Xatrix Security

[Xcellerator]

RM stores a list of exes that are allowed. If you were to rename a stand-alone exe file to 'iexpore.exe' would you then be able to run the file? If not could you then just use cmd to copy it to the system32 folder? Then you could create a create a shortcut to the file and it would search system32 automatically. Obviously you couldn't name it something already in the system32 folder...

Or maybe you could...

[muto]

As for as I know, RM (CC3 at least) doesn't whitelist .exe files to run, it's almost impossible to maintain a list like that. I've seen blacklisting (no regedit, msconfig, etc), but normally they just don't allow you to execute files that aren't on C:, and you don't have write (or view) access to that drive, so you can only runs files that are already on the computer.

[Xcellerator]

But using the CMD Reg shortcut you can access the C: drive from cmd, and copy files to it using the copy command. Could you just copy a exe and appropriate dlls if needed to the C: drive and then create shortcuts to them?

[jd2kuk]

From my experience, yup. I've done this, and I've heard of others that have too.

@muto- I'm pretty sure write access is there by default.

[ICT Tech]

@muto- I'm pretty sure write access is there by default.

We don't give students permission for read and write access to C:\ it's also hidden from student users profiles.
Although there is a workaround to get read access, I don't know of any (or at least can't remember) for write access

[Xcellerator]

I used that cmd reg add shortcut and I can access C: from cmd only...

[PDN]

I know someone who goes to a school which uses Fronter as a VLE and to download a file, it uses a java applet. This applet lets you see all hidden drives/folders because it doesn't adhere to policy settings. He then uploaded an exe onto fronter and downloaded on to the c drive without any problems and then he created a shortcut for it and he was running an exe file!

[Xcellerator]

That sounds like a great idea, I wonder if someone could create a .jar file to let you copy files from drive to drive with a nice GUI interface, not a command line...

My school uses fronter too, after my admin started scanning our accounts for SWF files, I uploaded them to fronter so they can;t be blocked, I don't even need to download them, I just have to click on them and they load in IE...

[heebyjeebys]

if you knew the admin password then you could use some group policy mmc snap'ins to disable the objects.

[ICT Tech]

if you knew the admin password then you could use some group policy mmc snap'ins to disable the objects.

Yeah, more than likely!