When SHIFT key is pressed >=5 times, windows executes a file named “sethc.exe” located in system32 folder. It doesn’t even check if its the same file. Also it runs with the privilege of the CURRENT USER which is executing the file i.e if u have logged on as a guest then in the TASK manager under processes, it shows your user name as guest. The file executes even if u log off, and have the windows login screen is showed up, BUT THIS TIME SINCE NO USER HAS LOGGED IN IT RUNS WITH SYSTEM PRIVILEGE.

ExploitationIf u understand this much, then the exploitation is very simple for you. What we will do is that,
we pick cmd.exe , copy it at a folder other than system32, (because windows
won’t allow u to copy) rename it to sethc.exe, go to system32 folder,
and paste it. Windows will ask, “that another file exists, do u want to
replace?” and after pressing OK, you have replaced the sethc.exe with ur own
cmd.exe. Now if u press SHIFT key >=5 times, a command prompt will
pop-up.

Finally

1. Now log-off or restart. When you reach the windows
   login screen, press the shift key >=5 times. A command prompt will
   pop up with SYSTEM privilege.
2. Enter the normal commands as follows:
3. net user username /add
4. net user localgroup administrators username /add
5. And a new user called username with admin privilege will be added.

And thats it, you have admin privilege of the system and you can do what ever you want to with it.

Hiding your fake admin profileNow you surely don’t want the real admin to track you. Here is what you will have to do to hide yourself from login screens as well as from control panel

1. Goto registry editor and open this place.
2. [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonSpecialAccountsUserList]
3. Here create a new DWORD value, write its name as the “user name” that u created for your admin account.

Thats it now you are invisible but still admin of the system. Live as admin forever and keep screwing the real admin forever.

Last but not the least (IMPORTANT)Windows has two type of login screens:

1. Where the accounts are listed with some pictures.
2. Where u have to write username and password.

After making the hidden account u will have to login through the 2nd step only. If ur login screen is of Type 1, press ALT-CTRL-DEL twice to get the 2nd type screen.

Thats it!!!

NOTE:This is a sureshot way to gain admin, if u r a lamer or a newbie
then please do some googling.
I have written almost every detail.

Thanks for reading this far  Make a comment if you liked this one.

Thanks for digging and shouting it out to your friends.

https://abhinavsingh.com/gain-admin-access-on-windows-system-using-your-guest-account/