Xatrix Security

[RM Trojan.Horse]

Dear Xatrix Security Members,
My School has around 300-400 Computers. All running Research Machines software. All the computers are running Windows XP Professional as their OS. The thing that I want to change on RM is the fact that I can't open any .exe files and I only have 30mb storage. I am a Media Student so I need alot of HD space and also I want full internet access. My Plan is to take my Mini USB Keyboard and Notebook USB Mouse into school and plug them in and start up in Windows Safe Mode. My school has deleted the vital .sys file needed for Mouse and Keyboard on Safe Mode, hence why I am using USB. Once I am into Safe Mode I will then pull out my USB Pen Drive with the .sys file on and put it in the correct directory so I can then restart and use the schools keyboard and mouse and boot into Safe Mode. From safe mode I should be able to run any software I want. Please tell me any advice you have and wether this will work or not. Many Thanks.. T.H

[FreelanceX]

tbh ive never tried this. So give it a go and see what happens. If u have any luck, let me know as this is something which could be very interesting to research

[missi0n]

my school needs a password to get into safe mode

[FreelanceX]

try "rm" as the password... without quotations... may work. lol. it works for 75% of the bios's...

[missi0n]

lol, ok ill try that


today, i guessed about 5 staff account's passwords

one of them was an advanced staff member, lets me instaul things
and look at the C drive, i also have full unrestricted access to command prompt.


i dont know how to make my own account tho?

i tryed doonig it through command prompt but my school has a very confuseing server and their are about 5


tommrow im going to instaul Logmein to it so i can control the computer from my home computer

then i have more time to look around it after school

[FreelanceX]

u need to access RM Management console for this... the user needs management rights also... the admins have this...

[irksome]

If you want to create an admin user account for yourself, then do this:

There's two ways that I know of.

Method One

Log on as a Advanced Staff user. Is is up to you how you find this out. You'll probably have to either use the fake login screen in one of the other threads or obtain thier password through other means such as guessing or watching them type it in.

Once you're in, open the management console, and navigate to Users. There should be a "System Administrators" usergroup somewhere in this catergory. Create a new user in there with an inconspicuous username, like a normal student's name, then move it into the student usergroup. Log on with this new account and you'l have system admin access.

Method Two

I'm not sure, but I think the System Administrators folder is only viewable by System Admins themselves (I don't really use Advanced Staff accounts often, only really use admin accounts for this kind of stuff). So if the first method fails, try this. Create your new user in the student folder instead. Bring up the user properties, and click the "environment" tab. You'll see that the user type is "Standard User" with no management rights. Admin users do not have any user tpye at all, therefore no group policy restrictions apply.

Anyway, to turn it to admin, click the "groups" tab, then tick the little box at the bottom that says "Show all groups". There should be two lists of groups. On the left, the available groups. On the right, the groups that that particular user is a member of. Look on the right and there shold be about 4 or 5 groups, such as "Standard User Type" and "CachePilotStudents". Remove all of those groups. Now from the left, add the "Domain Admins" and "CachePilotStaff" groups. Once they've appeared in the right pane, save the account and log on with it.

There you go, system admin access. Contrary to popular belief, the admin accounts are not monitored by RM. There is one account that IS monitored though, which is the RM Technician's account. So keep well away from it. That's what my system admin told me anyway. That's the way it is in my school, other schools may be different.

REMEMBER - Should you choose to do this, it is of your own free will. I am not responsible for you fucking up your school network or anything like that. And for the love of God, do NOT get caught. This means don't brag to your friends, as word quickly spreads in schools. Seriously, it isn't worth the risk.

[FreelanceX]

thats a fairly decent explanation irksome.

Im going to put up a few screenshots of the console, so can show exactly what you have to do. Ofcourse, you need the password and username of an advanced staff with management rights.

REMEMBER: NOT ALL ADVANCED STAFF HAVE MANAGEMENT RIGHTS!

oh and to add to irksome's warning... there is a fairly big chance you are going to get caught... with all the tools RM Provide, i was able to track down a pupil who was breaking laptop screens just by tracking his activites...

SO BE WARNED...

[FreelanceX]

ok here you go... this is the link to show you how to use RM Management Console and where you need to go...

http://rapidshare.com/files/18610128/RM_ManCon.jpg

I have for obvious reasons removed server names and the web address... Also all the kids usernames you can see, have actually left... so no breach of child privacy etc...

[irksome]

Oh, and one more thing I forgot to mention. This is important for you hackers.

Everyone has little icons in thier system tray that look like this: or this:

If by some stroke of miracle you hack the wrong account and see this: - log off and go to another computer immediately.

That is the RM technician account. My system admin showed me it (yes, he's a good friend of mine). Apparantly if you that account is logged on while there is no RM technician scheduled to be at your school at the time, then the people at RM will be notified, then they will phone your school's system admin, and you can expect him to be tappin you on the shoulder within about one minute.

So keep that in mind