A developer managed to open a console application with NT Authority/System rights at the startup screen before logging in.
From that command prompt it is possible to execute arbitrary programs like Notepad, Internet Explorer and even Explorer to get a start menu.
With those local System rights, is it easy to acquire domain admin rights?
OS: Windows 7 SP1 x64
This is how the "hack" was done. If you google for it, it seems quite well-known. To do it, you need admin rights, which were granted to our developer.
- Take ownership of Utilman.exe
- Replace Utilman.exe by a copy of cmd.exe
- Restart the PC to get to login screen
- Click on the accessibility icon
Why the hell do all the websites list "browse the web without logging in" as one of the use cases? None of the top 10 websites provides a way to fix this "security issue" (or whatever we should call this).