For all you students, windows 2k work around

Maybe you all already know this but here it is anyways.
I go to a Technology Magnet school (big whoop), now at my school they have fortres101 on the computers that are running windows 98, how ever in out oracle lab they are running 2000 Pro, now with fortres101 you can get around it, just by going into the web browser and typing in c:\ and it'll give you list of the hard drive and let u surf it like an FTP, how ever if you try this in 2000 with the web browser with the security measures in place you'll get an error like "You do not have the permission to go there" or something like that, so here is how you work around it. Open up the Browser and type this location "file://c|/" that should get you into the hard drive and allow you to see the contents, and run programs like cmd, and games that thoes mean old teachers disabled, I don't know if you can run the programs I didn't have the time to check it out.

You can also do something similar with the help menu. And I asked one of my teachers why security at my school was so lax and he was like "the computers are to learn on, we've had our Shell server hacked a few times and it took the admins an hour or two to restore it, we have tape backups and nothing important was ever lost, it's a learning tool nothing more."

you can also go into notepad, click open, and Type C:\ in the file to open box. Just set it to view all files. Right click and click open.

I have no doubts that you can do that, but here is the thing, any possible combonation that you can think of is disabled, (I.e: Right clicks are disabled, Crtl+Alt+Del is disabled) they though of almost every thing,

How in the world do you get any work done on an Windows machine without being able to right click and get to the context menus? This may be an example of taking security just a little too seriously.

Im taking a guess but what happens when you go into safe mode with network support...?
It might work, but then again...

Right click is enabled on our server. Security is bad though. They can only see what computer is doing what, not who is doing what.

Redbone > actualy I think Phoenix ment that you cant right click the desktop itself, so you can't mess with the Wallpaper or Screen Saver. My college has the same thing, which can be a real pain if you need to change the screen resolution to view a program or webpage properly.

Thanks for clearing that up, Syini666...but I can still see how that would be a pain.

I go to a tech high school/college and for us freshman in HS, we use 2000 pro. The only thing is that, there arent as many buttons to click on the menu. Also, we could see all the contents of the hard drive (since theres only school stuff in there) and the right-click is enabled. We have very few restrictions and we could do whatever we want with the computer as long as it helps with our work. It depends on what institution you go to. We run on a T1 with two Netgear routers.

I think it’s about time schools stopped treating all students like juvenile delinquents and remove all security measurers form computers and put them back on if a student doesn’t act responsible. Respect gets respect. Security measures = challenge.

It’s easy enough to make two ghost images. One locked down tight and one not.

programs can also be run using the task manager

My school desided to password everything..
They have a program called deepfreeze that made me made in particular...
It just made it so you couldnt save to hard drive without it getting deleted on reboots, pretty much makes you save to your "student folder" on another networked drive.
Anyhow, there was a little dialogue box that you can open up to turn this program off. So i was messing around and for fun I tryed using the shortform for the school, KDSS, then the shortform of the regional board, BWDSB, well BWDSB was the password so i am in full control. Try the shortforms if you get passwords, they work well

Some people may loath programs like deepfreeze but I love em. At the college I’m attending it’s on all the computer and if you sit-down on one that’s screwed up you just pop the reset button and away you go. No waiting for the computer to be re imaged or fixing it you’re self. Also it helps prevent things like cookie stealing and keyloggers. Once I sat down at a school computer that didn’t have deep freeze on it and decided to take a gander in the cookies folder. There were hundreds of cookies for about every site you could imagine.

My school uses 2k Pro, and we used to be able to get to c:/ by a couple of ways :
1. Setting the browsers homepage to c:/ <---- soooo easy
2. making a VB prog that opened windoz explorer at c:. even do it in word
shell "c:/winnt/explorer c:",vbNormalFocus <-- from memory, could also get a command line from there by running command in c:/winnt
3. If they have turbo pascal on their computers, you can get a DOS command line from there which you can navigate freely around the disk.

good old getting around crappy school security

Im currently in Computer Networking Tech. and the samething is happening there. They threw up what they thought was a good security, like removing Command.exe and the screensaver and background. All I did was hit run and typed in Command and WHALA command came up. For the Background all I did was right click over a pic and changed that boring pic of theres into an awesome one. I told my teacher that his security technology really sucks and then showed him why, when I ran FDisk. Dont worry I didn't follow thru with the command, but it did open his eyes.

Wow, hey look, a anti security thread in a security site.
hmm. *rolls eyes*
Im on the other end of the spectrum. I have been charged with securing brand new dells in a public library. Some of the measures I have to take are absurd. These kids are so bad that if they cant maliciously tamper with the machine they resort to physical damage.
However if they have free reign of the machine, they think it funny to find the most offensive sites they can, turn the speakers up and run obsence videos, musical songs, and anything else to proove how "cool" they are.
Since the library is under federal funding the answer isnt just throw them out - you cant.
the federal funding says free and unobstructed access to net content.
then we have the crowd that is over 18 that does the same things.
they loved to save to the hard drive, again the most obscene filth they can etc.
My point here is, as SOME places SEEM to go nuts with their security, a lot of them really have a reason. yes, ghosting would be good there... but Im not there nearly enough and they dont know anything about it.

A lot (not all) of the threads here are kiddies passing back ways to "hack".
I think that we need to end this thread...as I dont see anything of real value coming from it.

I'm sure you could use arbitrary code injection to kill fortres101 process' ?

Someone correct me if i'm wrong- If you can run an APP (via, ie>> "a:\app.exe") then you can most likely gain admin rights on that local pc. Questions/ COmments? Again- i restate that i may be incorrect. :-)

SAP training centers in the past locked you out of the drives and block the run option -to get around that you open winword and clicked open. In the open dialogue you would find the file in question (ie explorer.exe) right click and select send to command line. I think this was done on the NT systems -its been awhile.

Cheers,
-D

IMHO: security should be as max on school computers as possible. Why? Because there is such a huge number of dumbass idiot kids who think that because it's a school computer, it's their's to screw around with. I can't tell you how many times I've had to fix high-school computers (as a student tech) because someone was dicking around with it. Not to mention the p2p programs (kazaa, morpheus) which install spyware and other things, viruses, and of course, programs. Not to forget about BO and the like which then could mean the computers could be a part of a DDOS attack somewhere else. What happens? The school gets sued or has charges pressed against it by the victimized party and **** goes downhill from there. All because a student (or a few) decided to "have some fun"? Screw that noise...

Quote:

---

Originally posted here by tampabay420
I'm sure you could use arbitrary code injection to kill fortres101 process' ?

Someone correct me if i'm wrong- If you can run an APP (via, ie>> "a:\app.exe") then you can most likely gain admin rights on that local pc. Questions/ COmments? Again- i restate that i may be incorrect. :-)

---

No: the shatter attack makes priviledge escalation possible ONLY if the app in question is running under a priviledge account (system or administrator).


As for the whole security thing, the way I see it, I don't care if students are able to get to a command prompt on the comptuers in my labs because NTFS (and registry) permissions are set intelligently on win2000. So they might browse arround but most likely cannot do much harm... Also, using group policies, you can restrict most/all "potentially dangerous" functions...
As for students playing or using other apps during courses, I pretty much leave that up to the teachers... hell, they're not paid to sit there and do nothing during computer lab periods...


Ammo

Where I work, we run a win2000pro shop in our labs with deepfreezeNTFS. Additionally, we used to use roaming profiles to allow settings to follow users around, but we had to cut it due to high corruption rate. Our reasoning for "locking down" our computers is to provide a uniform experience to all users which is simply impossible in an open environment. Once society grows up and leaves behind the need to do childish acts, then perhaps we can move to a more open environment.

||Does anyone have suggestions on how to keep users settings w/o the use of roaming profiles? ||

Quote:

---

Originally posted here by wyverspur
||Does anyone have suggestions on how to keep users settings w/o the use of roaming profiles? ||

---

Do you mean mandatory profiles? If so in w2k group policies work wonders...

Ammo