Local Admin Account





Introduction: Local Admin Account

This instructable goes over how to theoretically go about changing the local root password on Mac OS X to gain full admin privileges.

This is my first i'ble, so please comment

*Hehem. Emphasis on the word comment

Step 1: Why?

Me and my friend discovered this while trying to beat the various sysadmins at my school.

As long as what you are doing is within the UN declaration of human rights, I don't care.

Step 2: Find a Mac

This only works on OS X (there are different methods for other *nixes), so first, find one.

As long as it runs a DARWIN-based kernel, this will work.

Step 3: Turn It On!

Turn on the Mac.

As soon as the screen starts up, press and hold {apple} + {S}.

From here a black screen with a lot of text pops up.

You have now entered single user mode.

Step 4: Single User Mode

After text has stopped popping up, type /etc/ rc/ .

At this point a huge amount of text will come at you at a million miles an hour.

When stuff has stopped coming up, press {return} and then type passwd root

Type in whatever you want the password to be, confirm it and after it says root password successfully changed (or something like that), reboot the computer by using the power button.

Step 5: Et Voila!

Sign in with the user name : root and whatever password you created. Congratulations! You have just beaten the demonic Sysadmins!

Please comment.

(I will add photos later)

EDIT: Added photos. Will have better ones when I get Hackintosh working



    • Creative Misuse Contest

      Creative Misuse Contest
    • Oil Contest

      Oil Contest
    • Clocks Contest

      Clocks Contest

    24 Discussions


    9 years ago

    Hey, this is a great instructable and is very informative. Just one thing is missing... pictures! It really helps a lot when trying to follow directions so you should consider taking some photographs. Once you do that and leave me a message when you have so that we can publish your work. Thanks! Thanks for the cool instructable and we hope to publish this soon!

    1 reply

    I recently inherited an old xserver dual-G4. there is also one method, of re-owning the mac that works similar.. In /Library , there is a file with the actual pass-key to install the mac, and, it also requires deleting one file, (name escapes me right now, system is at home).. Plenty of "How-To's" on the net on how to do this.. Apple turned what they used to call A/UX (their 68000 derivative of UNIX) into OS-X, but turned their backs on it once the iPhone became so popular, and began focusing on iOS.. Everyone decided they wanted ultra-portable, instead of lugging around their laptops. But, the LINUX world still lives, despite the cloud-ed world.

    How can I do this on os x mountain lion? I have a macbook air

    I feel your pain. Our school runs on Mac systems as well, but our District Level admins are pretty smart for school employees. They have blocked access to the Open Firmware (Single User Mode) with a password. Any ideas on how to get around that? I'm only asking for knowledge, I don't plan on breaking through their system.

    4 replies

    any idea on how to do this the other way around? (Block access to single user mode on MY mac to protect from this?)

    uh huh sure i looked at this becuse im helping my school we run linux mac and windows how screwed up is that i need this becouse the owners of the macs left without giving the password

    Yes they will when they unfourtunatly try to log in and the old password will not work.

    Good. Now I know where the useful files are. I hack Macs, like changing the background image on the login window. Good 'ible.

    5 replies

     Do what?
    Should be the same as for 10.3 and 10.4, and so stupid, it is a file-rename :-)

    If you have more things you could do in single user mode, it might attract more attention. I didn't even know about /etc/rc until you said so. And I'm the guy who has changed the .hidden file.

    Any knowledgeable "Sysadmin" will have the firmware password enabled and you won't be able to boot into Single User Mode.

    2 replies

    You'd think so, woudn't you?

    That said however, every time I've tried this on a school or corporate Mac network, it has worked. Go figure.

    And yes, it is a perfectly valid point, but at the same time, if they do that, then there is a lot to be said for trying a USBoot with something like #!, which will probably work.

    Firmware password also disables booting from any volume other than the currently blessed system volume. The bad side to it is that you can't use Target Disk Mode, boot from a recovery CD, or any other media either... I personally find it more of a pain than a help, but if you want a truly locked down Mac, then I guess you gotta do what you gotta do.