Sticky keys privilege escalation on windows xp

What's a privilege escalation attack ?

     The purpose of a privilege escalation attack is to gain more privileges over a operating system. An example can be gaining administrator privileges from a restricted account on windows xp system which is what we are going to do today.

How does this attack work ?

     This attack is a fairly simple one. The way it works is by replacing the 'sethc.exe' with the 'cmd.exe' file which are both located in the system32 folder, 'sethc.exe' is the application that is run when pressing shift five times. Then all you have to do is press shift five times in the login screen and instead of the sticky keys dialog you will get a command prompt with administrative privileges.

Disclaimer

          This tutorial is ONLY for educational reasons. Do not misuse this information. I am not responsible for the way you use this knowledge. And remember with great power comes great responsibility.

Tutorial

      In this tutorial we have windows xp professional machine that has two accounts a password protected administrator account(admin) and a unprotected restricted account(user01).

     Because we can't change the files from within windows we must boot a live cd and do the change. If something like that isn't possible because of e.g locked BIOS then someone could use social engineering to gain access for a limited time to a administrator account. For this tutorial i will be using a Linux mint live cd because that is what i have available right now, you can use any distro you would like and you comfortable with.

      First you must locate and navigate to the system32 folder

        To do that use the cd command to change directory and the ls command to display the files and directories.
     Then copy the file using the following command

cp cmd.exe sethc.exe

        You should also backup the 'sethc.exe' file
      Finally reboot and press shift five times in the login screen and you will be presented with a command prompt with administrative privileges which you can use to change the admin password, add a secret account, install malicious software and much more. Also it would be a good idea although not necessary to return the original 'sethc.exe file' when finished.

      For this tutorial we are going to change the admin account password using the following command :

net user admin *

Epilogue

       And this concludes the tutorial, and always remember that the purpose of this tutorial is only for educational reasons and not to be used in illegal activities.