[thegreatbeast666]

I don't know much about tools that will do what you want but I have taken classes that were setup in labs like the one you describe. With next to no knowledge in networking, programming, or security and without the need for a third party tool I was able to get the password off the administrator. I have used this method twice a little different each time.

The first time I created some strange sounding excel files and kept them in the same folder that the admin (instructor) had students keep class files in. I used VB for applications to create a simple prompt that when the file opened it asked for the user name and password. I made it fail the first time just to make sure he didn't use some default student user. The file had a bunch of random B.S. when it was opened and it did the trick by writing the input from the text boxes to a cell in excel.

The other time I was working on a project that involved SQL express and Visual Studio. More than once I needed the admin to give me permission to do something. I cant remember the details but it was all fake anyways. This admin was cool and stupid and very easy to trick. All I did was create a simple web page that attempted to connect to the campus SQL server. I knew he had a bunch of users but I wanted the student record one. So when I would run the program it would prompt for the user. I also had code that was running to open the management console. When he granted my app admin (took him a few tries) it opened the console in the background as that user and from there I gave myself root.

I hope that helps, I swear to you that I used nothing more than office, Microsoft help, and other tools from class. No hacker tools or anything like that. For me it was just figuring out the person and then the rest was easy. :0) I hope that helps.