Hacker News Reader

Parent Full thread

dsacco

No, but it is interesting to know methods like this.

You can achieve admin on an OS X machine by adding a new one like so:

1. Enter single user mode via cmd + s during startup.

2. Mount the hard drive via /sbin/mount/ -uw /

3. Delete the setupdone check via rm /var/db/.applesetupdone

4. Reboot, and now you are presented with the wizard for adding a new admin account.

View on HN

I remember someone (not me, oh no...) used one for NT4 with inadequate policies to get Admin access.

Create a batch file with the content:

net localgroup administrators NewUser /add

...then stick this into the 'StartUp' directory for All Users. Break something. Call support. They log in as Administrator, running your batch file in the process.

NewUser would be created with Admin rights. You wouldn't promote your own login, of course.

Of course this is only possible if FileVault is disabled, otherwise you would not be able to mount the hard drive without user's password.

Reply on news.ycombinator.com