PaulDotCom mailing list archives
Locked down laptop help
From: k41zen Me <k41zen () me com>
Date: Wed, 30 Mar 2011 07:44:40 +0100
I need to get some user data of a laptop. I have written permission to do whats necessary. What I don't have is a lot of time. Laptop is running Vista SP1 fully patched up to Jan 2011. System is bitlockered. I have the users cached creds and the bitlocker PIN so logging in as the user is not a problem. System has a software VPN solution on it but certificate has failed rendering the NIC useless and removing a whole heap of remote options. System is locked down so that: 1) 3rd party app stops devices from being attached to the laptop (USB, Expresscard, PCI, serial & parallel ports, firewire) 2) User has CD/DVD read but not write 3) user account rights are very limited 4) whitelist in place with mixture of GPO's and 3rd party app to limit what the user can run and from where on the system 5) cannot stop services 6) cannot delete files to break security apps or stop services 7) local admin account has been disabled 8) FW configured to only allow out DNS and VPN traffic to establish session 9) user cannot renew VPN cert I dont have bitlocker recovery PIN so booting into safe mode or placing drive into another machine is a no go. Also not stored in AD. I can't see any other ways to extend to functionality of the laptop so am now into privilege escalation. With all the meassures in place anyone know of anything that would work? TIA k41zen _______________________________________________ Pauldotcom mailing list Pauldotcom () mail pauldotcom com http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom Main Web Site: http://pauldotcom.com
Current thread:
- Locked down laptop help k41zen Me (Mar 30)
- Re: Locked down laptop help Jim Halfpenny (Mar 30)
- Re: Locked down laptop help Craig Freyman (Mar 30)
- Re: Locked down laptop help k41zen Me (Mar 30)
- Re: Locked down laptop help Tim Krabec (Mar 30)
- Re: Locked down laptop help Jason Jarvis (Mar 30)
- Re: Locked down laptop help Tim Krabec (Mar 30)
- Re: Locked down laptop help Jim Halfpenny (Mar 30)