cybercafe pro --DANGER--

i need some help i work with my sister and brother-in-law and he runs a cybercafe and he use's cybercafe pro and i have found a flaw. in the way that userdata ect is stored.

so i think i found a way that someone witha little programing know-how could use the way he runs the shop to gain free access and time.

(AN KNOW IM NOT A LITTLE KIDDIE TRYING TO GET ONE OVER ON PPL)

i want to show him that it can be done and that he need to make ajustments the the network and the way he runs the shop.

so i would like someone to help me write a little programe that will enable sharing on a folder with this path ("C:\Program Files\cybercafe\DB\") want to share the DB folder and once i have showen my brother-in-law and made changes to stop this then i am going to report the bug to cybercafe pro so they will make a patch

well thnx for your time hope you guys can help.

cya around

Why not report it to cybercafe first, then they write a patch (they have more skilled programmer) and your brother in law just updates the software ???

no it takes them months to write an update and i want my bro-in-law to change a few setting to stop ppl exploting the us

Since CyberCafePro seems to be a Windows-only application, I assume that
your brother-in-law is using Windows XP pro. And the customer will have some
"limited user" account.

If this is the case, the "limited user" will not be able to create a share on some folder,
at least to my knowledge.
In addition, if read/write-permission on that folder is denied to "limited user"s, there
seems to be no way to make use of a "security weakness", if it needs to enable a share.
(eg assuming that Windows xp pro bootet properly...).

However,I would report it to the developpers anyway.

Side-remark: You do not need programming skills to create a shared folder.
A little googling would have pointed you to [1].

[1]http://www.microsoft.com/windowsxp/home/using/productdoc/en/default.asp?url=/windowsxp/home/using/productdoc/en/net_share.asp

Quote:

---

Originally posted here by dustybunny
no it takes them months to write an update and i want my bro-in-law to change a few setting to stop ppl exploting the us

---

Have you reported this bug to Cyber Cafe? If its important enough, they might try to release a patch soon.

my bro-in-law puts cusomer floppy's & cds in the computer if the customer needs to print, so if someone made small script or programe and made it auto run, when he puts the cd in it will run the programe that would made a shared folder and then they could access the database.

now i have a little programing infor from college but my bro-in-law dont think it is possible and that im being over protective but i dont think i am.

and i know that the database can be edited in ms access. the database is not even passworded protected .

i have contacted cafepro about it but they dont seem to care.

Have your brother-in-law try another type of Internet Cafe software. I used AntaMedia's softare and loved it. The features in it are great and its very easy to use. It also allows you to monitor suspicious users and allows you to sell stuff such as Sodas or Snacks. The new update is very cool as well. You can advertise specials or sponsors of the cafe with a toolbar at the bottom. The toolbar does not get in your way when you're playing a game. You can also sell time codes to customers and create a subscription based service ;).....VEEEERY useful. I had customers that came in and played 5-6 hours a day so I'd just sell them 100 hours making it a lot easier for them to get on.

http://www.antamedia.com/caffe/download.htm

As far as your issue goes: I understand that you're all excited because you found a flaw, but you need to understand that it is best if you leave professionals to handle the patching. To prevent others from getting free internet access, you can walk around the cafe and just keep an eye on people. Also check your clock whenever you assign a computer to someone, and check if they've been on longer than the time you assigned them.

Again I agree with the advice that if you found a flaw, just show it to Cyber Cafe.
they will search a patch. It's useless for them to use a patch maded by someone else.
If they don't react, just go to your brother-in-law and really show him that you have free acces to his database.

and second, there wasn't even a password for the database? You are sure it was someone who runs a shop with a lot of computers and internet?

I would have to say, there is no point in creating an exploit to prove something that really doesnt need to be. if their is a flaw, there is a flaw, your brother can accept that and fix it on his own means, or he can ignore it. totally his choice. one way or another he will learn the hard way. in reality its not your concern, if the systems all go buggy you still get your pay check at the end of the week???


CTO