Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This was close to the way my high school chose to deal with process gaps. Luckily, the two IT guys were more than happy to help me out - I could get off scot-free if I just showed them how I'd done it.

They blocked executables on floppies, but if you copied something to a floppy as a .txt file to My Documents and renamed it, it was runnable.

They then blocked executables in My Documents, but if you put in a batch file, that'd still run.

They then blocked batch files, but if you created a shortcut to "cmd.exe" and ran that off a floppy, you got a shell prompt, from which you could run whatever you want.

They then blocked executing "cmd.exe", but the initial response didn't also include "command.com"...

_Unfortunately_, at that time, I'd already discussed the "cmd.exe" loophole with them, and the "command.com" loophole was basically the same thing that I'd already been told not to do... so I got detention for this one, and promptly stopped.



That’s a bit dissapointing. If you want someone to bring you vulnerabilities you have to allow them to experiment.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: