.bat files

[cdgill241183]

Hi all,

 

On Friday afternoon we had a student running several .bat files from his H: on the schools network.

 

The student had previously found a website to run a denial of service attack on the schools network. The school banned him from the network for several days and the police even visited his house but because it could "effect his grades" they let him back on.

 

I'm massively puzzled on how he has done this as the network is locked down so you can't run the files or run cmd.

 

I have logged onto our test student account and tried to run the files a few different ways but with no joy.

 

Without asking the student outright. Does anyone have any ideas how this could be done.

 

I don't want to admit defeat [emoji3]

[DarkenRahl]

Maybe run from USB instead? How do you know they were actually run from H:? Perhaps he dumped them in there afterwards.

[Arthur]

Would you be able to post any of the .bat files? I can understand if not. Edited January 24, 2015 by Arthur

[cdgill241183]

They are on my computer at work need to investigate further Monday on a virtual machine and see what they actually do.

 

DarkenRahl I'm near 95% sure that they were run from his H: a teacher saw him in him home folder clicking the files but couldn't be 100%

[burgemaster]

What have you got setup to restrict them from running BAT files? File screening to stop then copying? Applocker? GP File restrictions? Or banned file type in a normal GP?

Have a good play, Can you rename a .txt already in place to .BAT and run it?

[bald_pig]

Can you not just view his screen remotely to monitor what he's doing?

[GeekyPete]

He could write a vba Macro in Excel or word to execute a batch file.

[bald_pig]

He could write a vba Macro in Excel or word to execute a batch file.

 

Or python, I've seen batch scripts launched from python as well. I believe pretty much any programming language has the ability to pass on system calls to command line.