Does your school use lightspeed? It conveniently has an admin panel accessible from virtually anywhere on the domain if you just have the administrator user and pass. To get that, try breaking into the domain controller. I got into mine via the insecure tftp boot they have set up for imaging. They had an administrative account stored in the config files that you can use to log into the samba share and then obtain SYSTEM/SAM which has the local admin account password hash in it. And from there you can probably remotely log into the DC and grab ntds.dit assuming your school uses active directory, then just get the user and pass and unrestrict yourself on the wifi.
