Our school set default passwords for all new accounts as "123". Every year, we would maybe get 1-2 more staff with the same amount leaving.
2 months in, I decided to check if any of the teachers still had the default password set. Her username was easy to find out - it was just the initials of their name. So I attempt to login, and lo and behold I'm in!
I spent the next 20 minutes browsing the teacher portal, lots of boring stuff here but I got to find out this teachers salary and I was able to access the "book a computer room" page. Now, I don't know if you had this in your school, but if our none IT class wanted to access computers, the teacher had to book it in advance and we'd get to dick about on club penguin or something all lesson. So what did I do? I booked the next 3 months of classes in the computer room.
3 day external suspension.
Another time I started playing around with the network. There was this shared network drive which had all the domain controller stuff like wallpaper/default permissions etc, stuff that gets executed when the PC turns on. This folder you could only read from and not write - or else I would have changed everyones wallpaper to a dick or something. So I'm browsing this shared network drive looking at what I can find, and I find a permissions file. I open it up and I see that it refernces some tech admin's home directory. My logic was that if this shared directory could read from this dudes home dir, then I would be able aswell.
So I hit File->Create Shortcut -> to network w/e and input the details. I pray, I clench my butt, and I'm in! 1337 hax0rs unite and all that.
Inside his home directory there was various text files - FTP login details for the intranet, ftp details for the website page and various login/passwords for services that our network uses. I read a little about what happened to other people when they fucked with the FTP and as tempting as it was, I'd rather not get expelled for changing the schools home page.
Inside this text file contained a username/password to our firewall/antivirus/web blocker as well as the login url - thanks random admin techie! I login and I'm greeted with a web panel and full admin rights. I remember a big red button that said "Shut Off" which I could only assume would take down either 1. The web blocker or 2. The entire internet access for the school. I was in dangerous territory here so I opted to stay away from it.
After some digging, I finaly found the page I had been looking for - PERMISSIONS. This is where I personaly chose to add myself into the staff list and have full access to all of the internet - freedom at last! I could now play runescape instead of club penguin. I sold access to a select few people aswell, since crime pays an' all that.
Had full access for a good serveral months up to which point me and another guy fell out over some b/s and he decided to rat me out.
5 day internal suspension.