Getting Administrator access back on Win2k boxes

Even kids enjoy vintage computing :-) — Photo: stiefkind / Wikimedia Commons, CC0

From the carcino.gen.nz archive. This Windows note was written for the original site and is kept as published; newer systems and toolchains may behave differently.

The normal way
Normally all you have to do is fire up the Offline NT Password Editor and set a new password. The Offline NT Password Editor does just that - edit the passwords on your NT/2000/XP box. The Editor works by changing the password hashes stored in the SAM (a part of the Registry that stores security-related information). Since you can't do this while the system is running Windows, you have to reboot and run the editor (this is why it's called 'Offline'). Therefore, you need physical control over, or at least, access to, the system. (You need the same to use the techniques in this document.) I suggest that you try using the Editor first - it's usually a lot less hassle. Sometimes however, it just plain doesn't work, as in my case (I have no idea why not).

The normal way

Normally all you have to do is fire up the Offline NT Password Editor and set a new password.

The Offline NT Password Editor does just that - edit the passwords on your NT/2000/XP box. The Editor works by changing the password hashes stored in the SAM (a part of the Registry that stores security-related information).

Since you can't do this while the system is running Windows, you have to reboot and run the editor (this is why it's called 'Offline').

Therefore, you need physical control over, or at least, access to, the system. (You need the same to use the techniques in this document.)

I suggest that you try using the Editor first - it's usually a lot less hassle. Sometimes however, it just plain doesn't work, as in my case (I have no idea why not).

So, your friends have forgotten the Administrator password on their Windows 2000 box, and now you need to get Administrator access back. Normally all you have to do is fire up the Offline NT Password Editor and set a new one. Unfortunately, when I tried it, it didn't work (I don't know why, but it failed to work repeatedly, and yes, I did check that it was actually changing things as it should, and no, I hadn't messed with syskey).

Fortunately, assuming that you have physical control over the machine, it is actually quite easy to get a command prompt logged in as Administrator.

If you don't care how this works, just skip to the instructions.

Privilege escalation

The basic approach we're taking is to find a program that the system will run with full administrator privileges, and to then replace this program with our own. The next time the system starts it, our program is run, and we can have our program do whatever we want to do.

This technique is known as "privilege escalation" because it makes use of existing privileges (the ability to log into the system, for example) in order to gain a higher level of privileges (hopefully, complete control of the system).

Typically, we want to run the command shell (cmd.exe) since from there we do basically anything, for eg. adding a user to the Administrators group, or changing the Administrator password.

Of course, there aren't many programs that will be run with such rights, at least in Windows 2000.

Services

Why you need to use services in Win2k
Privilege escalation used to be even easier in NT4, as you didn't even have to use a registered service: you could just replace logon.scr (the login screensaver) with a copy of cmd.exe, log out, and wait until it was run. When it did, you had a command prompt with Administrator privileges. While you can still try this in Win2K, you'll find that the command prompt "screensaver" is run with no privileges, so there isn't any point. So, next best option: services.

Why you need to use services in Win2k

Privilege escalation used to be even easier in NT4, as you didn't even have to use a registered service: you could just replace logon.scr (the login screensaver) with a copy of cmd.exe, log out, and wait until it was run. When it did, you had a command prompt with Administrator privileges.

While you can still try this in Win2K, you'll find that the command prompt "screensaver" is run with no privileges, so there isn't any point.

So, next best option: services.

The best targets that I'm aware of are the system services which run as "LocalSystem" (see the "Why you need to use services in Win2k" sidebar for why we can't use all the old NT4 tricks). Almost all of the services run as LocalSystem, so any of those will do, but since you're (temporarily) replacing this service by our own program, you must choose something that isn't essential to being able to boot & log in to the system.

I recommend the Print Spooler service, which should work fine for most people. You can find this at \system32\spoolsv.exe.

A small complication

One problem with using services is that services are not just regular Windows programs, so you can't just simply replace them with cmd.exe. Instead, we have to write a simple program which can run as a service, which then runs cmd.exe for us.

If you have a copy of Borland C++ Builder or Microsoft's Visual Studio, you can easily write a suitable service yourself using the Service wizard/template, and putting in one line of code:

ShellExecute(0, "open", "cmd.exe", "", "", SW_SHOWNORMAL);

Alternately, you can download the one I wrote, SystemShell (full source included - if you just want the .exe you can download that directly).

A second problem is that the services are often already in use by the time you finish logging in to Windows, and this may prevent you from replacing the file in Windows. This isn't a big problem, just reboot to a DOS floppy (or whatever you have handy - a Linux CD would work just as well).

Right, let's get on with it.

NTFS
If your Windows partition is NTFS, you're on your own - NTFS file permissions should prevent you from replacing the file while in Windows, DOS doesn't support NTFS, and Linux NTFS support is at best "experimental". YMMV.

Instructions

Download SystemShell.zip and extract out SysShell.exe, putting it on a floppy or somewhere convenient on your hard disk (or if you prefer, write your own version instead).
Reboot to a DOS floppy.
Change to the system32 directory in your windows installation, eg. if your Windows directory is C:\WinNT:
```
C:
cd C:\WinNT\System32\
```
Save a copy of the real service, so you can put it back when we're done:
```
copy spoolsv.exe spoolsv.old
```
Replace the service by our program, SysShell.exe, which you extracted out in step 1. You also must replace the copy in the 'dllcache' directory, as otherwise Win2k will restore the real service as soon as it gets a chance.
```
copy A:\SysShell.exe spoolsv.exe
copy A:\SysShell.exe dllcache\spoolsv.exe
```
Reboot and load Windows.
You may need to log in (and possibly even try and print something) before Print Spooler service (actually our program) is run, but when it does, you should see a command shell open up.
Using the command shell, do whatever you need to do. One useful example command, to add the user 'myuser' to the Administrators group:
```
net localgroup administrators myuser /add
```

When you're finished, remember to put the real service back:

Reboot to your DOS floppy.
Change to the system32 directory again:
```
C:
cd C:\WinNT\System32\
```
Copy the real service back, again remembering to replace the version in dllcache:
```
copy spoolsv.old spoolsv.exe
copy spoolsv.old dllcache\spoolsv.exe
```

Nice one.

Disclaimer

The author is not liable for any damages arising (either directly or incidentally) from the use of these techniques & software. Especially if you didn't read the instructions.