I got in trouble for a bunch of things. I wrote a utility that was supposed to cover up the "system tray" clock (with an identical one with context menu) so I could run command line apps on school computers, but the system thought it was a virus. (I guess Delphi 3 apps named iexplore.exe are suspicious? :P)
Then I embedded the Game Maker installer in a Powerpoint presentation, since it was one of the few ways to be able to run a foreign exe (along with zip files, but they are more obvious targets and they're more likely to inspect them).
Then I exposed (didn't exploit) a serious XSS issue in the school's VLE, which of course they gave me a final warning for.
Edit: The School's IT policy, previously a single A5 page, became two-and-a-half A4 pages thanks to me.
At my school for whatever reason I was able to change for whatever reason the hosts file. I changed the popular mail service to redirect my clone site to collect passwords... I got caught in a week.
For some reason I still don't understand today, 9 of us in my high school programming class had read permission on absolutely everything. It was only students numbered "01" through "09" in that particular class -- I checked the border conditions in a very OCD-style.
Then I embedded the Game Maker installer in a Powerpoint presentation, since it was one of the few ways to be able to run a foreign exe (along with zip files, but they are more obvious targets and they're more likely to inspect them).
Then I exposed (didn't exploit) a serious XSS issue in the school's VLE, which of course they gave me a final warning for.
Edit: The School's IT policy, previously a single A5 page, became two-and-a-half A4 pages thanks to me.