agree that knowledge is bad, we agree that the people that use it for wrong are the ones to blame =).

So if you will do bad or break the law by reading the following, then it is entirely your own fault! We take no blame.

Any way, what this exploit does is allow any user (Including the Guest account) to get logged on as the SYSTEM account. The SYSTEM account is above even administrator. Once in you can change passwords, see all files etc etc. The problem with this is that it only works on XP, it has been fixed for Vista.

All that you will need for this exploit is access to command prompt (Or really, to execute commands, which can be done easily), and access to the at command.

Now, for the record, I’m logged on as “Administrator” for this tutorial.

Logged on as "Administrator"

Logged on as

Step 1:

Click “Start” >> “Run“.

Step 1

Step 1

Step 2:

In the Run command Textbox, type “cmd” to bring up the Command Prompt window.

Step 2

Step 2

Step 3:

In the Command Prompt window type:

at time /interactive “cmd.exe”

Where time is the time plus one minute. So in my example the time is 4:16PM, I typed into the Command Prompt Window:

at 4:17PM /interactive “cmd.exe”

Since 4:17PM is one minute after 4:16PM.

Step 3:

Step 3:

If you get the error “Access is denied” then you’re out of luck. The network administrator has disabled the at command.

Step 4:

Close Command Prompt and wait…

When the time that you set has come, you will see another Command Prompt Window come up.

You will notice that the title is no longer “c:\windows\system32\cmd.exe” but instead “c:\windows\system32/svchost.exe“.

This is good!

Step 4

Step 4

If it hasn’t come up then go back to step 1.

Step 5:

Almost there, this is the fun bit!

Without closing the new Command Prompt window, press Ctrl+Alt+Del and bring up task manager.

In the processes tab you will see a process called “explorer.exe“. Right-Click that and select “End Process Tree” from the menu.

Step 5

Step 5

Everything should now dispear, including the start bar, everything! Except for one thing… The Command Prompt window.

Step 6:

Simply type “explorer.exe” into the Command Prompt window and press enter. The start bar, and everything else should return.

Step 6

Step 6

Step 7:

Once everything has come up, click on “Start“. You will notice something very awesome…

Step 7

Step 7

You are logged on as SYSTEM! You have full system rights too (To that local computer).

Enjoy!

 Mail this post

Popularity: 35% [?]

Posted under Hacking, Security, Tutorials

This post was written by Slyke on October 21, 2008

Change any password on your computer without knowing the original one.

Have you ever forgotten the password to one of the accounts on your computer? You wish there was some way to get back into it to get back all your files and settings?

Well you’re in luck today!

Just follow these steps, and you’ll be back in in no time:

Step 1:

Click the start menu and open up “Run”, Vista users can just type “Run” into the search field.

Step 1

Step 1

This will open up command prompt.

Step 2:

To get a list of the users currently on your computer just type “net users” into the command prompt screen.

Step 2

Step 2

Or in my case:

Step 3:

From here you can change the password easily. Here’s an example:

net user administrator *
net user “John Doe” *

Or in my case:
net user “Slyke” *

Step 3

Step 3

You will be asked to enter in your password twice.

You won’t be able to see what you’re typing (Not even the password mask stars come up). So make sure you get it right, twice.

Step 4:

Here’s a screen shot of what it will look like if you’ve done everything correctly:

Step 4

Step 4

Step 5:

Logoff and then try to login with the account that you just changed the password for!

 Mail this post

Popularity: 66% [?]

Posted under Hacking, Security, Tutorials

This post was written by Slyke on October 18, 2008