Guide to: Getting Admin Access on any Windows XP box
Wednesday, November 23, 2005
How to guarantee local Administrator access to any Windows XP box
In this tutorial I will discuss a number of different methods to gain admin access to any Windows XP system. The
only catch is, you have to have physical access to the box. I've set it out into sections and each method should
be tried in order, i.e; from the beginning of the tutorial to the end.
Contents
1 Safe mode methods
2 Normal logon methods
3 Recovery Console methods
4 Logon.scr method
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Section 1 - Getting admin access using Safe Mode
The scariest part about this method is the fact that 80% of XP machines don't have an Administrator (Domain
Controller) password. Yeah, you heard right. 80%. In saying that, we can boot the target machine up into Safe mode
and try logging in with "Administrator" as the username and leaving the password blank. This will be the end of
the road for most of you readers as this method is the most likely to work. If this method doens't work for you,
skip on down to section 3 - your PC is likely to be harder to break into than the usual XP childsplay box. What to
do once you're in? Well generally the trend seems to be adding yourself to the Administrators usergroup. But first
you need to make yourself an account. To do this go into the control panel and navigate your way to Administrative
Tools >> Computer Management >> Local Users and Groups >> Users. Right click in the white space on the right hand
side and select New User, add the details and be sure to make yourself a member of the Administrators usergroup.
Control Panel --> Administrative Tools --> Computer Management --> Local Users and Groups --> Users.
If you already have a username, you'll see it in the list on the right hand side, right click on your username and
go Properties. Click the "Member Of" tab up the top, now click the add button and choose Administrators.
You're now an administrator!
(If that wasnt like handing candy back to the baby, give up now 'cus you wasnt cut out for all this pc stuff)
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Section 2 - Getting admin access using the Normal Login prompt
Note: If you're machine is running a Novell Client, the follwing will not work. Instead - to logon to the local
machine only - there should be a checkbox at the bottom of the client, something like "local machine" or "this
machine only". Make sure it's checked. Yep, you guessed it. This method is almost identical to the Safe Mode
method, the only thing different is a neat little trick I learned. You know when you boot into XP normally and all
you get is the normal usernames to login as? Well those days are over. Give you're machine the three fingered
salute (ctrl + alt + delete) TWICE. Hello, we've now got a login where we can attempt to login with any username
we like. Type in "Administrator" as the username and leave the password blank.
See Section 1 - Getting access using Safe Mode for instructions on what to do once you're in.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Section 3 - Getting access using the Recovery Console
For this method to work you'll need to have access to a Windows 2000 Pro setup disc. We'll use this to run the
Recovery Console. How? Navigate your way into your BIOS (Basic Input/Output System) by hitting either the delete
key, F1 or F2 when your PC first gets turned on. In the BIOS you'll need to find how to enable booting from a CD,
if you're unsure you'll need to look in your motherboard manual or go to your motherbaord's manufacturers site and
browse for some instructions. **Shit, I can't get a Windows 2000 Pro disc!** You wont need the product key or
anything like that so you should invest a night of bandwidth and download an .ISO image off Kazaa or some other
P2P network - it'll be well worth it, you'll use it more than you think. Okay, now we got your PC booting off the
CDROM drive. Whack the 2000 disc in and hit any key when it asks you if you'd like to boot off the CD. Now an even
bluer screen comes up with "Loading Windows 2000 Setup" or something like that at the top. Great, now we're
setting up Windows setup. It should take around 4-5 minutes to fully load and you'll be presented with a screen
that has a number of options. It may look something like this:
1.Press ENTER to install Windows 2000 Professional
2.Press R if you would like to run the 2000 Professional Recovery Console
3.Press F3 to exit
Or something like that. In any case, you want to hit "R" so you get prompted with a black screen that is asking
you what Windows installation you'd like to login to. It should have:
"1. C:\Windows\" up the top and a blinking cursor beneath it.
Note: It may not be C:\ that your Windows installation in located - I was going to say %SYSTEMROOT%\Windows but
that sometimes gets a little confusing.
Hit "1" and then ENTER. It's now asking you for a password... hit ENTER again. You're in!
You can now (in theory) add yourself as a normal user. Not straight away though, you'd need to prepare yourself in
advance. This is an idea that's just popped into my head, I havn't tried it and am giving no guarantees it'll
work... but here we go. My idea is to edit the autoexec.bat file so it will execute a command that will either add
you as a normal user on the machine or install a keylogger, you may take your pick. I'm going to add a normal user
for this demonstration.
**Note** All this shit in autoexec.bat is only going to happen when the next person logs on to the machine, so
don't get impatient if you gotta wait a couple of days.
How do I edit autoexec.bat? Now here's a trick for young players. The Recovery console comes with a built in BATCH
command that will allow you to run any batch commands within a text file that you've copied from a floppy in the
recovery console. We'll create a text-come-batch file that will add a couple of lines of extra instructions onto
the autoexec.bat file.
What will be in this batch file? Well, shit, you can put in there whatever the hell you please but for this
tutorial's sake I'm going to add in a simple command that will add me as a new normal user next time the owner
logs on. Now you need to need to be kind of careful here, if you have a reasonably clued up owner they'll notice
there is a new user if they log off then on again. But that's a risk you need to decide if your willing to take.
Anyway, where was I? Ahh, yes, creating this batch file. I've pissed around with the recovery console for the last
half an hour and decided the best way to do this is to create a file called autoexec.bat in advance and chuck it
on a floppy.
In autoexec.bat add the following text: net user [yourusername] [your password] /ADD exit Where [yourusername] and
[your password] are replaced with the corresponding values.
This will add you as user with normal access privledges. We cannot add you as an administrator because it'll give
us a System error 5, access denied, if a Domain Controller isn't logged on while trying to add a user from the
command prompt.
Save this file to A:\autoexec.bat. When you get into the recovery console, whack the floppy in and type: "copy
a:\autoexec.bat c:\autoexec.bat" and hit enter. It should prompt you if you want to overwrite the autoexec.bat
file. Choose 'y' for yes. Type "exit" and hit enter.
I've just tried this method and it changed the value of autoexec.bat without a worry in the world but one problem:
the autoexec.bat file in Windows XP is not parsed by default. You need to change a registry value for it to be
parsed on startup. Hey, you might get lucky.
Another interesting thing I found while using the recovery console was the restrictions placed on the NET command.
You can only use NET USE in the recovery console. This means you could potentially NET USE your way into a
location on your network and add files to the current installation although there really isn't a lot of point
unless the files are too big to fit of a floppy (even then you could burn them to a CD)
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Section 4 - Getting admin access using the logon.scr method
Personally I had high aspirations for this method. I really thought it has potential to be one of the great XP
faux pas. I wasn't totally wrong.
This method will allow you command-line access with no command restrictions, i.e., things like net user/send/
whatever aren't disabled. You do, however, come accross some interesting Access Denied errors.
What's the point in this method? If you've already got a damn account why the hell are you moaning? Well,
kimosabi, you may have an account but you don't have access to the domain controllers documents do you now? No,
you don't. Well this method will not only let you see his/her documents it'll let you copy, delete or even move
em. You can own your Domain Controller's documents.
This method will only work if you have access to the regitry or can manipulate the system so the registry gets
edited next time the administrator (or someone with registry editing capabilities) logs on. It involves editing
two hives (you only really need to do one but the other just makes things faster). The usual disclaimer applies
here - if you screw with your registry and you don't know what you're doing you could shoot yourself in the foot
and f*** the OS. Don't piss around if you're incompetent.
First of all you'll need to fire up the registry editor by going Start > Run and typing "regedit" or "regedt32".
Now navigate your way to the key "HKEY_USERS\.DEFAULT\Control Panel\Desktop".
There you'll find a hive called SCRNSAVE.EXE and it should have a value of "logon.scr". This hive is the hive that
tells the operating system what to do when the system has been idle for 600 seconds at the logon prompt. At the
moment it is going to execute the "logon.scr" screen saver. What's to stop us changing that to whatever we want?
Absolutely nothing (except limited access to editing the registry ). What you want to do is change the value of
"logon.scr" to "cmd.exe". To do this, double click on the hive SCRNSAVE.EXE (a box will pop up) and change it's
value.
Now this will do the trick but we might as well make it as easy as possible for ourselves because, shit, that's
what we're here for, right? In the same key you'll find another hive called "ScreenSaveTimeOut" this should
(usually) have a value of 600, that means 600 seconds. So when you restart your PC and leave it sitting at the
logon prompt it'll take 10 minutes for it to execute the "SCRNSAVE.EXE" hive. We want to change that to something
a little more realistic. You can choose how long you'd like but I'll say 10 for the sake of the argument.
Okay, so now we've changed the two registry hives and are ready to try the logon.scr method of gaining commandline
administrator access to Windows XP. Restart your machine and when it gets to the stage where it's sitting at the
screen with the usernames ready for you to click on, don't move the mouse... just wait for 10 seconds.
Holy shit, it worked! We now got a full screen command prompt at our disposal! Yeehaaa! But wait... oh man, when I
try "net user myusername mypassword /ADD" it doesn't work! Access denied! Yeah, you're right, you can't actually
add new users at all (from my experience) using this method.
But look on the bright side, you can navigate to anywhere in the OS. You can copy, paste, edit and do whatever you
like with the files on the hard drive... except the SAM.
What can I do if this method doesn't work for me? There are a number of things you can try if this method doesn't
work for you. The first and most obvious thing to try is instead of putting just "cmd.exe" (which should work) you
could try putting the whole path and filename. I.e., "C:\Windows\System32 \cmd.exe" or you could even go so far as
to changing cmd.exe to command.com.
Another interesting thing you could try is this:
Fire up a command prompt (or notepad to make a batch file, whatever you have access to) and type:
copy C:\windows\system32\logon.scr C:\windows\backup\logon.scr" hit enter, Then type:
"copy C:\windows \system32\cmd.exe C:\windows\system32\logon.scr" hit enter, hit "y".
Make sure the SCRNSAVE.EXE value is "logon.scr" and change the ScreenSaveTimeOut value to 10.
Logout and wait 10 seconds.
posted by ::. aRe-FiFth .:: @ 11/23/2005 03:34:00 AM,
