I remember someone (not me, oh no...) used one for NT4 with inadequate policies to get Admin access.

Create a batch file with the content:

net localgroup administrators NewUser /add

...then stick this into the 'StartUp' directory for All Users. Break something. Call support. They log in as Administrator, running your batch file in the process.

NewUser would be created with Admin rights. You wouldn't promote your own login, of course.

Of course this is only possible if FileVault is disabled, otherwise you would not be able to mount the hard drive without user's password.

To ward off the dummy 99%.

You can't stop a guy who knows what he's doing, but you can stop Josie from the next desk snooping around in HR's file. Also, it causes a breach, which depending on where you live might be needed to show intent.

You do not want that binary that you have downloaded to be able to do a privilege escalation without your consent.

Also, some people may feel like changing your wallpaper to something inappropriate, but they may not be motivated enough to hack your pc.

I can't remember it correctly but there is a saying along these lines:

most people would open your door if there was no lock on it. Eventhough it's useless.

Same reason we put locks on our doors. If someone is really serious, he or she can (destructively) break in. But a locked door will prevent someone from casually getting in.

You can do this with a phone or tablet (Android). That's essentially how many root exploits are accomplished, boot into the default recovery (typically hold volume up during power on), run a script, and recovery replaces key files which are used later to provide you with root.

This is less common NOW, but back in the Android 2.xx days it was the defacto way of getting root.

The Repair Tool requires unrestricted physical access, it is running as administrator. The same way that a Live CD could.

> Do you really think that startup repair mode is required to swap the position of cmd.exe and sethc.exe?

A Live CD/DVD would work just as well. As would a USB-based OS. You could also (although it would require more work) use network boot to run your own code.

There's no vulnerability, this is unfixable, you just have to secure the system using full disk encryption and secure boot.

No, it's not, because sethc.exe resides in %systemroot%\system32 - an area that is protected by ACLs, only allowing regular users read access. Going into startup repair mode grants system-level access to files there. Without repair mode, users cannot swap these files.