T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/batch-files-and-functions.md:69- Finding
Pre-Authentication SYSTEM Shell and Administrator Account Creation Technique
- Content
View full analysis
Restart, then Troubleshoot > Startup Settings > F4 (safe) or F5 (safe+networking). WinRE: repeatedly power-cycle (hold power 10s, 3 times). WinPE: boot from USB, runs wpeinit automatically. WinPE drive detection script: loop through drive letters A-Z checking for existence of a known file. Create admin account from recovery: rename utilman.exe, copy cmd.exe over it, reboot, click Ease of Access at login to get CMD, `NET user demo-user password1 /add` then `NET localgroup administrators demo-user /add`. ``` ### Technical Analysis The reference explicitly describes replacing the Windows Ease of Access executable with `cmd.exe`. Because Ease of Access can be launched from the sign-in screen under a highly privileged Windows security context, this replacement creates a pre-authentication command shell. The instructions then create a new local user and add it to the local Administrators group. This is not necessary for the declared batch-file authoring functionality and deliberately bypasses normal authentication and authorization boundaries. It also modifies a protected operating-system executable, effectively creating a local backdoor until the original file is restored. ### Attack Path 1. An attacker with physical access or access to a recovery environment boots the machine into WinRE or WinPE. 2. The attacker modifies the offline Windows installation by replacing `utilman.exe` with `cmd.exe`. 3. The machine is rebooted to the Windows sign-in screen. 4. The attacker activates Ease of Access, causing the substituted command shell to launch without authenticating. 5. The commands documented by the Skill create a new local account. 6. The new account ...[truncated 702 chars]- Remediation
View remediation