RUN AS LOCALSYSTEM USER
NOTE:
this script has been scanned with virustotal.com and xcitium verdict cloud.
PYTHON SCRIPT FILE SHA1 VALUE - 1cb8bbcfd9b8fb7e412b0c3af50b7ae5d4bf48b7
JSON FILE SHA1 VALUE - e624a1dc3e4966de119dba02d3efde29ad62fb67
rename = "john" # give here the name
import ctypes
from subprocess import PIPE, Popen
def ecmd(command):
class disable_file_system_redirection:
_disable = ctypes.windll.kernel32.Wow64DisableWow64FsRedirection
_revert = ctypes.windll.kernel32.Wow64RevertWow64FsRedirection
def __enter__(self):
self.old_value = ctypes.c_long()
self.success = self._disable(ctypes.byref(self.old_value))
def __exit__(self, type, value, traceback):
if self.success:
self._revert(self.old_value)
with disable_file_system_redirection():
obj = Popen(command, shell = True, stdout = PIPE, stderr = PIPE)
out, err = obj.communicate()
ret=obj.returncode
if ret==0:
if out:
print("Successfully renamed the Built-in Administrator account")
print(out.strip())
else:
print(ret)
else:
if err:
print(err.strip())
else:
print(ret)
ecmd('wmic useraccount where name="Administrator" rename "%s"'%(rename))
Comments