Background:
For those of you who didn't know, there's a special registry key for Windows NT based systems. The path of this key is "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Image File Execution Options". This key is particularly useful if you get a trojan on your system that refuses to shut down (you can tell windows to run another EXE in place of the EXE attempting to run here). This way, even viruses that check permissions and set them if you try and revoke read/write/execute from the trojan/malware/whatever. To do this, you simply create a subkey with the exe's name, add a string value named "Debugger", and set the value of this key to another EXE. But of course, there's a DARK SIDE TO THIS, THAT CAN MAKE YOUR LIFE A LIVING HELL. I was playing around, and decided to add WINLOGON.EXE to this list, and have it run CMD.EXE instead... and so the fun begins. Windows doesn't boot. Once it gets past the loading screen, it stays on a black screen for a few seconds, and reboots. ALAS! Recovery console to the rescue... OH WAIT, Recovery console won't let me edit the registry (it doesn't do much of anything besides suck)... Ok, so i decided to try and be clever and rename winlogon.exe to cmd.exe since that's what was trying to run. It worked, or so I thought, I tried to login at the logon screen, and it just kept bringing me back to it. So... I connected to the system from another XP box, and tried remote registry editing, which appeared to work. In reality, it seems to have just corrupted the registry. The Windows XP installation is screwed and I have no clue how to repair it. Hope I can find that site that tells you how to backup your product activation files, or else I might have a problem (not the first time i've had to pull out that bastard CD). I really hope MS puts a tighter lid on the registry with Longhorn, to prevent users from doing dumb things because they were bored -_-.
Actual Problem:
Microsoft Windows allows non-administrators to screw up their system (that's nothing new, I haven't been living in a hole, leave me alone...). Even a 13 year old kid at school could write a macro to exploit this and cause the system administrator a nasty headache. Even if you know what the problem is, it's not one you can just "fix". It's really quite sad that the system can be unbootable so easily (note: I'm aware of the NTLDR thing, but that's obvious, and easily fixable, this isn't).
All someone would have to do is write some code to add a key and value to the registry, then retrieve the SE_SHUTDOWN_PRIVILEGE via RtlAdjustPriviledge and make a call to NtShutdownSystem (Undocumented, NTDLL.DLL) with the POWEROFF constant.
Consider yourself warned :\. I know this sort of my fault, but still, this should not have been allowed to happen. Windows goes to GREAT deal to try and prevent me from doing things sometimes, but it had no problem with me shooting myself in the foot this time.
