SETHC exploit. Came in with Kali Linux on my USB. No password for booting up! XD Renamed CMD.EXE to SETHC.EXE Boot into Windows. Press Shift 5 Times. This activates the Sticky Keys (SETHC.EXE), which is now CMD.EXE. Any program loaded outside an account is run as Administrator. I then had Admin control of the computer. W00TW00T G0T R00T!1! I then made a local admin account with NET commands. I noticed that the accounts they have are on multiple servers. The teacher accounts are on a separate server than the students.
This is as far as I got, but here is how I'd continue. Considering that this is my teacher's computer, he'd log into his account on the teacher account server. With my admin privileges on the local machine, I could run a keylogger I made in C++ as a Windows Daemon.
I could then wait until he logged in the next morning for his lesson plan and come in after school to collect the information (password). I could then log in with his account. The teachers have an app on their accounts which allow them to access the grades for their class. Now I could change the grades.
But I wouldn't have to stop there. I'd have access to his email account which would have account settings saved on his client. I could use social engineering to get information from other teachers. I could look at his history of sent messages and subscriptions and see if there is any material for blackmail.
I would then remove the local admin account I made and make SETHC.EXE a Sticky Keys again, rather than as CMD.EXE, so as to hide the evidence. I would also log onto his account from other computers to lessen the chance of my getting caught.
I could run Rainbow Tables, Dictionary attacks, and spread various kinds of malware under my teacher's name. I could plant documents that would align these activities to a motive and have him fired.
If I had control of all the accounts on the server, I could add SMB and SSH servers to every machine and run them all on different accounts. I could also have other friends from across the district do the same in their schools. Soon we'd have a botnet spanning the entire district. One SSH command from a public library and I could have them all run, for example LOIC all at once. An amazing DDOS! With SMB, I can change the code remotely and have it install any new malware I wanted (Even though this is also possible with SSH)
If anyone were to catch up with what was happening, I could send a command to wipe the information. I'd also use a buffer overflow of a char array in C++ to wipe info without pointers, so that deleted files would be corrupted. I'd already have "human proxies". People I act through (some directly some online). If someone follows the trail well enough, it still wouldn't lead to me, but rather someone else set up for the blame.
Now, we have a huge arsenal of machines at our command and complete control of all the grades of every student in the district.
I have intelligent, capable friends in every school in my district. They can at least follow my explicit instructions. Many of which I'd have blackmail over from monitoring their activities with MITM attacks. Why so much futa... They'd do what I want regardless, but its just an extra precaution.
This power could be used to blackmail any student in the district, monitor the activities of teachers and students by installing keyloggers on every machine. I could also allow access to this information for a hefty fee.
The possibilities are endless. Keep in mind, this is what I COULD DO. Not what I did nor what I intend to do. I gave rather detailed instructions here, but I can be far more explicit. :)
We're Anonymous Be glad we aren't dicks.