Hacking Devices with Physical Access

Steps for various operating systems are included in this article. Also take note that these only provide local administrator access, not domain administrator access.

Windows (all versions, including Windows 7)

1. Go to your personal computer.
2. Download Rufus (a bootable USB drive creator).
3. Download the latest version of Ubuntu (Any live environment will work, but Ubuntu is highly recommended since it is signed by the Microsoft Secure Boot key, so it will boot on UEFI Secure-Boot-enabled Microsoft systems). Make sure the file you downloaded is an ISO file (e.g. ubuntu.iso).
4. Use Rufus to write the Ubuntu ISO to your USB flash drive. WARNING: You will lose everything on this drive, so please back up any files located on it.
5. Go to the target computer.
6. Turn the computer off. (If the OS is Windows 8 or higher, hold Shift while clicking Shut Down or clicking Restart to disable the "Fast Startup" feature.)
7. Turn it on, and repeatedly press the UEFI/BIOS key.
Note: The UEFI/BIOS key may be different on different machines. Keep rebooting and try different keys (all function (F1, F2, etc.) keys, Del, Esc, etc.). You should arrive at a menu where you can boot from a specific device or change the boot priority order.
8. Choose the option that directly boots from USB, if available. If there are only options to change the boot priority order, move the USB device option to the top of the list (or most priority/try booting first, so the computer boots from a USB first if detected instead of the internal storage) and reboot.
9. Wait for Ubuntu Live to boot.
10. Select "Try Ubuntu", "Try Ubuntu without installing", or any option that says "Live CD".
11. Open the Ubuntu file manager, select "Other locations" (or any similar options) and mount the computer's internal storage.
12. Navigate to C:\Windows\System32\.
13. Find Utilman.exe and rename it to Utilman.exe.hacked (or another random file extension).
14. Make a copy of cmd.exe and rename it to Utilman.exe
15. Close all windows and restart the computer.
16. At the login screen, click on the Ease of Access button (usually at the bottom left corner).
17. An administrator command prompt window should appear. Run the following commands (change usernames and passwords to your preference):

    > net user Hacker /add /active:yes
    > net user Hacker *

18. When prompted for a password, enter one or just leave it blank and hit Enter twice.
19. Run the following commands:

    > net localgroup users Hacker /delete
    > net localgroup administrators Hacker /add
    > exit

20. Restart the computer and log in to the newly created Hacker account (or whatever you named it).
21. To return the computer to normal functionality, log in to the Hacker account, delete the Utilman.exe, and rename the Utilman.exe.hacked file back to Utilman.exe. If you want to remove the Hacker account as well, remove it first and then use this tutorial except restore the original files in the Ubuntu file manager.

Windows 7 (no extra hardware required)

1. Turn off the computer or laptop.
2. Turn it back on. As soon as you see the Starting Windows screen, hold down the power button until the computer turns off. The computer must be force-shutdown during the Starting Windows screen, so start holding down the power button as necessary (depending how long a force shutdown takes for the device, usually it's 5 seconds) to make sure the computer turns off at the "Starting Windows" screen. (The goal of this step is to force-shutdown the computer during its boot process.)
3. Turn the computer back on.
4. Select "Launch Startup Repair".
5. Wait for the system scan. After about 3-5 minutes, it will ask you if you want to use System Restore. Press "Cancel".
6. The scan will continue for about 15-20 minutes. Wait for it to complete.
7. A window will pop up asking to send error information to Microsoft. Click "View problem details". Scroll all the way down and click the offline privacy policy link (it will usually be X:\Windows\System32\en-US\errofflps.txt or at least start with X:\).
8. Notepad will open. In Notepad, click File > Open...
9. In the Open File dialog, navigate to C:\Windows\System32\.
10. Find Utilman.exe and rename it to Utilman.exe.hacked (or another random file extension).
11. Make a copy of cmd.exe and rename it to Utilman.exe
12. Close all windows and restart the computer.
13. At the login screen, click on the Ease of Access button (usually at the bottom left corner).
14. An administrator command prompt window should appear. Run the following commands (change usernames and passwords to your preference):

    > net user Hacker /add /active:yes
    > net user Hacker *

15. When prompted for a password, enter one or just leave it blank and hit Enter twice.
16. Run the following commands:

    > net localgroup users Hacker /delete
    > net localgroup administrators Hacker /add
    > exit

17. Restart the computer and log in to the newly created Hacker account (or whatever you named it).
18. To return the computer to normal functionality, log in to the Hacker account, delete the Utilman.exe, and rename the Utilman.exe.hacked file back to Utilman.exe. If you want to remove the Hacker account as well, remove it first and then use this tutorial except restore the original files in the Notepad Open File dialog.

Chrome OS

1. Turn off the Chromebook.
2. Turn in back on and hold down the Esc and ↻ (Refresh) keys for about 5 seconds.
3. Press Ctrl + D and agree to the dialog box that appears. WARNING: This will erase all local data on the Chromebook.
Note: While the Chromebook is in Developer Mode, every time you boot it you will have to press Ctrl + D (or wait 30 seconds). Do not press Space unless you want to turn off Developer Mode.
4. Restart the Chromebook.
5. Press Ctrl + Alt + 🡪 (Forward) (not the arrow keys, the arrow buttons on the top).
6. Type the following commands (replace the date and time placeholders with the correct date and time):

   $ date -s "DD MM YYYY HH:MM:SS"

7. Press Ctrl + Alt + 🡨 (Back) (not the arrow keys, the arrow buttons on the top).
8. Log in with your school credentials.
9. Download Crouton to your Downloads folder.
10. Open Crosh by pressing Ctrl + Alt + T and type shell.
11. Type the following commands:

    $ cd ~/Downloads
    $ sudo sh -e ./crouton -t unity

12. After the installation completes, type the following command:

    $ sudo startunity

13. To switch between OSes, use the following keyboard shortcuts:
    Chrome OS: Ctrl + Alt + 🡨 (Back)

    ---

    Shell: Ctrl + Alt + 🡪 (Forward)

    ---

    Ubuntu: Ctrl + Alt + ↻ (Refresh)
14. You can log out of the Ubuntu session at any time.

Max OS X (High Sierra or earlier)

1. At the log in screen, type root as the username and leave the password blank. Click the "Log in" button several times until you log in as root.
2. Marvel at one of the greatest mishaps of Apple.
3. There is also another interesting bug; when a prompt appears to enter the password, it shows the actual password in the "Password Hint" field instead of the password hint. In that case, just enter that password.

Mac OS X

1. Turn off the MacBook.
2. Turn it back on and hold down the ⌘ Cmd + R keys until the Apple logo appears.
3. On the top menu, click Utilities > Terminal.
4. Run the following command:

   # resetpassword

5. Follow the intructions to reset the password of any user. Reset the System Administrator's (root's) password to gain access to the keychain.

Linux

If your school has Linux (most distros) devices (pretty cool, but unlikely since MDM is better on Windows, macOS, and iOS), use this section.

1. Press any key to interrupt the boot process. You should arrive at a GRUB menu.
2. Press E to edit the selected option (should be the default "boot normally" option).
3. Navigate your cursor to the like starting with kernel.
4. Navigate to the end of the line (usually after "quiet" or "quiet splash").
5. Type a space and then a "1" (or sometimes "single"), so it looks like: "... quiet splash 1".
6. Press F10 or Ctrl + X (or whichever keys it tells you to press to boot) to boot. The OS should boot in Single-User Mode.
7. Type passwd to reset the root password.
8. You may reboot the computer by typing reboot now or exit.
9. Log in as root with the password that you set. Now you can modify other (local) users' passwords and files.