I'm bored, so i'm starting a new thread.


Surely everyone here can remember trying to get around the computer protection systems in place at their high schools for various reasons.

Some of you wanted to look at porn, but I just wanted to work without all the restrictions that the safeguards put in my face. See, I was in charge of updating the school intranet's html pages, and the lab admin never thought of giving me access to the drives, so I had to figure out my own exploits.

Here's what I did, and I never got caught either. They never suspected me b/c i didn't have special access, and neither did anyone else:

My old school had something called fortress installed on the lab machines (win98 in those days) that kept people from accessing stuff on the HD, CDS, or floppys. However, I found a huge flaw in the system:

By opening up internet explorer and typing A:/ or C:/ or what not into the address bar, I could easily access the blocked drives through the browser.

I could even open up windows explorer with that and get into the control panel and change the color schemes just for fun. My favourite trick was to make all the 3d objects in windows (that covers pretty much everything) white and I also made all the text white so it blended with everything else.

I wasn't out to cause damage or anything like that, I just wanted to annoy people and prove to them that their supposedly foolproof countermeasures were not worth a damn for having such a big security hole.


post your stories of the havoc you caused if you have any to share.

------------------
Old aunts used to come up to me at weddings, poking me in the ribs and cackling, telling me, "You're next." They stopped after I started doing the same thing to them at funerals.

[This message has been edited by Pagewizard_YKS (edited June 07, 2004).]

If you can't get past school security you need help. Atleast in my school anyway.

------------------
OSC Empire | A.H.N.U.L.D.
[Jim7 PING reply]: 666secs

Someone downloaded UT demo on my school's server. Happy days followed.

------------------
Snail racing: (500 posts per line)

-------@%

The Massassi JO/JA Single Player contest info

Someone told me the admin password that they use at my middle school once. Since I work in the media center at my high school and run the computers, my teacher told me the admin password. Took me a day to realize that it was the same one. I told her and she says they use it for the whole county. Turns out that Palm Beach County School District is the 3rd largest in the US. :|

------------------
A computer's worst nightmare:
0010111010011110210011010001

[This message has been edited by gammasts.]

My college have some pretty tight security.

They use a program called Novell and one called Winlock.

It's easy enough to get into control panel or the c drive by creating a shortcut to it. But you cant do much from within control panel since there are registry restrictions and winlock seems to close anything you can open.

There is no way to edit the registry to remove the restrictions like I did at High School (You could use VB through word or excel and unlock everything). But here if you try to read or write from the registry you get a permission error due to winlock. They also disabled the Task Manager so you can't end task stuff

The web filter, however, is easy to bypass. I use a program called OEMBrowser and for some reason it bypasses the restrictions completley (IE and Firefox are affected.)


------------------
WARNING: THIS POST MAY CONTAIN TRACES OF PEANUT!
----@%

I didn't have the heart to rename this system.bat and then replace the windows one with it

------------------
Old aunts used to come up to me at weddings, poking me in the ribs and cackling, telling me, "You're next." They stopped after I started doing the same thing to them at funerals.

[This message has been edited by Pagewizard_YKS (edited June 07, 2004).]

If you just want to be annoying, this is the winner:



------------------
WARNING: THIS POST MAY CONTAIN TRACES OF PEANUT!
----@%

[This message has been edited by TheJkWhoSaysNi (edited June 07, 2004).]

Ahh... Good times indead!

At our school (its BRAND new, only 3 years old), we had CS LAN games with entire classrooms. Not to mention the MANY ways we got around blocked pages, we pretty much used every exploit possible to get what we wanted. Its pretty tightened up now and we're all graduating (I'm coming back for extra courses) so we don't really care anymore.

------------------
[="Mothers stop cooking take off your aprons; Fathers stop looking at every sports station; Take a second, and think of every poor nation." - Nas=]

Massassian since: March 12, 2001

I tried that on my comp. Definitely annoying.



------------------
Old aunts used to come up to me at weddings, poking me in the ribs and cackling, telling me, "You're next." They stopped after I started doing the same thing to them at funerals.

I've done a lot of this stuff even since grade school... In grade 7 or 8 or something, I figured out how to send messages to other users. I only found it mildly amusing but the entire class ended up doing this all the time, and it was pretty stupid... I also figured out how to run QBASIC, which I would then use to generate a tone that would endlessly rise from 40hz... It always made everyone panic.

In high school, I can't even remember all the ways I've bypassed security... Some students didn't have internet access enabled because they hadn't handed in some permission slip, but you could access the internet from the login screen by pressing the start button. That was disabled eventually. I think I might've figured out another way to do this, but I can't remember.

One of the teachers actually showed the class a way to get past this by going into the internet options... I think that method ended up being used by just about everyone, and none of the teachers cared.

We've also had the thing with the C drive icon missing from My Computer, and it could still be accessed by typing C:.


File downloading was blocked last year, and the computer teacher/admin asked me to figure out a way past this, and within a few minutes I figured out how to download a large video file.

A bunch of new computers were set up that have Windows XP on them, and we quickly discovered we could access the control panel using Run in the start menu.


------------------
MadQuack has a signature.

Same thing happened with me and Netsend, flirb.

But oh man. My school is so much fun. I didn't know that the entire county was connected... And so one day I was floating around on one of the drives, and hit "up" instead of "back." Thousands of computer icons were listed...

Intreagued, I browsed through them. I recognized that the first two letters of each were the abbreviation for each school in the county. Then I found some that said "SPATTEND" (My school - Attendance) or "ANATTEND" (Annapolis - Attendance (another school in the county).

They all had passwords, however, so and I'm not brave enough to try to guess the passwords, for fear that they'll notice a bunch of failed login attempts and trace the computer... (Every computer in the county has a different name.)

However, I was as giddy as rat in a cheese factory that day.

Oh, I also discovered that you can get almost anywhere by using the shortcuts, but Run and a lot of places are blocked, I assume by the registry.

TheJkWhoSaysNi- What kind of code did you use to unlock things, and what kind of stuff did you unlock?

Webfilters were easy to block too. I use www.thecloak.com, but I was working on using my linux computer as a proxy, and just go through that. That would have been awesome, but I haven't had time to work on it further.

------------------
[16:38] Correction: dick tracy was a real man
[16:38] happydud: Actually...
[16:38] happydud: He wasn't.

[19:08] Dormouse: hi, my name's happydud and i'm passive-aggress.. SHUTUP!! *stabs nearby orphan*
[You have gained 3 Dark Side Points]

I feel ever so violated.

I never even bothered to try and fiddle with the school security settings (6 years ago now), as they had a foolproof system: 14k modems, win 3.11 and 386 computers. Waiting for the computer to catch up with you will hamper any hacking attempts.


------------------
This one day I went to change my password, but being the clever chappy that I am, I accidently typed the new pw into the e-mail address bar and clicked submit, hence the slightly modified new user name. Go me and my awesome computer skills.

I once changed the star button text on several lab computers to "gbk was here"....

------------------
Dear lady, can you hear the wind blow, and did you know
Your stairway lies on the whispering wind.
:wq

Ok, I'm on the other side of the fence in this situation. I'm one of the network admins at a private school here in Oz.

Using Windows 2000 security policies, we've got the student workstations tighter than a deep sea fish's bumhole. The local drives are read-only apart from a single directory. User's desktops are stored in their user directory on the network. The kids can screw up their own directory and nothing else.

In the very rare instance that a computer is screwed up - a reimage takes less than 5 minutes.

Admin passwords are kept private and the admin accounts can only log in to workstations in our (locked) office (different network segment).

We're pretty confident in our network security and challenge the kids to hack into it.

Raynar

------------------
Pagewizard_YKS: "making your own lightsaber doesn't make you a nerd... "

[This message has been edited by Raynar (edited June 07, 2004).]

I'm often playing JK on the computers. If we play MP, it's KWP -- weaps 4,5,7,9 own.

Otherwise, other ppl are playing Swat 3. Before that was Return to Castle Wolfenstein, and first was StarCraft.

Oh, I don't know if this counts, but when my teacher took away our cd drive trays, a few ppl successfully inserted the cd and continued playing. I had copied the JK installer on beforehand -- took him forever to find out that the GAMEDATA folder in c:\ was a resource folder for the installer .

But back on track, when he took the trays away, I started a nonviolent protest by pushing all the eject buttons on all 18 (?) computers for the cd drives and it made them all make whirring noises for a while. Then he started calling me "evil"...

------------------
for(i = 0; i < 00; i = i + 1) Print("massassi is good");
PrintInt(i); //print the integer value of infinity (if we ever get there)

[This message has been edited by Darth Slaw (edited June 07, 2004).]

wouldn't taking out the drive tray ruin the drive outright? Plus, a lot more dirt would get in there...




------------------
Old aunts used to come up to me at weddings, poking me in the ribs and cackling, telling me, "You're next." They stopped after I started doing the same thing to them at funerals.

No, these ones are removable (I think; ppl take them out all the time). There are two that aren't, so he left those alone.

------------------
for(i = 0; i < 00; i = i + 1) Print("massassi is good");
PrintInt(i); //print the integer value of infinity (if we ever get there)

Pfft, just give me a keylogger and a lockpick....

Sooner or later, you will have to type the password, and into my little friend the keylogger it will go. How often do you check your keyboard Ps2 port? Thought so.

A smart script kiddie would find a way to packet-sniff everything coming from that locked office, so the password could be harvested that way too.

furthermore, What's going to stop people from using a knoppix cd to access and change the hard drives via linux?


------------------
Old aunts used to come up to me at weddings, poking me in the ribs and cackling, telling me, "You're next." They stopped after I started doing the same thing to them at funerals.

[This message has been edited by Pagewizard_YKS (edited June 07, 2004).]

Bout the time that I had a class dealing with comps that year they decided to upgrade to Win2K... Without bothering to find out that the software we use for the class? Half didn't work and the other half... Well someone had misplaced the CD's... And since they had just upgraded the OS they hadn't gotten around to any software protecting anything... Yeah that lasted only the semester. Other than that for those pesky internet permission forms... They had something better than any software... The librarian (Only place anyone could wander in and use the net)

------------------
Ya know? Common sense? Not really that common...

Turn of boot off CD in BIOS... Password the BIOS

------------------
Ya know? Common sense? Not really that common...

[This message has been edited by Charlie (edited June 07, 2004).]

Sure, do that, and Ill get around it in 10 minutes flat.

------------------
Dear lady, can you hear the wind blow, and did you know
Your stairway lies on the whispering wind.
:wq

what about a knoppix boot disk?

That still lets you boot knoppix even if you can't cd-boot for some reason....

An admin would be a damn fool to disable both cd and floppy booting, b/c how else would they reimage when the comp gets screwed up?

------------------
Old aunts used to come up to me at weddings, poking me in the ribs and cackling, telling me, "You're next." They stopped after I started doing the same thing to them at funerals.

[This message has been edited by Pagewizard_YKS (edited June 07, 2004).]

By re-enabling CD booting for the time it takes to fix the comp

And I'm with GBK, password protecting the BIOS won't really keep anyone out. You can usually reset it by holding down a key (like CTRL or F1) while turning the computer on. Reseting the BIOS to default settings won't only get rid of the password but would probably turn CD-booting back on, so you wouldn't even have to actually go into the BIOS settings.



------------------
When guitars are outlawed, only outlaws will have guitars.

I (legitly) had access to the admin password for a few years, so that made things easily. Lacking that, there were always the student tech accounts, our personal rogue domain server (lots of fun there, let me tell you), and the good old make a shortcut to control.exe and drag the .cpl's onto it. Also, on the admin desktop, there was a plaintext file of all the user accounts w/ passwords. And I was more or less authorized for physical access to the servers anyway.

Goodtimes overall, it helped me to do my tech job and punish those who forgot to logout or who installed spyware.

Our school's computer network is made up entirely of Macs, so there's not much "fun" stuff you can do. Except for the Tech Lab, which has probably close to twenty brand new computers. And the best part is, our teacher is an Unreal Tournament addict, so we get to have a LAN game every once and a while. But back to the Macs. Our administration's idea of "security" is to put up a shoddy internet filter that only works about half the time they actually have it running (about 1-2 days a week). Oh, and the default password for every teacher's account is "248", and most of them are too lazy to change it. So consequently, bad grades have a habit of "dissapearing" in certain classes.

------------------
"I sound like angry chickens, or maybe a space robot."
-Les Claypool of Primus

This year was fun. Fun in the sense that we totally OWNED the security on those lame machines.

This year, for some ungodly reason, all of the computers purchased were hooked into the school system network DOWNTOWN, instead of the school's local network as they have been.

In the past, it was simple Novell stuff. Noone really cared to much about it, easy to bypass if you needed something, didn't restrict you to much. But this year, I can't even tell you what they put on there, but it was EASY to get past.

All the new computers are XP machines. You'd log in and nothing would be on the desktop. The internet was being routed though a proxy blocking virtually EVERY site worth seeing and half of the ones we normally needed to actually get an education (morons). Right click was disabled. You don't really realize how annoying it is to not have that in Windows until you don't have it.

Beginning of the year, a student managed to break the first part of the security. This became the backbone of everything else. She managed (yes, SHE) to find a spare network drive lurking about, completely empty. Just a drive, floating on the network. Then she managed via some other means (I suspect she did something at home then brought it to school) to get use full access to the contol panel. From here, we had a much nicer level of control. I began be changing the resolution on every computer I was forced to use like that to 1024x768 up from 800x600. I changed the background. I changed the system colors a little bit. All of this only applied to MY user login, which was the best part. As the year progresses, this network drive became the home to more and more items. After second quarter, we had the following on there: Winamp, FireFox (To regain some of the features that had been locked off in the system and thus in IE. Not to mention it's a better browser.), Trillian, AIM (For the idiots who hate Trillian), mIRC (For the idiots who hate Trillian), a full Control Panel, and Media Player. Life was substaintially better. I had one teacher consistantly refer to it as hacking. This consistantly pissed me off, as it's not so much hacking as it's defeating the lame security put in place. By the end of the year, pretty much right now, we had UT2k4, Halo, an assortment of ripped music, iTunes, and Photoshop Elements in addition to everything mentioned above. All on this network drive. This drive was a GOD.

Now for the kicker. Not but a month ago, another of my computer teachers got a new set of these computers to replace her ageing PIII IBMs. She accurately described it as replacing crap with slightly newer crap. Her exact words.

So she gets these, and one of the employees for the school system who takes care of the security paid a visit to fix something on one of them so she had admin access (Which, by the way, doesn't give her much more than what we get.). So he sits down near a friend and I. We both know all the ins and outs of this system. So we decided to somewhat loudly begin to talk about the restrictions and suggest back and forth the ways to get around them.

Me: "Man, if only I could listen to music..."
Him: "You can. Go under the I: Drive and then to the Program Files and open up Winamp."
Me: "Really? Cool!"
Him: "Now if only I could right click to download this image."
Me: "Go get Firefox, it's on the I: Drive."
Him: "Wow, that was alot easier."
Me to a guy across the room: "Hey Jon, are you on AIM?"
Him (Guy next to me): "Jon, go to the I: Drive and open up Program Files and launch Trillian. You'll need to set AIM to port 23 to get past the proxy."

This went on for about 20 minutes. The teacher sat there smiling, not saying anything. This employee initially ignored us, but he gradually started paying closer and closer attention. Finally he walked over and asked me to look up a site for him. I had everything closed, so I go to the I: Drive, I launch Firefox, I enter the URL for our proxy so I can bypass it and see whatever the hell I want (http://www.nocensor.citizenlab.org/#4.5 for those interested. Massive list. Most work.) they had been hunting these down all year, but the site I just mentioned was a gold mine, if they found one, I found another within a few minutes. So I do that, and he asks to see this site. So I plug in the site, and it pops up, no restrictions, and by god you should have seen the look on his face.

PRICELESS.

They shoved all that stupid crap on there to make it secure, and we found ways around all of it. Then, to add to his expression, which I was rather enjoying, I went looking for a new background at Deviant Art and then loaded it on screen with the Control Panels.

He packed up shortly after that and left. He didn't look to happy.

So, they put security on our computers, and we proceeded to own them at the end of the year with all the back doors.

Security my *** .

That is all true.

------------------
Frogblast the Vent Core!

--End of Line--

Thats awesome!

And how do you do that I need to know dammit!



------------------
Run Away!!

Err, its a resource hack. Load up explorer.exe in any resource editor... Its one of the string resources, but Ill be buggered if I could remember which one...

------------------
Dear lady, can you hear the wind blow, and did you know
Your stairway lies on the whispering wind.
:wq

That's what Google is for.

------------------
Frogblast the Vent Core!

--End of Line--

If you managed to break into our office, install a keylogger, and break in yet again to get admin access, then congratulations, you've been nabbed by the passive IR sensors and security cameras. Wave and say hi!



A script kiddie cannot sniff passwords here - everything transmitted is packet encrypted, nothing is sent in plain text.



Booting via CD and floppy is disabled in the BIOS which is password protected. Yes, I know that there are utils out there that can crack BIOS passwords. This will keep out the average script kiddie.



Here, quick reimaging is done from a second hidden partition (gotta love XOSL). Using Ghost to dump from one partition to the other - lightning quick, and no boot disk needed. If the partition table is screwed, then we just temporarily enable CD booting.

Raynar

------------------
Pagewizard_YKS: "making your own lightsaber doesn't make you a nerd... "

Okay, plan B: dig a tunnel.

Also, there is no such thing as foolproof encryption. If there is one thing the scene has taught me, if something can be encrypted, then sooner or later it can be cracked.

Even security cameras have blind spots. Give me about 10 minutes in that lab and I could probably create a diagram later that shows the blind spots on all cameras.

As for the IR sensors, I can smear myself with mud. Hey, it worked for Arnie in predator.

------------------
Old aunts used to come up to me at weddings, poking me in the ribs and cackling, telling me, "You're next." They stopped after I started doing the same thing to them at funerals.

[This message has been edited by Pagewizard_YKS (edited June 07, 2004).]

[This message has been edited by Pagewizard_YKS (edited June 07, 2004).]

Brah, i am jsut 1 year removed from middle school and my boys would look at porn at our middle school

------------------
The original gangster is I

This explains much.

------------------
Dear lady, can you hear the wind blow, and did you know
Your stairway lies on the whispering wind.
:wq

My school had Fortres 101 on the Windows 95 computers in my first hour typing class freshman year. It prevented access to the hard drive, IE, Control Panel, Run, etc. You could make a hyperlink in Word to the C: drive, rename or delete the Fortres folder, and restart into a freed desktop.

The library computers allowed internet access but seal off the hard drives and disabled right clicking. Strangely, they left the link to My Documents on the Start Menu. From there you could make a shortcut to the hard drive and do whatever.

After a couple of friends and me found and popularized such methods, they basically gave up. Everybody knew practically everything. By the time I graduated I had a dozen passwords memorized, including the network administrator's (unfortunately, the last became public knowledge and was changed).

Now I work for the school. I get paid $6.50 to run Windows Update, ghost certain hard drives, set up new labs, and install annoying software like Fortres on various machines. I have a copy of the master key. I'm responsible. It's amazing how quickly I shifted from being egalitarian to being pro-meritocracy.

Raynar: Many/most motherboards have either an accessible battery or CMOS-clearing jumper. Gaining access to the BIOS only takes physical access.

this kid is a joke...

I can tell that you're here just tryin to get at me or somethin...

its cool though. If someone here wants to try so hard to ride my d*** then that's cool.

I just find it funny that you're tryin that hard.

I can tell you're fake

------------------
My Life.
My Tracks.

You're in 9th grade (MAYBE 10th) and you have children that look at porn? Not only that but you knew they were doing this at school? Sick freak.

------------------
There is no signature

lmao I was lookin at porn when I was in 6th grade...

not in school, but at home.

A lot of kids did... back then cyberin was new too

------------------
My Life.
My Tracks.

Meh. Pr0n is overrated.

We just have evil stuff on our machines, mainly protected by Websense, and we've got two years to beat it before we leave the school. I think you can modify the proxies in IE... hehe. Our school has very little if any protection on drives. I just want to get my own back on the w***** Fielder, who thinks he's the uber at technology and computers. I'm not the best, but I'm one of the best.

Oh, and the second-in-command of the IT suite is like 19 and he's already got around £500,000 through successful running of web companies and selling them on later.

------------------
Violets are blue, roses are red, living like this we were already dead.

Sir, do you honestly have any idea how dumb that phrase makes you look?



This depends. At my school, you HAD to have the proxy set up the way it was, otherwise you couldn't get to the outside world of the internet. You may be able to do otherwise. But if all you're looking for is a way to get around the blocks placed on sites, go look for a proxy server (I forget what the heck their real name is). Examples: http://nocensor.citizenlab.org/#4.5 There is a massive list of them right there. Our "secutiry" people tried to crack down on them and blocked the first 5 we used, then we found that site. They block one, we have another that same day. God only knows why they haven't just blocked the main domain.

------------------
Frogblast the Vent Core!

--End of Line--

i have found so many exploits, currently, i am very frustrated b/c our school has just gone to XP and put on some phanominal security systems. now we can safe only to a floppy disk or the network sahred my documents folder. the problem is floppys are too unreliable and the network is the playground for morons who like to delete and alter files ARRG!

------------------
DUU BistX0rz ein N00b!