alternative command.com for win2k

**nihil** · February 14th, 2004, 06:51 AM

Hi,

what is blocked exactly, not the name, but something else?!

This is a pure guess, but when you run command.com you bring up what an old fart like me would call a "DOS box", or command line prompt?

I think that it is this window that is blocked, which sort of makes sense, because if you let them get that far, you would have to block everything that could be invoked from it individually?

I suspect (pure guess again

) that you need to find where this window comes from? and perhaps check the registry.

Cheers

**stanger** · February 14th, 2004, 10:05 AM

review...

Originally posted here by lepricaun
yes, cd and floppy are enabled,
no it does not block all com files, when you rename it it still gives the message " the command prompt is disabled by your admin".
and the command prompt has much more power than the gui, it is possible to share folders ,and to map drives, which is not anymore with the gui.

disabled by your admin...
so how he had done ?
>he used the user/group policies

Originally posted here by lepricaun
yes, it is cmd.exe, but this is already disabled, but then we found out that when you go to c:\winnt\system32 there still is a command.com, which still worked, untill now, but i need to know if it is absolutely secure.
i've tried opening it with a hex-editor and changed all the command.com lines to accesss.com, and also the file name itself, but it still is disabled...
so how does this work?
what is blocked exactly, not the name, but something else?!

exactly...there is a link to a registry key in the exe file that sets a "disable environment" for the logged in user.
on execution the program checks the registry for an existing policy key .

solution (as posted) :
edit the registry path in the exe file to a 100% not existing path: == enable the execution for "all"

**lepricaun** · February 14th, 2004, 11:33 AM

If you have a good sys admin, he'll block you from running all exe except the one he specified

that's not the case, all exe's can be executed except cmd.exe, tried renaming it too, but that don't work either...

o.k. - this should work with any windows policies related executables:
with your hexeditor open [cmd].exe

i'll give it a try, also with regedit.exe, and i'll let you know on tuesday, cause then i'll be at my work again....

As I understand the original question, which is basically how to bypass administrator restrictions that have been placed on his/her account. They would like to access cmd.exe to do something they most likely do not understand and are not allowed to do.

no it is not to do something i don't understand, read this thread:
http://www.antionline.com/showthread...hreadid=254315
it has the same principle, just helping out....

and i'll give the cgi-bin a try....
i'll let you know if it worked!

as for the registry adjustment, i'll first have to get regedit to work again, before i can do something about this, so that's another problem...

**576869746568617** · February 14th, 2004, 04:23 PM

Have you tried using regedt32 instead of regedit to edit the registry?

Remember...there is both a 16-bit and 32-bit version of almost every command in WinNT/2K/XP. If one doesn't work, you can always use the other.

**lepricaun** · February 14th, 2004, 07:34 PM

yes 576869746568617, i've tried regedt32 too, also blocked, they are pretty clever!
But if they weren't then this wouldn't be much of a challenge, would it?!

***Tedob1*** · February 14th, 2004, 07:59 PM

ok lets get serious about this with the info im getting here im getting confused. while its not true that plain 'user' premissions disallow access to a cmd prompt these permissiom disallow access to regedit but you indicate you can use it. if you open the run command and enter gpedit.msc do you get "you do not have permission..." or do you get a console?

the "first" step in hacking anything is enumeration. in other words lets find out exactly what we're dealing with. is this the only computer you have access to at work? if not does the same condition exist at all computers you logon to? open the run box and enter 'winver'. what service pack is installed?

**lepricaun** · February 15th, 2004, 01:13 AM

it is not the only computer, but the policies are set by the domaincontroller, so on which computer i login doesn't matter, i still get the same restrictions....
as for the run box, it's gone too...

so that's a bit of a problem....

**phase1retaliate** · February 15th, 2004, 03:29 AM

yeah. the IT desk at my high school is pretty damn stupid too.

***Noia*** · February 15th, 2004, 06:11 PM

oh ffs, since when did AO ever help people trying to break/by-pass restrictions set forth by the admin!? I'v not seen any justification for this so I'm presuming we'r dealing with a 13 year old who want's to be l33t and hax0r the school some how.

If there are restrictions set on your schools network, abide by them, don't go trying to break them, chances are your being watched.

**lepricaun** · February 15th, 2004, 07:11 PM

oh ffs, since when did AO ever help people trying to break/by-pass restrictions set forth by the admin!? I'v not seen any justification for this so I'm presuming we'r dealing with a 13 year old who want's to be l33t and hax0r the school some how.

If there are restrictions set on your schools network, abide by them, don't go trying to break them, chances are your being watched.

and your age??? eight???

no, i'm 25 and if you did some research before you come up with these types of accusations, you'd know this isn't neccesary!!!
view this threads:

http://www.antionline.com/showthread...hreadid=254315

http://www.antionline.com/showthread...hreadid=253958

and by the way, what is wrong with testing the security ( hacking ) if it is with permission???

Thread: alternative command.com for win2k

Thread Tools

Display

Posting Permissions