A challenge for me, a challenge for you
Jun. 4th, 2003 01:56 pm![[identity profile]](https://www.dreamwidth.org/img/silk/identity/openid.png){kind=small}
hoffman-log.livejournal.com posting in ![[community profile]](https://www.dreamwidth.org/img/silk/identity/community.png){kind=small}
techrecoveryHey guys. Haven't posted here in a long time, but I have a good one for ya. Now, I know this isn't about bitching about crappy customers, but it's an interesting chance to test your skills, and possibly make some money too. My network teacher last year seems to enjoy doing these "challenges" where he sets up a system to be "unhackable" and offers a reward to anybody that can hack the system. Here's the specks.
The machine is protected by Hard-Guard. Read up on it. The basics are that any changes you make on the computer are lost once you reboot.
The system has a BIOS password. I have successfully passed this. The system setup password, however, is different. I have not yet cracked this.
The computer is a Dell Optiplex Gx1, BIOS version A07.
The computer will not boot into the OS. You must get past Hard-Guard first (so technically anything after this would be pretty much easy to do).
The CD-ROM is disabled (in the sense that the power cable is unplugged)
Same thing for the floppy drive, also the zip drive
Wake on LAN is disabled
I cannot make any hardware changes (like opening the case and removing the card)
Last year I was able to get around this simply by popping in a CD and re-installing the OS. Going by the above information, that's not possible this time around. So I've been trying a few other things, like hoping the "human" factor plays into it (i.e.: His windows password is the same as the hard-guard password). Thus far, however, I haven't been able to connect L0pht Crack successfully to the domain controller (from a different computer on the same network).
The ultimate goal is to boot into the OS, install Kazaa, place a folder on the desktop titled "HACKED", reboot, and have the installed changes remain (because hard-guard is supposed to wipe all changes clean).
I'm smacking my brain on the wall over this one and I gotta say, this one is really difficult... Any suggestions would be appreciated, and I will gladly split the reward money with anybody who provides any suggestions that help lead to a successful hack.
_MaH
Last year I was able to get around this simply by popping in a CD and re-installing the OS. Going by the above information, that's not possible this time around. So I've been trying a few other things, like hoping the "human" factor plays into it (i.e.: His windows password is the same as the hard-guard password). Thus far, however, I haven't been able to connect L0pht Crack successfully to the domain controller (from a different computer on the same network).
The ultimate goal is to boot into the OS, install Kazaa, place a folder on the desktop titled "HACKED", reboot, and have the installed changes remain (because hard-guard is supposed to wipe all changes clean).
I'm smacking my brain on the wall over this one and I gotta say, this one is really difficult... Any suggestions would be appreciated, and I will gladly split the reward money with anybody who provides any suggestions that help lead to a successful hack.
_MaH
![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
no subject
Date: 2003-06-04 11:20 am (UTC)so if you can get into the hard guard startup menu you can boot the system, install your stuff, reboot, and hit backup to save your changes.
i assume that your issue is getting a password to access that menu of hard guard?
You've got me all intrigued now.
Re:
Date: 2003-06-04 11:26 am (UTC)This will revert the system back to what it was before, reboot the computer, and incidentally, will lead right back to the above mentioned screen :-(
This breaks down what changes it says it's noticed. The problem here is that before I can see that screen, it asks for a password.
Takes the detected changes, and makes it a part of the new backup. Again, a password is needed.
So the issue here is getting past Hard-Guard. I was wondering if anybody came up with anything I might've missed, or if there was anything I could possibly do (with my limited access) to the BIOS, hence why I provided computer and BIOS type.
I think I'll call the company and ask if they have a backdoor on the product... Of course, they'll probably just tell me to remove the card. :-(
But I'm glad I got someone interested... I personally love these kind of challenges!
_MaH
no subject
Date: 2003-06-04 11:34 am (UTC)I feel like there was a 2600 article on it (or a similar hunk of hardware) awhile back, but I could be wrong. They don't have articles posted on their site, it pisses me off.
"Yeah rah rah free software, free information, but not ours. :P "
Re:
Date: 2003-06-04 11:52 am (UTC)_MaH
no subject
Date: 2003-06-04 11:51 am (UTC)Could you lock out that card from being loaded? maybe create an IRQ conflict in the BIOS by manually assigning them? disable slots?
I know some BIOS's I've seen you could do some pretty low leve stuff in, it'll depend what that one's set up like.
Worth a try though.
Hmmm....
Date: 2003-06-04 11:53 am (UTC)_MaH
Re: Hmmm....
Date: 2003-06-04 11:59 am (UTC)What info do they need to give you the master password?
Re: Hmmm....
Date: 2003-06-04 12:05 pm (UTC)"Is it that we can't open the case, or just that we would have to get around the lock on the case?"
We're pretty good at picking locks... Anyway, no, you can't open the case. Boy wouldn't that make it easier? I'm not sure what info they need. I told them I was an assistant network administrator for a company, and that our head administrator installed the product last week. Anyway, we need to make a critical update, our head admin. is on vacation and we can't reach him, and he's the only one with the password and key to the server room and server case.
Either the guy saw through me, or something, because he didn't ask me for any additional information, and just said "I'm sorry, I'm not allowed to release that information." I read this as "There is one but I can't tell you", otherwise he probably would've just flat out said "Sorry, there's no backdoor on Hard-Guard." So now I'm scouring the net to see if anybody else has managed to crack hard-guard, but so far, nada.
_MaH
Re: Hmmm....
Date: 2003-06-04 11:59 am (UTC)and no physical access to internals to short out the bios settings... ugh.
2600 is here, used to be the most respected hacker zine around, but it's gotten very lame of late with it's increased public profile. most of the stuff in there now is common sense or script kiddie-ish. used to be a great resource for geekly knowledge.
Re: Hmmm....
Date: 2003-06-04 12:09 pm (UTC)I still think the most frustrating things for me are the disabled CD-ROM and floppy...
_MaH
Re: Hmmm....
Date: 2003-06-04 12:26 pm (UTC)good luck with your attacking it, it'll be bouncing around my head for awhile. ;o)
Re: Hmmm....
Date: 2003-06-04 12:28 pm (UTC)_MaH
Re: Hmmm....
Date: 2003-06-04 12:37 pm (UTC)Worth a try, but don't hold your breath.
Re: Hmmm....
Date: 2003-06-04 12:40 pm (UTC)_MaH
Re: Hmmm....
Date: 2003-06-04 12:46 pm (UTC);o)
Re: Hmmm....
Date: 2003-06-04 01:41 pm (UTC)AAAAAAAACCCCCKKKKKKK
Date: 2003-06-04 03:39 pm (UTC)Did any of you ever work around so many complex computer things that after an hour or so of it you no longer feel computer-smart, but more like an absolute brain-dead drone?
I think my mind has shut itself down as some sort of defense maneauver...
_MaH
no subject
Date: 2003-06-05 01:16 pm (UTC)I'm slowly making my way through the technical FAQ now. Interesting...the supervisor password is stored in the boot sector. Might be a crack there, though I'm not sure what at the moment.
It's too bad it won't boot into the OS. One potential way to at least crash it, if not hack it, would seem to be attempting tons of minute file changes, perhaps eventually overloading the Hard-Guard's onboard buffer.
Side note: This thing must play hell with a defragger.
The two routes I see are:
1. Cracking the Hard-Guard supervisor password. Obviously, that gives you pretty much free reign.
2. Somehow getting in enough to either wipe or hex-edit the boot sector. Is this FAT, NTFS, Ext2 or what? Also, what OS?
Re:
Date: 2003-06-05 01:24 pm (UTC)_MaH
no subject
Date: 2003-06-05 01:59 pm (UTC)However, those are somewhat older apps that may not work with NTFS. My idea was that you could use hex edit to scan the first two sectors and see if the password shows up (I used to use this approach on Commodore programs back in the day). However, I'd be a little surprised if they didn't encrypt the password. Still, you never know.
You could also just wreak havoc in the boot sector, but then you end up with a machine which likely won't boot. If your goal was to crash, not hack, that would be fine.
Frhed is another option that might work with newer systems. (http://www.geocities.com/thestarman3/tool/frhed/FRHED.htm)
Re:
Date: 2003-06-05 01:35 pm (UTC)So, yeah, defragging must be hell for the thing (see thought below) and I've wondered what you could come up with if you ran Norton Restore or some program like that on the HD.
I've been thinking about a defrag approach... Last year when this (virtually) same challenge was presented, I bypassed hardguard by reinstalling the OS. I guess hardguard is setup to check for something like that. Anyway, after that discovery, they disabled the CD-ROM. I'm curious if file read/write control exercised by hardguard is suspended during a defrag process...
The above, however, wouldn't work since I don't yet have administrative privilages. I've been trying to l0pht crack the thing, but it says i don't have the privilages to access it. Must be a LC4 "feature". Also he stepped in and said I couldn't use l0pht crack.
But when I was poking around the registry today he was making comments like I was really close... Anything I could access in the registry that might help?
_MaH
no subject
Date: 2003-06-12 10:27 pm (UTC)Re:
Date: 2003-06-12 10:29 pm (UTC)_MaH