Anyway here we only need the Windows XP/Server 2003 to be installed on a FAT32 partition.
There are three simple steps involved:
• Rename the logon.scr file situated in system32 folder to something else. Then make a copy of the cmd.exe and name it logon.scr .
• Restart the computer, wait on the logon screen for the renamed cmd.exe to fire up as logon.scr . Usually the time taken will be the time the admin set as the screen saver time. Usually 10 mins, and then you get a console window in front of you with all the admin powers.
• Make a useful command. Best thing to do is run the explorer.exe command and wait for the GUI shell to load. Now you can perform normal computer operations. Another good thing that can be done is to change the Administrator password with the NET command on the command line itself.
Now we will see how to do the first step in more detail. This can be achieved if u have a simple account or else use a boot disk and from command line you can perform the operation. Or else use a Linux installation to do it. Its always helpful to have a Linux live CD in hand. Else you can use the parallel Win 98 installation to do it (if available).
I will elaborate the boot disk method. Most people will be having a Win 98 boot disk or a CD. Boot from it and reach the command line. Suppose Win XP is installed on C:\ then do the following:
• A:\> C:\
• C:\> CD Windows\SYSTEM32
• C:\Windows\System32> REN logon.scr logon1.scr
• C:\Windows\System32> COPY cmd.exe logon.scr
• CTRL+ALT+DELETE (Restart the comp, remove the bootable media)
Let see what happens in the second step. You need to do nothing in this step. You just need to sit and wait without pressing any key or moving the mouse for the screen saver to fire up. In this case logon.scr fires up. Logon.scr is nothing but a renamed cmd.exe .
A command line shall appear after the set time expires.
Now for the hacking step, we have a full powered command line in hand. Now we can do whatever we wish. Lets do one thing first; make sure that we have a long term access to the computer. We will change the administrator password. Type the commad:
NET USER Administrator <pass of ur choice> ¿
Very seldom does even a admin log in with the administrator account. So now you have the administrator account in your hand and not many can do anything about it.
Supposing the computer is usually used frequently with the admin account, you can simply type the ‘explorer’ command at the shell to call the GUI shell. You get a full power shell in your hand. This is very safe since one will realize that anyone ever hacked their comp. But this will require you to wait for the command line to fire up as a screensaver every time.
Anyhow, now you can hack comps of many FAT32 fools.
. Great tutorial.
