XP – Get System User

In Windows XP, the system run level is higher than administrator, and has full control of the operating system and it’s kernel. When you hit Ctrl+Alt+Tab and get to the task manager process list, you will see that the System User controls several processes

Most System processes are required by the operating system, and cannot be closed, even by an Administrator account. Attempting to close them will result in a error message.Under normal circumstances, a user cannot run code as System, only the operating system itself has this ability, but by using the command line, we will trick Windows into running our desktop as System, along with all applications that are started from within.

Changing your administrator password on Windows XP, may be necessary at times depending on the scenario. One such technique, with a full desktop available to you is also possible.

Lets get rolling:

1. open up command prompt and type:

at

If it responds with an “access denied” error, then we are out of luck, and you’ll have to try another method of privilege escalation; if it responds with “There are no entries in the list” (or sometimes with multiple entries already in the list) then we are good. Access to the at command varies, on some installations of Windows, even the Guest account can access it, on others it’s limited to Administrator accounts.

2. if you can use the at command, which is basically a task scheduler, then enter a command similar to something like mine

at 23:27 /interactive "cmd.exe"

the time is usually a minute (or two) ahead of your present time in the 24 hours format

3. When the system clock reaches the time you set, then a new command prompt will magically run. The difference is that this one is running with system privileges (because it was started by the task scheduler service, which runs under the Local System account). It should look like this:

You’ll notice that the title bar has changed from cmd.exe to svchost.exe (which is short for Service Host).

4. End the current Explorer.exe. [hit ctrl+alt+del->task manager->processes]

5. At the system command prompt, enter in the following:

explorer.exe

6. Voila! …user System logged in!

7. Stuff you can do!

8. Log out to get back to your normal user

FIX: Open the services control panel (Start > Run > services.msc) and disable the Task Scheduler service.