[Riverclawz]

If you open cmd with admin access it spells C:\Windows\system32> in before your command, but if you can open the console with a .bat and make it say C:\Windows> in before the command, do i still have admin access on the computer?
Also, imagine you need to log into a domain when logging into windows like a network at work/school/... and if you open cmd you see your login and some more stuff instead of C:\Windows\system32>. If you see this C:\Windows> there when opening a cmd through a .bat, does this keep the admin privileges on the network or only on the local machine? I was told by our schools network administrator (AKA my teacher) that if someone found an error in the security off the network he or she would get 10 extra points on his/her IT exam. If i am unclear or if you want print screens to make my explanation more understandable tell me and i'll do my best for a better explanation with pics

Ty!

[ArkPhaze]

I don't understand. The working directory has nothing to do with permission levels, if that answers your question.

[Riverclawz]

Oh, but why does it change when i run it at different privilege levels then? If run as a user i get C:\Windows\system32> and if i run it as admin C:\Windows\system32> appears.

[ArkPhaze]

Oh, but why does it change when i run it at different privilege levels then? If run as a user i get C:\Windows\system32> and if i run it as admin C:\Windows\system32> appears.

That seems like the same path to me, so I'll assume you meant to write different paths. As I said though... Again, it doesn't mean anything:


Get rid of the belief that you think it means anything. The only time you'll notice it is if you try to take action on a folder that requires admin permission for instance most commonly. If you pay attention, the noticeable difference is the "Administrator" mention in the titlebar.

[diana32]

You must know someting about runas - is a sudo command but for windows.
IF you can use the runas command which is kind of similar, or you can check out the sudo for Windows project over at SourceForge which adds a sudo command.

The difference is subtle:

Let's say you have two users. Bob is a normal user and James is an administrator.

If you log in as Bob and use "runas james acommand" the command is run as if it was run by James, so it accesses James' user settings and any user changes go into James My Documents & settings folders, etc. So if you are installing an application, say, it will be installed as James, not as Bob.

If on the other hand Bob does "sudo acommand" the command is still run as Bob, but with elevated permissions - just like the Linux sudo command. To prevent any user from being able to sudo you have to define a sudoers user group that contains the list of the normal users that have permission to elevate using sudo. The users still have to provide credentials before elevation.

Sometimes the difference isn't important, sometimes it is, and I find that both commands can be useful.This is a copy for this link :
http://superuser.com/questions/42537/is-...or-windows

[Riverclawz]

Oh, but why does it change when i run it at different privilege levels then? If run as a user i get C:\Windows\system32> and if i run it as admin C:\Windows\system32> appears.

I'm sorry, i was trying to say that if i run it as a regular user i see this, C:\Users\Storm Trooper> and as an admin i see C:\Windows\system32>, i understand it has nothing to do with privileges but still, why does it change?

[noize]

Oh, but why does it change when i run it at different privilege levels then? If run as a user i get C:\Windows\system32> and if i run it as admin C:\Windows\system32> appears.

I'm sorry, i was trying to say that if i run it as a regular user i see this, C:\Users\Storm Trooper> and as an admin i see C:\Windows\system32>, i understand it has nothing to do with privileges but still, why does it change?

That doesn't mean anything. If I have a file in C:\Windows\System32, it has administrator privileges by default, as all of the files in that directory. Though, each file can be taken to be executed with different privilege levels (take all files in System32 again). Let's say you've got a script:

Code:

copy %0 %windir%\system32

If it is placed in %userprofile%, you'll get an error due to the failed copy, if it is in the %windir%, you'll get a success message.

[Riverclawz]

I see, thanks for your help!

[mls577]

If you open cmd with admin access it spells C:\Windows\system32> in before your command, but if you can open the console with a .bat and make it say C:\Windows> in before the command, do i still have admin access on the computer?
Also, imagine you need to log into a domain when logging into windows like a network at work/school/... and if you open cmd you see your login and some more stuff instead of C:\Windows\system32>. If you see this C:\Windows> there when opening a cmd through a .bat, does this keep the admin privileges on the network or only on the local machine? I was told by our schools network administrator (AKA my teacher) that if someone found an error in the security off the network he or she would get 10 extra points on his/her IT exam. If i am unclear or if you want print screens to make my explanation more understandable tell me and i'll do my best for a better explanation with pics

Ty!

well it seems your question about the cmd has been answered. No, the working directory that shows up when you open cmd isn't an indicator of administrator rights. You can use commands like "whoami" to see what user account the cmd is using. Also you can use the "net localgroup administrators " command to see who does have access on that machine.

now on to answering the real question. If you want to try to leverage your way into those extra points on your exam, You should try to find out as much as you can about the network and it's systems. Before we go any further, I'd make sure that your teachers word is good, because if you do find a security hole and you exploit it, then you could get into legal trouble. If that doesn't really worry you, then keep reading. First let's talk about one machine, because one machine is probably easier to access than the whole network and that might count enough to get your those points. So I'd find out the operating system and post back here. I'd also see if certain things work for you, can you open cmd and other windows tools? Can you boot from a live cd/usb? Can you access certain admin/ restricted directories? the list goes on. So find out some info and post back here.

[Riverclawz]

I can open cmd, and run stuff like ipconfig /release and so on, this i use to evade monitoring from the teachers program
It's windows 7 i have a file filled with routers with their ip and MAC addresses for sniffing or a mitm attack but i'm not going to go that far (because then i'll be breaking too many laws and intruding privacy).
You are right about the permission thing, i don't know how far i can go w/o getting in trouble with the law and/or the school itself. Before I go further i'll talk about him about it. But i'm still interested please go on with our conversation
Btw, this is only memory but i think i can access the config screen and change some basic stuff and taskmngr is also available but i can't use any tools that require admin privileges. The network has a few routers with a login screen, perhaps that is a weak link ready for exploitation? Something else we could try is install a piece of software, sometimes a teacher (with less privileges than an admin, but more than me) walks away from his/her desk so i can shove a usb in to exploit autorun? something like that. I can't install anything so it needs to bypass that too.