mIRC Home    About    Download    Register    News    Help

Print Thread
Page 1 of 2 1 2
How to prevent registry access??? #65822 29/12/03 12:41 PM
Joined: Dec 2003
Posts: 7
P
peracchi Offline OP
Nutrimatic drinks dispenser
OP Offline
Nutrimatic drinks dispenser
P
Joined: Dec 2003
Posts: 7
Hi everbody!

I wish to know how to prevent mIRC to access windows registry.

I have a cybercafe and people is using mIRC to stole registry informations, as for example, game and applications CD-Keys.

A customer show me this code sample that gets Half-Life CD-Keys:

----------
regread {
var %a = regread
.comopen %a WScript.Shell
if !$comerr {
var %b = $com(%a,RegRead,3,bstr,$1-)
var %c = $com(%a).result
.comclose %a
if (%c != $null) return %c
else goto error
}
:error
return error! when reading or key does not exist
}

pegarkey echo -a $regread(HKCU\Software\Valve\Half-Life\Settings\Key)
----------

Best regards,

/Leandro Peracchi

Re: How to prevent registry access??? #65823 29/12/03 06:23 PM
Joined: Oct 2003
Posts: 3,918
A
argv0 Offline
Hoopy frood
Offline
Hoopy frood
A
Joined: Oct 2003
Posts: 3,918
are you locking them from opening the registry in windows as well? (ie. start -> run -> regedit) ? because if not, then it doesnt matter what mirc can/cant do, they can still do it using the windows environment.

if you are, then all i can say is, dont allow the use of such functional irc clients in your cafe

there is a lock, but it does not lock the /comopen commands
you might want to suggest that in the features board, to add a lock to that command as well


- argv[0] on EFnet #mIRC
- "Life is a pointer to an integer without a cast"
Re: How to prevent registry access??? #65824 30/12/03 09:37 AM
Joined: Feb 2003
Posts: 2,624
Raccoon Offline
Hoopy frood
Offline
Hoopy frood
Joined: Feb 2003
Posts: 2,624
You can disable the WScript crap, but I don't recall how.

But yea, if you're going to allow people to run mIRC, you're probably allowing them to download and execute all sorts of files that would compromise your system. If this isn't the case, then simply restrict the creation of any files. If they can't save their script, they can't execute it.

- Raccoon


Well. At least I won lunch.
Good philosophy, see good in bad, I like!
Re: How to prevent registry access??? #65825 30/12/03 01:43 PM
Joined: Sep 2003
Posts: 70
M
madewokherd Offline
Babel fish
Offline
Babel fish
M
Joined: Sep 2003
Posts: 70
Well, they could load mirc.ini as a script, couldn't they?

Re: How to prevent registry access??? #65826 30/12/03 04:21 PM
Joined: Dec 2003
Posts: 7
P
peracchi Offline OP
Nutrimatic drinks dispenser
OP Offline
Nutrimatic drinks dispenser
P
Joined: Dec 2003
Posts: 7
Hi guys! smile

Regedit is disabled by system policies.

The real problem is the comopen command... :tongue:

Re: How to prevent registry access??? #65827 30/12/03 08:45 PM
Joined: Dec 2002
Posts: 3,127
P
ParaBrat Offline
Hoopy frood
Offline
Hoopy frood
P
Joined: Dec 2002
Posts: 3,127
Please dont cross post (post the same question in multiple areas). It causes confusion and wont get you more or faster answers. I've deleted the other post since this is the one ppl have replied to


ParaBrat @#mIRCAide DALnet
Re: How to prevent registry access??? #65828 30/12/03 09:49 PM
Joined: Dec 2002
Posts: 1,922
O
Online Offline
Hoopy frood
Offline
Hoopy frood
O
Joined: Dec 2002
Posts: 1,922
Since /comclose cannot (yet) be locked in the Options dialog, the only thing you can do about it is creating a custom alias, comclose { halt }, that will stop ordinary scripts from using this feature.

If you would like to disable Wscript, this page might help. I'm not sure if disabling or uninstalling it will make your browser unable to run scripts too.

Re: How to prevent registry access??? #65829 31/12/03 04:14 AM
Joined: Oct 2003
Posts: 3,918
A
argv0 Offline
Hoopy frood
Offline
Hoopy frood
A
Joined: Oct 2003
Posts: 3,918
this should definitely be a call to Khaled to get /comopen lockable in the next mirc


- argv[0] on EFnet #mIRC
- "Life is a pointer to an integer without a cast"
Re: How to prevent registry access??? #65830 31/12/03 05:45 AM
Joined: Aug 2003
Posts: 18
A
Amar Offline
Pikka bird
Offline
Pikka bird
A
Joined: Aug 2003
Posts: 18
Hello there

Well, almost three years back while I had to depend on netcafe's for internet access, I came across few software which were customised so that a fellow user will only have limited privilage or access to the workstation or services. I think finding such a software, where access to the registry or control pannel is disabled by the Administrator could help you to achieve what you seek.
BUT I am not so sure whether mIRC will bypass such securities provided by these sort of Administrating software.

Please check the following links for more details.

www.right-fax.com/cafe/Internet-Cafe-Software.htm
www.h2ad.com
www.antamedia.com

All the best


if it is a door, it will open!
Re: How to prevent registry access??? #65831 31/12/03 05:29 PM
Joined: Dec 2003
Posts: 7
P
peracchi Offline OP
Nutrimatic drinks dispenser
OP Offline
Nutrimatic drinks dispenser
P
Joined: Dec 2003
Posts: 7
Hi everbody! smile

Thanks for the replies.

I hope that soon a new version of mIRC allow us to lock this /com commands and this way increase the security of computers with mIRC.

For now I will follow the tip of Online and see what I get if I disable Windows Scripting Host.

I am afraid of indesirable side effects of doing this in my computers...

I already use a great software for Cyber Cafes called SmartLaunch.

Take a look at http://www.smartlaunch.net/

Best regards and happy new year for everbody!!!

/Leandro Peracchi

Re: How to prevent registry access??? #65832 31/12/03 07:15 PM
Joined: Dec 2003
Posts: 7
P
peracchi Offline OP
Nutrimatic drinks dispenser
OP Offline
Nutrimatic drinks dispenser
P
Joined: Dec 2003
Posts: 7
Hi Online!

I followed the steps in the link you provided to disable Windows Scripting Host but this donīt resolved... frown

That function /comopen stills work... :P

Anyway, thanks for help!

/Leandro Peracchi

Re: How to prevent registry access??? #65833 31/12/03 08:29 PM
Joined: Dec 2002
Posts: 1,922
O
Online Offline
Hoopy frood
Offline
Hoopy frood
O
Joined: Dec 2002
Posts: 1,922
Yeah you're right... even removal of wscript.exe wouldn't disable the COM object. One thing that worked here is renaming HKEY_CLASSES_ROOT\WScript.Shell to something other than "Wscript.Shell". This makes the object not usable (until you rename it back, that is). This solution doesn't seem to interfere with IE's script parsing abilities, but if you decide to do this, just write down to yourself that you did, because some applications (or scripts) might need it. I don't know...

Re: How to prevent registry access??? #65834 31/12/03 09:38 PM
Joined: Dec 2002
Posts: 1,527
_
_D3m0n_ Offline
Hoopy frood
Offline
Hoopy frood
_
Joined: Dec 2002
Posts: 1,527
wouldnt do much good if ppl put older versions on there now would it, it should have had this ability built into the OS for that type of environment adding it now wouldnt really solve any issue


D3m0nnet.com
Re: How to prevent registry access??? #65835 01/01/04 08:34 PM
Joined: Sep 2003
Posts: 70
M
madewokherd Offline
Babel fish
Offline
Babel fish
M
Joined: Sep 2003
Posts: 70
Well, theoretically, an admin should control what programs are run on there......right?

Re: How to prevent registry access??? #65836 01/01/04 09:26 PM
Joined: Dec 2002
Posts: 1,527
_
_D3m0n_ Offline
Hoopy frood
Offline
Hoopy frood
_
Joined: Dec 2002
Posts: 1,527
theory is a nice concept that makes u feel all warm and fuzzy inside, here we deal with facts not theory


D3m0nnet.com
Re: How to prevent registry access??? #65837 02/01/04 12:42 AM
Joined: Sep 2003
Posts: 70
M
madewokherd Offline
Babel fish
Offline
Babel fish
M
Joined: Sep 2003
Posts: 70
So you're telling me that real admins DON'T decide which programs are run?

Re: How to prevent registry access??? #65838 02/01/04 02:08 AM
Joined: Dec 2002
Posts: 1,527
_
_D3m0n_ Offline
Hoopy frood
Offline
Hoopy frood
_
Joined: Dec 2002
Posts: 1,527
no what im tellin u is that windows doesnt really allow real admin control. if it did this would have never ever been an issue at all.


D3m0nnet.com
Re: How to prevent registry access??? #65839 02/01/04 03:27 PM
Joined: Jul 2003
Posts: 742
MTec89 Offline
Hoopy frood
Offline
Hoopy frood
Joined: Jul 2003
Posts: 742


http://MTec89Net.com
irc.freenode.net #MTec89Net
Re: How to prevent registry access??? #65840 05/01/04 06:50 PM
Joined: Dec 2003
Posts: 7
P
peracchi Offline OP
Nutrimatic drinks dispenser
OP Offline
Nutrimatic drinks dispenser
P
Joined: Dec 2003
Posts: 7
Hi everbody! smile

I still don't find a solution to this problem... frown

Any other ideas?

Best regards,
/Leandro Peracchi

Re: How to prevent registry access??? #65841 05/01/04 07:40 PM
Joined: Dec 2002
Posts: 1,922
O
Online Offline
Hoopy frood
Offline
Hoopy frood
O
Joined: Dec 2002
Posts: 1,922
Did you try to rename that registry key? It's a rather safe solution that works here. Once it's done, scripts will not be able to address the Wscript.Shell object and use its capabilities.

Page 1 of 2 1 2