Getting Administrator access back on Win2k boxes: first draft

So, your friends have forgotten the Administrator password on their Windows 2000 box, and now you need to get Administrator access back. Normally all you have to do is fire up the Offline NT Password Editor and set a new one. Unfortunately, when I tried it, it didn't work (I don't know why, but it failed to work repeatedly, and yes, I did check that it was actually changing things as it should, and no, I hadn't messed with syskey).

Fortunately, assuming that you have physical control over the machine, it is actually quite easy to get a command prompt logged in as Administrator.

If you don't care how this works, just skip to the instructions.

Priviledge escalation

The basic approach we're taking is to find a program that the system will run with full administrator priviledges, and to then replace this program with our own.The next time the system starts it, our program is run. Typically, we want to run the command shell (cmd.exe) since we can then do whatever we want, such as (for example) adding a user to the Administrators group, or changing the Administrator password.

Of course, there aren't many programs that will be run with such rights, at least in Windows 2000.

Services

Why you need to use services in Win2k Priviledge escalation used to be even easier in NT4, as you didn't even have to use a registered service: you could just replace logon.scr (the login screensaver) with a copy of cmd.exe, log out, and wait until it was run. When it did, you had a command prompt with Administrator priviledges. While you can still try this in Win2K, you'll find that the command prompt "screensaver" is run with no priviledges, so there isn't any point. So, next best option: services.

The best targets that I'm aware of are the system services which run as "LocalSystem" (see the sidebar for why we can't use all the old NT4 tricks). Almost all of the services run as LocalSystem, so any of those will do, but since you're (temporarily) replacing this service by our own program, you must choose something that isn't essential to being able to boot & log in to the system.

I chose the Print Spooler service, which should work fine for most people, so I recommend that. You can find this at \system32\spoolsv.exe.

A small complication

One problem with using services is that services are not just regular Windows programs, so you can't just simply replace them with cmd.exe. Instead, we have to write a simple program which can run as a service, which then runs cmd.exe for us.

If you have a copy of Borland C++ Builder or Microsoft's Visual Studio, you can easily write a suitable service yourself using the Service wizard/template, and putting in one line of code:

??ShellExecute(0, "open", "cmd.exe", "", "", SW_SHOWNORMAL);

Alternately, you can download the one I wrote, SystemShell (full source included - if you just want the exe you can download that directly).

A second problem is that the services are often already in use by the time you finish logging in to Windows, and this may prevent you from replacing the file in Windows. This isn't a big problem, just reboot to a DOS floppy (or whatever you have handy - a Linux CD would work just as well).

(If your Windows partition is NTFS, you're on your own - NTFS file permissions should prevent you from replacing the file while in Windows, DOS doesn't support NTFS, and Linux NTFS support is at best "experimental". YMMV.)

Right, let's get on with it.

Instructions

1. Download SystemShell.zip and extract out SysShell.exe, putting it on a floppy or somewhere convenient on your hard disk (or, write your own version).
2. Reboot to a DOS floppy.
3. Change to the system32 directory in your windows installation:
   ??C: ??cd C:\WinNT\System32\

4. Save a copy of the real service, so you can put it back when we're done:
   ??copy spoolsv.exe spoolsv.old

5. Replace the service by our program, SysShell.exe, which you extracted out in step 1. You also must replace the copy in the 'dllcache' directory, as otherwise Win2k will restore the real program as soon as it gets a chance.
   ??copy A:\SysShell.exe spoolsv.exe
??copy A:\SysShell.exe dllcache\spoolsv.exe

6. Reboot and load Windows.
7. You may need to log in (and possibly even try and print something) before Print Spooler service (actually our program) is run, but when it does, you should see a command shell open up.
8. Do whatever you need to do. One useful example command, to add the user 'myuser' to the Administrators group:
   ??net localgroup administrators myuser /add


When you're finished, remember to put the real service back:

1. Reboot to your DOS floppy.
2. Change to the system32 directory again:
   ??C: ??cd C:\WinNT\System32\

3. Copy the real service back, again remembering to replace the version in dllcache:
   ??copy spoolsv.old spoolsv.exe
??copy spoolsv.old dllcache\spoolsv.exe


Nice one.

Disclaimer

The author is not liable for any damages arising (either directly or incidentally) from the use of these techniques & software. Especially if you didn't read the instructions.

??