And my favorite stupid WinNT/Win2k trick. Any normal user can become administrator without knowing the administrator password, assuming they can log on to the machine locally as a normal user, works great in a corporate desktop environment:
[list=A]
- copy %WINDIR%\SYSTEM32\LOGON.SCR to %WINDIR%\SYSTEM32\LOGON.ORG
- copy %WINDIR%\SYSTEM32\CMD.EXE to %WINDIR%\SYSTEM32\LOGON.SCR
- logoff, in 15 minutes (900 secs) you will see a DOS window appear
- you can now create a new user with Windows NT administrator priviledges or change the Administrator password with utilities such as USRMGR.EXE, MUSRMGR.EXE or ADDUSERS.EXE (if you don't have them installed, copy them from CD/ResKit, or have someone email you their copy)
- after you are done, you can type exit in the DOS window
- copy %WINDIR%\SYSTEM32\LOGON.ORG to %WINDIR%\SYSTEM32\LOGON.SCR
Note: The above assumes the system you are trying to own is using the "default" logon screen saver. If it uses something else just replace "logon.scr" in the instructions above with whatever *.scr file is currently being used for the logon screen saver.
This is great corporate fun. And it's a handy way for administrators to recover from a forgotten administrator password. What security! Might as well save the bucks and stick with your lame Win9x for the desktops.
Side note for NT admins. This really can come in handy to recover a lost password so you don't have to reinstall the OS and lose all your SAM info. And if you can't copy the file as a normal user, yank the drive out and stick it in as a second drive in another running system, copy the CMD.EXE to the <SECONDDRIVE>:\WINNT\SYSTEM32\LOGON.SCR, then put the drive back in the original machine and wait for the CMD prompt to appear and do yer magic.
But don't mark me for "+" on the MS side. It's a "-" as it's a big security hole.
And yes if you have local access to a machine whether Win* or Linux you can own it, assuming it has a floppy and/or a cdrom (boot from floppy/cdrom, mount the root filesystem, have your way). If the system is physically chained to the desk and doesn't have a floppy/cdrom, you're only going to own the Win* box. To be able to bypass the security so blatantly on a running system is just laughable.
[ December 19, 2001: Message edited by: VoidMain ]