Printable View
hi,
i'm looking for an alternative command.com for windows 2000, a program which has the same capabilities but isn't recognized as such..
got to check if i can get past local policies which disables the command.
i've tried patching a command.com already, but with no luck ( since i don't know how it is recognized)..
any ideas?
Hmmm?
Is the CD and floppy drive enabled?
Do the local policies prevent all .com programs? (if not have you tried a renamed version?)
What do you think that users would do with command.com if they had it?
Cheers
hu?
command.com ? win2k?
commandlineinterpreter for w2k is cmd.exe, isn't it?
sry...i do not understand... you would like to run the dos/winxx command.com on w2k ??
or are you looking for a better working prompt?
then try 4NT.
http://www.jpsoft.com/4ntdes.htm
yes, cd and floppy are enabled,Quote:
Is the CD and floppy drive enabled?
Do the local policies prevent all .com programs? (if not have you tried a renamed version?)
What do you think that users would do with command.com if they had it?
no it does not block all com files, when you rename it it still gives the message " the command prompt is disabled by your admin".
and the command prompt has much more power than the gui, it is possible to share folders ,and to map drives, which is not anymore with the gui.
yes, it is cmd.exe, but this is already disabled, but then we found out that when you go to c:\winnt\system32 there still is a command.com, which still worked, untill now, but i need to know if it is absolutely secure.Quote:
hu?
command.com ? win2k?
commandlineinterpreter for w2k is cmd.exe, isn't it?
sry...i do not understand... you would like to run the dos/winxx command.com on w2k ??
i've tried opening it with a hex-editor and changed all the command.com lines to accesss.com, and also the file name itself, but it still is disabled...
so how does this work?
what is blocked exactly, not the name, but something else?!
If you have a good sys admin, he'll block you from running all exe except the one he specified
o.k. - this should work with any windows policies related executables:
with your hexeditor open [cmd].exe
search for:
50 00 6f 00 6c 00 69 00 63 00 69 00 65 00 73 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d
replace with:
50 00 6f 00 6c 00 69 00 63 00 69 00 65 00 73 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 7a 00 74 00 65 00 6d
i tested only regedit.exe, so pls tell me if it is working with cmd.exe , :D
At my high school, they have two different names for the MS-DOS command interpreter. COMMAND.COM and CMD.EXE. For some reason, the system restricted access to COMMAND.COM (which is a good thing), but still left CMD.EXE open. Also make sure that users cannot access the command prompt by going to telnet or ftp and typing "!".
p.s. I'm trying to fix my signature.
Our admin allows access to both. All in all, the IT people at my school are incredibly stupid. As I understand the original question, which is basically how to bypass administrator restrictions that have been placed on his/her account. They would like to access cmd.exe to do something they most likely do not understand and are not allowed to do.Quote:
At my high school, they have two different names for the MS-DOS command interpreter. COMMAND.COM and CMD.EXE. For some reason, the system restricted access to COMMAND.COM (which is a good thing), but still left CMD.EXE open. Also make sure that users cannot access the command prompt by going to telnet or ftp and typing "!".
-Cheers-
lol stranger! I love hex....BTW, NT, 2K and XP all have both a 16 bit command interpreter (command.com) and a 32 bit command interpreter (cmd.exe).
As for a better interpreter, I don't think you're going to get one. You can replace the command shell, but the interpreter is still the same, as it is a kernel mode process. But if you want a better shell (the best, IMHO), go with Cygwin . It's almost like having *nix on windows.
(They also have an X style GUI for Windows also called Cygwin/X )
Hi,
This is a pure guess, but when you run command.com you bring up what an old fart like me would call a "DOS box", or command line prompt?Quote:
what is blocked exactly, not the name, but something else?!
I think that it is this window that is blocked, which sort of makes sense, because if you let them get that far, you would have to block everything that could be invoked from it individually?
I suspect (pure guess again :) ) that you need to find where this window comes from? and perhaps check the registry.
Cheers
review...
disabled by your admin...Quote:
Originally posted here by lepricaun
yes, cd and floppy are enabled,
no it does not block all com files, when you rename it it still gives the message " the command prompt is disabled by your admin".
and the command prompt has much more power than the gui, it is possible to share folders ,and to map drives, which is not anymore with the gui.
so how he had done ?
>he used the user/group policies
exactly...there is a link to a registry key in the exe file that sets a "disable environment" for the logged in user.Quote:
Originally posted here by lepricaun
yes, it is cmd.exe, but this is already disabled, but then we found out that when you go to c:\winnt\system32 there still is a command.com, which still worked, untill now, but i need to know if it is absolutely secure.
i've tried opening it with a hex-editor and changed all the command.com lines to accesss.com, and also the file name itself, but it still is disabled...
so how does this work?
what is blocked exactly, not the name, but something else?!
on execution the program checks the registry for an existing policy key .
solution (as posted) :
edit the registry path in the exe file to a 100% not existing path: == enable the execution for "all"
that's not the case, all exe's can be executed except cmd.exe, tried renaming it too, but that don't work either...Quote:
If you have a good sys admin, he'll block you from running all exe except the one he specified
i'll give it a try, also with regedit.exe, and i'll let you know on tuesday, cause then i'll be at my work again....Quote:
o.k. - this should work with any windows policies related executables:
with your hexeditor open [cmd].exe
no it is not to do something i don't understand, read this thread:Quote:
As I understand the original question, which is basically how to bypass administrator restrictions that have been placed on his/her account. They would like to access cmd.exe to do something they most likely do not understand and are not allowed to do.
http://www.antionline.com/showthread...hreadid=254315
it has the same principle, just helping out....
and i'll give the cgi-bin a try....
i'll let you know if it worked!
as for the registry adjustment, i'll first have to get regedit to work again, before i can do something about this, so that's another problem...
Have you tried using regedt32 instead of regedit to edit the registry?
Remember...there is both a 16-bit and 32-bit version of almost every command in WinNT/2K/XP. If one doesn't work, you can always use the other.
yes 576869746568617, i've tried regedt32 too, also blocked, they are pretty clever!
But if they weren't then this wouldn't be much of a challenge, would it?!
ok lets get serious about this with the info im getting here im getting confused. while its not true that plain 'user' premissions disallow access to a cmd prompt these permissiom disallow access to regedit but you indicate you can use it. if you open the run command and enter gpedit.msc do you get "you do not have permission..." or do you get a console?
the "first" step in hacking anything is enumeration. in other words lets find out exactly what we're dealing with. is this the only computer you have access to at work? if not does the same condition exist at all computers you logon to? open the run box and enter 'winver'. what service pack is installed?
it is not the only computer, but the policies are set by the domaincontroller, so on which computer i login doesn't matter, i still get the same restrictions....
as for the run box, it's gone too...
so that's a bit of a problem....
yeah. the IT desk at my high school is pretty damn stupid too.
oh ffs, since when did AO ever help people trying to break/by-pass restrictions set forth by the admin!? I'v not seen any justification for this so I'm presuming we'r dealing with a 13 year old who want's to be l33t and hax0r the school some how.
If there are restrictions set on your schools network, abide by them, don't go trying to break them, chances are your being watched.
and your age??? eight???Quote:
oh ffs, since when did AO ever help people trying to break/by-pass restrictions set forth by the admin!? I'v not seen any justification for this so I'm presuming we'r dealing with a 13 year old who want's to be l33t and hax0r the school some how.
If there are restrictions set on your schools network, abide by them, don't go trying to break them, chances are your being watched.
no, i'm 25 and if you did some research before you come up with these types of accusations, you'd know this isn't neccesary!!!
view this threads:
http://www.antionline.com/showthread...hreadid=254315
http://www.antionline.com/showthread...hreadid=253958
and by the way, what is wrong with testing the security ( hacking ) if it is with permission???
for me it's ok
it took me just 15 minutes to get around thr restictions .... just should make the admin think about the security...
but i'm localadmin at work and ...uh...one of the networkadmins do smile at me every time we met
so i have to find out my limmits myself - with possibility of loosing internet access for all tere grouped users...so...think before you will act
btw... i'm coming to connect from a "blacklisted" server(gate) :))
Lepricaun,
Chill out mate :) some of us have been following your threads and see what you are doing. I have done the same myself in the past...........
I would be given a machine with user rights to see if there were any holes? the logic being that I was as good or better than the "best user" and that as I was on the development/project management/apps support side I was not really "tainted" with insider admin department knowledge.
OK I did help out on that side and have both local and sysadmin access, but that was not the idea of the testing that I did. It was pure security testing, really not that different, logically, from the systems and user acceptance testing that my guys would do?.
If you want to know how to break an application.............give it to a user :D
Cheers
Err, no, not quite, you see, you didn't acctualy specify your motives in THIS thread. I hadn't read the others, and I don't really care either, if you don't explain your reasons for wanting this info then you better expect to be told to **** off.Quote:
Originally posted here by lepricaun
and your age??? eight???
no, i'm 25 and if you did some research before you come up with these types of accusations, you'd know this isn't neccesary!!!
view this threads:
http://www.antionline.com/showthread...hreadid=254315
http://www.antionline.com/showthread...hreadid=253958
and by the way, what is wrong with testing the security ( hacking ) if it is with permission???
Have you attempted to spawn the process from another application that is allowed, for instance the web browser?
Also, what version of antivirus software are you using? Any way to exploit the update feature to spawn a system process?
What about running Windows Update (system privelages), then spawning a command prompt from the address bar using IE's explorer integration? (Of course, file system restriction may prevent this.)
Can you select "New Task" from the task manager?
does the local admin account autologon when the PC is booted into safe mode? Could a user use this to root the PC by adding a local account with admin access that has the same name as their domain logon?
Just brainstorming some ideas here.
lepricaun, actually i looked over your posts before i tried to help (although ive been none). but unfortunatly...as far as i can tell right now, if a computer is completly current with its patches and the command prompt is disabled along with command prompt script processing theres no way (that ive found so far) to escuate privilages in order to remove these restrictions because they all require a command prompt of one form or another.
i tried everything i can think of but if a machine is fully patched theres no vuln with which to attack from the outside and create a shell with system privilages. i made a shortcut and started netcat detatched and and set it to run a morphed version of cmd on connect. i could connect to it but when it went to open a command shell i got "the administrator has disabled the command prompt"....on netcat!!...thats allot of nerve
so now we know that a program can run detached as long as it doesn't try to open a shell. im going to try making a pl script to do "something" and compile it with perl2exe to run without a console. maybe that will work.
yes, i'm sorry about that Noia, i might have been overreacting, but i just had a bad day yesterday, had the flue with fever and all, so sorry for my reaction, please just ignore it!Quote:
Err, no, not quite, you see, you didn't acctualy specify your motives in THIS thread. I hadn't read the others, and I don't really care either, if you don't explain your reasons for wanting this info then you better expect to be told to **** off.
yes, but even the browser is restricted, for instance, when i type c:\ in the browser i get the message that this is not allowed due to restrictions...Quote:
Have you attempted to spawn the process from another application that is allowed, for instance the web browser?
perhaps, were using trendmicro's officescan, and although i did some research about this program, i haven't found anything usefull yet...Quote:
Also, what version of antivirus software are you using? Any way to exploit the update feature to spawn a system process?
not possible, all done automatically, we can't even select "no" when the automatic updates are installed and the pop-up box askes you if you want to reboot your computer.Quote:
What about running Windows Update (system privelages), then spawning a command prompt from the address bar using IE's explorer integration? (Of course, file system restriction may prevent this.)
No, cannot even open the taskmgr...Quote:
Can you select "New Task" from the task manager?
haven't tried that yet, but i'm sure it doesn't autologon.. but i'll give it a try tomorrow!Quote:
does the local admin account autologon when the PC is booted into safe mode? Could a user use this to root the PC by adding a local account with admin access that has the same name as their domain logon?
i've tried running netcat too to get a shell by using"nc 127.0.0.1 1500" and that also gave me a shell, but the only command i can execute is "exit" all others are restricted!Quote:
lepricaun, actually i looked over your posts before i tried to help (although ive been none). but unfortunatly...as far as i can tell right now, if a computer is completly current with its patches and the command prompt is disabled along with command prompt script processing theres no way (that ive found so far) to escuate privilages in order to remove these restrictions because they all require a command prompt of one form or another.
i tried everything i can think of but if a machine is fully patched theres no vuln with which to attack from the outside and create a shell with system privilages. i made a shortcut and started netcat detatched and and set it to run a morphed version of cmd on connect. i could connect to it but when it went to open a command shell i got "the administrator has disabled the command prompt"....on netcat!!...thats allot of nerve
so now we know that a program can run detached as long as it doesn't try to open a shell. im going to try making a pl script to do "something" and compile it with perl2exe to run without a console. maybe that will work.
and i think my administrators are doing their job really well, but that just makes it more interesting to help them..
( and for my knowledge of course, since i'm planning on getting a job as system administrator too!)
i've tried adjusting the cmd.exe , taskmgr.exe and regedit.exe to look at another location of the registry to see if they are disabled, perhaps this will help?! i know it tomorrow, and i'll let you guys know!
what about dosbox ??
http://dosbox.sourceforge.net/
it's an x86 emulator with dos ;)
lepricaun! i got it! i got it.....god dam i got it!
at home logged into an admin account. in gpedit i disable dos prompt and checked disable dos scripting...click ok. try running a cmd prompt..."your administrator blah, blah blah". click on the executable contained in here tcmd202.zip from this page http://www.jpsoft.com/download.htm#free and voila!
its a 16bit free command com replacement called take command, that opens up a win3.1 type gui. i type in ftp xx.xxxx.xx.xxx and a regular dos box opens and asks for a user name...holy ****! i enter cmd and get ..."your administrator blah, blah blah". hmm! type in netstat and it open a dos box starts listing. YES!
i haven't looked a the_JinX's link im sure thats just as good if not better. but this works. it will fit on and run from a floppy and bill gates can kiss my polack ass.
forgive me but this has really been bugging me...oh well off to source fourge! thanks the_JinX
Would this little proggie work?
It was a little 5 minute thing and I'm a sloppy programmer; probably it could use some work. I tried it out, though, and it worked alright. But I don't know how to disable DOS prompt or scripting in Win2k :rolleyes: so I don't know if it would work under those circumstances. I think it might not. Maybe someone could compile that and give it a go? Probably going with TedBob's method would be easier. Just my $0.02 ;)Code:#include <iostream>
#include <cstdlib>
using namespace std;
int main()
{
char *str = new char;
loop:
cout << "command: ";
cin.getline(str,50);
system(str);
goto loop;
return 0;
}
See ya later,
mjk
thanks all for being such a help!!!!
unfortunately i'm sick at home at the moment, so i cannot test anything yet at my work..
hope to be at work tomorrow though!
Tedob1, since you were able to block the command prompt with policies, can you test this cmd.exe for me? i've attached it and changed one character in the string of the registry at which the program goes to check if it is disabled or not.
btw, if you do not trust the program, which i can understand, then patch it yourself, just open it with a hex-editor and search for:
D.i.s.a.b.l.e.C.M.D.
right after this word you'll see a string pointing to a registry key, just change microsoft into microzoft or something like that and save the program.
that's all i did..
this should work too, got the idea from stanger...
but i'm sure as hell gonna try all programs that you guys gave me too, the more options to get through this, the weaker the security!
but that rises another problem:
suppose these programs work, how the hell can they be blocked too, cause otherwise i just found a leak ( with help of you guys ), but without the cure!!!!
The only way I know of is to disable removable media and to restrict download/email permissions to block all .zips, and the two executable files for take command. This is not a very fesable thing, as you may have a legit need to allow .zips, and the .exe files could always be renamed......
Now the real work begins!
at work they use zen works for desktops (novell),
only the novell delivered applications are executable...
there is no possibility of disabling removable media, or disabling downloading of zip, exe and com files, so for as far as i know, it has a leak which can't be closed, and i don't think they want to get novell to stop this problem...
and with novell, some other problems will surely arrise...
SO what is the real issue? The only thing you have done so far is maybe open up a command prompt...
The thing that I think you are overlooking, is that if the option to do something is disabled through the gui, it will also be blocked from the command line. For instance, you stated earlier that you could not map a drive or do anything like that. Just because you can now get to a command prompt doesn't mean that the "net" command will work for you.
The GPO policies that restrict sharing drives or mapping drives does not apply just to the GUI, it applies to the entire system.
This entire thread just goes to show the need for security in layers... So you can run a command prompt, that doesn't do any good if the only folder you have write permissions to are your user folders, with almost all of the other folders restricted to you. The only thing you are testing is how good your admins are, and how deep they took their security lockdown.
I'm pretty sure that most people on here will agree that if you can run whatever you want from a floppy and have physical access to the box there is very little that can be done to secure the machine. The real question is does it matter? So you have full access to a desktop machine.. Big deal.. Does it have any sensitive material on it? It shouldn't, and if it does you have a lot bigger problems to deal with than a user getting admin on a server that they have a legitimate login for.
I guess I just don't understand why it is that your company is paying you your salary to try and secure a workstation? It's just not that important.
My take on desktop security is that it needs to be strong enough to keep your system from getting infected with all of the different virii/trojans that keep popping up, and that it needs to keep the average user from screwing up the system by accident. In the cases of a snoopy employee who hacks into their own system, your HR policies should address those types of issues.
as far as im concerned the real issue is temp workers and disgruntled employees, not that i've ever come across a gruntled one. why lock down a workstation? so dishonest people hired as temps or unhappy employees aren’t able to access sensitive information and sell it to the competition they could even be getting payed by the competition to work as a temp using them as a reference to get hired at the target location. or a larcenist checking out your network security while under temporary hire.
its not a good idea for a security person to be oblivious to these things. once a command shell is acquired it's much easier to escalate privileges, plant backdoors like a reverse shell threw a shtml proxy, run a packet sniffer or just find out what’s there that can be exploited.
id like to point out that removing the floppy and cd and disallowing exe and zip files at the fire wall can in no way stop someone from getting an exe or any other type of file onto the computer as long as they have internet access and access to an unzipping util. its just a matter of encoding a file to a web page then copy and paste it into notepad.
yeah, you are right.Quote:
Originally posted here by lepricaun
there is no possibility of disabling removable media, or disabling downloading of zip, exe and com files, so for as far as i know, it has a leak which can't be closed, and i don't think they want to get novell to stop this problem...
and with novell, some other problems will surely arrise...
i do not wanna administrate such a network as we got at work...must be fustrating...
hey, you can do more with the command then with a gui, and the net command does work.
i do believe too that it shouldn't have to be disabled though, cause where is the trust?
and they are not paying me for this, it's just something i agreed to help with outside working hours...
i did it to learn!
and the cmd.exe doesn't work, but regedit and taskmgr does, only the regedit can view, but not modify....
gotta try something else...
hmmm...i will have a look into ntdll.dll
We are talking about a workstation though. A workstation should never have confidential material on it to begin with. It should be part of your security policy that all documents that are of a confidential or higher nature should be stored on a file server which is using some type of secure encryption. If you are not encrypting files that have sensitive or secure data in them, you have a lot bigger problems to deal with. It is also very unusual for people who are dealing with sensitive materials to share their workstations with temporary employees.Quote:
Originally posted here by Tedob1
as far as im concerned the real issue is temp workers and disgruntled employees, not that i've ever come across a gruntled one. why lock down a workstation? so dishonest people hired as temps or unhappy employees aren’t able to access sensitive information and sell it to the competition they could even be getting payed by the competition to work as a temp using them as a reference to get hired at the target location. or a larcenist checking out your network security while under temporary hire.
its not a good idea for a security person to be oblivious to these things. once a command shell is acquired it's much easier to escalate privileges, plant backdoors like a reverse shell threw a shtml proxy, run a packet sniffer or just find out what’s there that can be exploited.
id like to point out that removing the floppy and cd and disallowing exe and zip files at the fire wall can in no way stop someone from getting an exe or any other type of file onto the computer as long as they have internet access and access to an unzipping util. its just a matter of encoding a file to a web page then copy and paste it into notepad.
Ok, so you get admin access on a workstation and you are able to run a packet sniffer. A properly designed network would have probes that are searching for nics that are running in promiscious mode, and instantly shut those down, or atleast generate an alarm so somebody can go check it out. Or better yet, have something look for people that are sniffing the network as well as using switches to isolate traffic.
The worst case I can think of is that someone could plant a password sniffer and try to get the password of other people. But even this threat is easily turned into a moot point through proper procedures.
1) Make sure your admins have seperate user and admin accounts.
2) An admin should never log in with an domain administrative password on a client workstation. You have trusted workstations or servers that are used when an administrative login is needed. This way the worst you can do in terms of sniffing a password is get the local admin password on the client machine, or get the password of another client..
Even better yet, institute a tripwire type program to watch the files that are critical to winlogin to make sure they are not altered. This can very easily be done, and in most cases the person trying to hack your system is going to be unaware of the check being done.
But honestly, on a properly secured and patched system, getting just a dos prompt will get you very little. The main concern you would have is in dealing with a very sophisticated hacker, someone who has access to undisclosed expoits. But if this is the case, you are screwed anyway because they had you the moment you gave them physical access to the system.
The command may run, but if they are using GPO properly you will not be able to create a shared resource or map to a shared resource. But just the basic fact that you have run permissions on the net command shows that your administrators did not do their job properly. Or, as is the more likely case, they are fully aware that there is a vulnerability there, but the business model allows for the vulnerability to exist with minimal impact to the bottom line. The biggest thing about writing a security policy is knowing what needs to be very secure vs. what can be somewhat secure. You just have to make sure you have processes in place to deal with the minor security issues so that they don't turn into major issues.Quote:
hey, you can do more with the command then with a gui, and the net command does work.
mohaughn ....now your talken'. however i disagree that these faults are designed to produce minimal impact by default. they are not its up to the administrator to make sure they have minimal impact and that any infractions of policy are detected right away. to the best of my knowledge it takes third party software to detect a nic running in promiscious mode. if you can correct me on this i would appreciate it. too many believe that all one has to do is deny this any that and thats the end of story. if one isn't aware that this can be bypassed then the thought of layered security seems like un-necessary work. please dont negate the importance of threads like this by saying "big deal all they can do is ...". you seem to understand the importance of layered security. Me i had to learn it from boards like this and books. my employer dosen't want to pay for any courses at all and im sure im not alone in this.