[Johhnydirk8]

OS:windows 11 education

Disabled applications: cmd prompt, local policy editor, registry, many settings

Antivirus: crowdstrike av

Available applications: powershell(non admin),
Task manager, uefi bios, anything online if on home internet( maybe a few blacklisted sites in local policy editor idk?)

---

Also it seems like all vpns and things like tor are disabled
SIGNED: OWNER OF THIS THREAD

[zprcymel]

Have you tried the windows installer usb trick?

[DramaKing]

Have you tried the windows installer usb trick?

I'm not familiar with that one, but it sounds like it involves a bootable Windows Setup drive, which on a school laptop...lol. That's going to be more unlikely than being able to open PowerShell.

I know some methods of dumping the Local Security Authority memory, but they all require admin. Probably isn't worth it to you, but maybe an encrypted version of Mimikatz or a keylogger.

[Johhnydirk8]

I feel like that would be suspicious if I had to go to tech support at any time.

---

If a teacher sent me

[DramaKing]

EDIT: Oh, and see if Safe Mode is available. Also try the usual privesc (privilege escalation) tools, BeRoot, LaZagne, Seatbelt, PowerSploit, SharpSploit. Oh, and if you can get a RAT past that CrowdStrike EDR, you can use it to gain admin / dump hashes.

Note that doing this stuff can be detected, and I would say that you'll lose computer privileges for a minimum of 9 weeks or be expelled. Be smart.

[KyFu]

OS:windows 11 education

Disabled applications: cmd prompt, local policy editor, registry, many settings

Antivirus: crowdstrike av

Available applications: powershell(non admin),
Task manager, uefi bios, anything online if on home internet( maybe a few blacklisted sites in local policy editor idk?)

---

Also it seems like all vpns and things like tor are disabled
SIGNED: OWNER OF THIS THREAD

Your best bet is to do a bootable USB drive with Hirens boot PE. Hirens gives you the ability to activate the "Hidden" administrator account on the local device (Since it's a school, It's best practice to assume they're utilizing Active Directory)
Use Hirens, then use Password Recovery and then select the local SAM file that it points you to, Unlock "Administrator" > set password > Voila. You're in as an administrator by typing ./administrator and then the password.

[Jadzia]

I'd triple think this decision to try to hack government property. I would absolutely go find something less risky to hack. Good luck at not getting caught though if you decide to anyway. :(

[DramaKing]

Your best bet is to do a bootable USB drive with Hirens boot PE. Hirens gives you the ability to activate the "Hidden" administrator account on the local device (Since it's a school, It's best practice to assume they're utilizing Active Directory)
Use Hirens, then use Password Recovery and then select the local SAM file that it points you to, Unlock "Administrator" > set password > Voila. You're in as an administrator by typing ./administrator and then the password.

Yeah, obviously, it's easy to do this on a personal PC to get admin. This is why every enterprise uses a BIOS password (well, strangely, my last job didn't) and probably BitLocker. OP is welcome to check if he has access to UEFI settings / boot menu, but any school IT person worth the name will secure that. 'Course a CMOS reset will take care of that, but, again, it's far from stealth.

[KyFu]

Yeah, obviously, it's easy to do this on a personal PC to get admin. This is why every enterprise uses a BIOS password (well, strangely, my last job didn't) and probably BitLocker. OP is welcome to check if he has access to UEFI settings / boot menu, but any school IT person worth the name will secure that. 'Course a CMOS reset will take care of that, but, again, it's far from stealth.

According to OP, the school is "lacking" security protocols. Either way, still too many disadvantages over any advantages OP would achieve.