how to by pass writing privileges in windows

I'm having a problem with some system, i wonder is there a way to elevate ,in windows XP or 7 or any other version, the privileges.
the problem is:
1) the BIOS is password protected
2) the user account does not have writing privileges to disk C (hell, even the control panel is protected)

so the method of using booting disks are not an option cause i cant configure the BIOS boot order
and the methods to use the log on screen not an option either.

what I'm looking for is a method that will give me the writing privileges to disk C
I don't mind if a solution is some source code in any programming language that by passes this limitations or some tools
any way I'm for any solution, prefer a solution that does not changes the original administrator password or has the ability to restore the old one

any idea, solution, walk through, step by step are welcome
just a student for software engineering so have a limited knowledge in all programing languages equally

please somebody help!!!

Depending on the system.....you maybe able to reset the bios??

You could always remove the harddrive and slave it into another system and access it that way.

MLF

Sometimes there is a jumper on the board that will reset the BIOS password. Depends on the model. As far as gaining more access to the system, there is always KonBoot. Be very careful though, if this is a company machine, what you are doing could get you fired or worse. If it is a school machine, you could be expelled or worse. I am sure you get the idea.

edit: Crap. I guess I missed the part saying that boot disks were out of the question. Can you not tap F12 [most systems] to get a boot menu, without actually changing the boot order? Or does the BIOS password restrict that as well?

1. Do you own the machine?
2. Why do you want to do this?

:lildevil::lildevil:

Good question nihil. It sounds like some kid trying to 'hack' a public system/terminal.

nihil and ech0 lets set it straight that I'm not a kid, much older then you think,
although what I'm looking for is illegal to do but yet its not illegal to know how.
the knowledge is legal, but the decision what to do with it is always in mans hands

the system is in my university and the PC's are locked behind a padlock so opening the PC could be troublesome although i have some skills in lock picking.
the problem with the system is that the public partition is being deleted and restored every day, so keeping some of my files on the public machine is impossible but if I'll be able to store it on System disk C:\ then i by pass it and that is what I'm trying to achieve

Quote:

---

Originally Posted by igkutikov

nihil and ech0 lets set it straight that I'm not a kid, much older then you think,
although what I'm looking for is illegal to do but yet its not illegal to know how.
the knowledge is legal, but the decision what to do with it is always in mans hands

the system is in my university and the PC's are locked behind a padlock so opening the PC could be troublesome although i have some skills in lock picking.
the problem with the system is that the public partition is being deleted and restored every day, so keeping some of my files on the public machine is impossible but if I'll be able to store it on System disk C:\ then i by pass it and that is what I'm trying to achieve

---

What you are trying to achieve seems to be AGAINST the policy of that system's owner. If they wanted you to store files on their system, they would have given you a way of doing so. As for what nihil said, you seem to miss the point.

1 - You dont own the sytem.
2 - What you want to do is against their policy.
3 - In other words, what you want is to crack their security implementation for your own benefit which is illegal!

I dont think you will find help here for what your intentions are, since they are non ethical, illegal, and just plain stupid, since there are so many other ways to keep access to your files when you need them. The only kind of files that i can think of in your situation might be malicious code, ie. keyloggers, backdoors, rootkits, etc....! If it were only for your school files, a place to have access to what you really need for your school, there are SO MANY WAYS of doing so without breach of policy, or cracking the system. Just to name a few:

- File hosters
- Drop box
- Emails
- Some browser functios such as opera unite & opera link
- Portable media
- Many more solutions......

If i were the admin of the school where you are at, and i caught you doing what you intend to do... i would prolly call the cops or have you expelled at the least....

My point is... that i cannot find any valid reason for what you want to do!

How ever... if it where your system, and its like you claim, just for the knowledge.... the best way to go about it is to reset bios (meaning you have physical access to the box), and from there on changing boot parameters etc... on YOUR OWN system.

Well, my experience of that sort of software (DeepFreeze etc) is that it also resets the system image, so what you are proposing probably wouldn't work anyway, as your files would be erased?

Also if you can access the system partition then so can anyone else and they would have access to your files.:eek:

Don't you have an account on a fileserver to store your files?

Create some sort of failure within the machine. Log a help desk call.

Wait for help desk to log into machine in attempt to fix issue.

Recover cached logon credentials.



Purely theoretical, of course. I would *never* do such a thing in real life.

They seem pretty clued up so they should clear the cache afterwards.

In fact, I wonder if user credentials are actually required or cached at all as these appear to be public use computers?

I still think that the whole system gets re-imaged each day so it wouldn't achieve much anyway.

Also, I suspect they would just re-image the machine anyway, and I would guess that software runs a system and doesn't require a login, as it appears to run automatically each day?

**** me, I have to agree with Nihil here. Sounds like the whole thing is re imaged daily.

That being said, I doubt they flash the BIOS daily.

Resetting BIOS passwords is simple. Remove the battery power on then off usually does it. Ignore the warnings on power up. By that I mean you will be presented with options, one of which is Ignore.

If you are not presented with these options, then you will have to determine which jumper resets the password. GOOD LUCK! if you are picking a lock to get access, as it may take a bit of research.

Now here's the kicker. If you do get access to the BIOS and can enable CD/DVD - USB boot, it may do you no good. In most secure environments where re image is performed daily (for security purposes) Each node on the network has an IP address assigned to a MAC address.

Any conflict within the routing table (lack of better explanation) and a SNMP alert will be sent to the admin or the physical port on the switch/server will shut down. Or both. So you have to first determine the machines ip address and mac address prior to booting up into whatever OS you choose. The boot sequence will have to include the mac and ip address when creating the virtual nic.


Saving files on the local drive, at this point will work without setting off an alarm, but at the end of the day... No files.

SO Whatever you write. Whatever you save. You should plan on that "whatever" to be done within a short time.

If your "whatever" is destructive and actually works, it will be traced back to the machine you altered.

Hmmmm, I can see other potential practical difficulties too.

1. You not only have to pick the lock, you also have to relock it. This would be a problem if the lock requires a key to do it rather than just closing the hasp.

2. I would guess the case opened alarm has be turned on? The problem here is that you need to boot the machine to change the BIOS settings, and by that time it might already have phoned home before you have a chance to reset it. You could probably get round that by disconnecting from the network temporarily, provided that your machines are turned off regularly.......otherwise that may set off an alarm?

3. Removing the CMOS battery may not reset the BIOS password. A lot of modern motherboards store the BIOS and passwords on non-volatile EEPROM chips.

4. There may well not be a password reset jumper switch either.

5. If you reset the BIOS password it will be obvious what has been done.

I agree with dinowuff in that you need to do some more research, particularly into the BIOS and motherboard features.

Quote:

---

Now here's the kicker. If you do get access to the BIOS and can enable CD/DVD - USB boot, it may do you no good. In most secure environments where re image is performed daily (for security purposes) Each node on the network has an IP address assigned to a MAC address.

---

If you boot into a live environment, you still have the same MAC address. It reads it from the hardware. [Are you thinking of Virtual Machines?] So unless the system used static IP addressing, it shouldn't really be a problem.

Well, in my opinion, if you sit down in front of a public access computer and find that it has been locked down in this way, you should either get on with what you are supposed to be doing or get up and quietly walk away.

What you are looking at is the tip of the iceberg and you have no idea what other security measures are in place. It is not a risk that is worth taking IMO.

For example, how do you know that as part of the re-imaging routine they don't first calculate a hash total for the system drive...........they know what the answer should be.............and if somebody has added files that would be immediately obvious.

One method I have used with computers where people have forgotten the BIOS password or inherited a box with the password set, is to disconnect the HDD and provoke the booting of a BIOS flash from removable media. That is because with SOHO and domestic machines the other boot options are generally still enabled. Flashing the BIOS usually does not ask for the password and sets it to blank.

In the case of public access machines, they are usually set to locally boot from the C:\ drive only, and possibly the network, so this would not work.

Of course I am sure that we have all heard of exploits that permit elevation of local privileges............ but if you want to follow that route then be prepared to go all the way to the "big house" :eek: And if the Admins are on the ball they probably won't work anyway.

Q: "Why did you go to college son?"
A: "To get a criminal record"

Ummm, yeah, well..............................

westin:

You are correct. The mac will be the same. I was more referring to the static ip and it's relationship to the MAC. A big concern is the difference between M$ Virtual server and VMWare. As I write this I think of CITRIX and the way it controls remote hardware...

OP - If you want to break into this system, get a job at the HelpDesk!

dinowuff

Ah... I see what you were saying. You were talking about a different IP coming from the same MAC all of a sudden, and tripping some alarms. Good point.