Interesting proxy script

[GrumbleDook]

Taken with permission from icttechnician.com (from the professor fo cruel & unusual punishments)

quote:
Originally posted by Tony Sheppard:
Mind if I post a link to this script from the scripts section on a different site? Or even cut and paste it onto there?


Where ever you like Tony, if it helps people I'm happy for it to be used and abused anywhere.

There is no copyright or support offered, nor can I guarantee that you won't trash your computers by using it.

I can tell you it works fine here, teachers love it, pupils hate it.
In our OFSTED they thought it was a very good idea (they suggested we sell it!).

Thanks for asking.

-----------------------
Here's the details on what we call the "ProxyKiller" ================================================== ==

To disable Internet access all we have done is lie to the box about the address of the proxy server. Simply put, this is done by having an entry in the hosts file for the proxy name that points to the local loopback address on the student's PC's. There are however a few essential things that need to be setup for this to work.

1/ Our computers are identified by room name and PC number, for example:

There are 31 PC's in room F29, the PC's are named:
F29-0 (Teacher Station's are always 0)
F29-1
F29-2
.....
F29-28
F29-29
F29-30

This essential for automatic room identification within the batch file.

2/ Your group policy that gives out the proxy details (to the students) must hand out the name of the proxy not it's IP address. Handing out the IP address to Staff is OK, we don't want to inconvenience staff.

3/ PC's 1 - 30 have a modified hosts file with the proxy name resolving to 127.0.0.1

4/ PC 0 must have a normal hosts file. PC 0 is usually where this script is run from, it won't work on any other PC at the moment.

5/ F30 is the technicians room, because we get asked to enable / disable the internet in rooms we need the script to ask which room we want to target.

6/ Staff have to have administrator rights on the boxes targetted by this script. Students should have no higher than "Power User".

7/ Our boxes revert to disabled when rebooted, this is done by drive protection software called DeepFreeze, if you don't have drive protection software running the machines will stay in whichever state they were left in last. Or you have to figure some way of automatically replacing the hosts file when the PC is rebooted.

Before I go on, please note that this is version 1 of this script, it's not the best written or efficient; that work will go into version 2.

Please note some of the lines have been wrapped, I don't know how well the batch file will work if just copied and pasted from here. If you want a copy of the file directly, e-mail me.

--- ProxyKiller.bat starts here ---

@echo off 
:start 


REM This batch file was written to run once change the local hosts file throughout a room and quit. 
REM 
REM V1.0.8 23/11/2004 10:54 
REM 
REM See Martin Smith before changing this. 



set debug=n 
if "%debug%" == "y" set onscr=echo 



REM ----- 
REM Variables used by the script 
REM ----- 

set roomask= 
set allow= 
set room=%computername:~0,3% 



if "%room%" == "F30" ( 
goto room_ask 
) else ( 
goto room_ok 
) 

:room_ask 
cls 
echo, 
echo 1 = F29 
echo 2 = F44 
echo 3 = F45 
echo 4 = F47 
echo 5 = S53 
echo 6 = G44 
echo 7 = S14 
echo 8 = F42 
echo, 
set /p roomask=Which room should this hit (Q to quit)? 
if "%roomask%" == "Q" goto end 
if "%roomask%" == "q" goto end 
if "%roomask%" == "" goto room_ask 
set /a room=%roomask% 
if /I %roomask% LSS 1 goto room_ask 
if /I %roomask% GTR 8 goto room_ask 
if /I %roomask% EQU 1 ( 
set room=F29 
set boxes=30 
) 
if /I %roomask% EQU 2 ( 
set room=F44 
set boxes=30 
) 
if /I %roomask% EQU 3 ( 
set room=F45 
set boxes=30 
) 
if /I %roomask% EQU 4 ( 
set room=F47 
set boxes=30 
) 
if /I %roomask% EQU 5 ( 
set room=S53 
set boxes=30 
) 
if /I %roomask% EQU 6 ( 
set room=G44 
set boxes=15 
) 
if /I %roomask% EQU 7 ( 
set room=S14 
set boxes=14 
) 
if /I %roomask% EQU 8 ( 
set room=F42 
set boxes=30 
) 
:room_ok 


:checkroom 
if "%room%" == "F29" ( 
set boxes=30 
goto ask_allow 
) 
if "%room%" == "F44" ( 
set boxes=30 
goto ask_allow 
) 
if "%room%" == "F45" ( 
set boxes=30 
goto ask_allow 
) 
if "%room%" == "F47" ( 
set boxes=30 
goto ask_allow 
) 
if "%room%" == "S53" ( 
set boxes=30 
goto ask_allow 
) 
if "%room%" == "G44" ( 
set boxes=10 
goto ask_allow 
) 
if "%room%" == "S14" ( 
set boxes=14 
goto ask_allow 
) 
if "%room%" == "F42" ( 
set boxes=30 
goto ask_allow 
) 
goto end 



:ask_allow 
cls 
echo, 
set /p allow=Allow or Disallow Internet access (A/D/Q to quit)? 
echo, 
if "%allow%" == "Q" goto end 
if "%allow%" == "q" goto end 
if "%allow%" == "A" goto allow_net 
if "%allow%" == "a" goto allow_net 
if "%allow%" == "D" goto disallow_net 
if "%allow%" == "d" goto disallow_net goto ask_allow 



:allow_net 

for /l %%i in (1,1,%boxes%) do ( 

start "%room%-%%i Allow Internet" /min cmd /c copy c:\windows\system32\drivers\etc\hosts \\%room%-%%i\c$\windows\system32\drivers\etc\hosts 

) 


goto start 



:disallow_net 

if not exist C:\WINDOWS\system32\drivers\etc\hosts.mgs ( 

copy C:\WINDOWS\system32\drivers\etc\hosts C:\WINDOWS\system32\drivers\etc\hosts.mgs 
>>C:\WINDOWS\system32\drivers\etc\hosts.mgs echo 127.0.0.1 inetcom1 

) 


for /l %%i in (1,1,%boxes%) do ( 

start "%room%-%%i Disallow Internet" /min cmd /c copy C:\windows\system32\drivers\etc\hosts.mgs \\%room%-%%i\c$\windows\system32\drivers\etc\hosts 

) 


goto start 



:end 
set roomask= 
set room= 
set allow= 
set debug= 
set onscr= 
set boxes=

--- ProxyKiller.bat ends here ---
----------------------------------------

Seems interesting.

[webman]

This is quite similar to my Remote Process Killer HTA, which was based on code by Sirbendy/Karl Rowlands.

[ChrisH]

Another way to use a dummy proxy. Good idea there

[webman]

Yes it is, an interesting way to solve it which I didn't think of. We don't use this method though because the GPO sets the IE proxy via IP address and also ticks the box that says "Bypass proxy for local addresses" which means kids can still access webmail when they should be typing a 3,000-page essay on Macbeth Hence our need for CACLS.EXE 8)

[tarquel]

Ooo - gonna have to play with this [and edit hehe] later

Nice job

PS Tony - Can you edit your post and "tag" the code for ppl - just to help readability etc

Nath.

[ChrisH]

PS Tony - Can you edit your post and "tag" the code for ppl - just to help readability etc

Nath.

Done

[StewartKnight]

but if you bring internet explorer in on a flash pen, then you can still get on the internet can't you?

I'd use it sparingly, or the kids will figure out how to get round it!

[webman]

but if you bring internet explorer in on a flash pen, then you can still get on the internet can't you?

I'd use it sparingly, or the kids will figure out how to get round it!

Not unless you disable students from running .EXE files like we do.

[ChrisH]

Yes you should stop students from running executable files from removable media where you can using software restriction policies. Here we have no optical or floppy drives so I just hide and deny access to local drives as we dont allow USB stuff either as stuff kept coming in. You need to look at you drive letters and restrict those accordingly.