Re’Quest™ Reservation Software
- Category: Restrictive Software
- Sub-category: Computer Reservation and Desktop Time Management
- Vendor: iTeam Resources, Inc.
- FOOLIT code: DESKQUEST
Description
The Re’Quest computer management software enables the staff of libraries and other institutions to monitor what is happening on their computers. Re’Quest’s central management keeps track of what is happening within the network at all times, enabling administrators to take actions such as sending information or warning messages to patron acting inappropriately, locking the computers for review of patron activity by an administrator, and even logging the patron off the computer without ever approaching them.
Computers are often configured to limit users to a certain amount of time per day through the enforcement of a “daily usage policy”, sometimes as little as 15 minutes for “e-mail access” stations. The software is very comprehensive, with optional features such as requiring acceptance of a Computer Use Policy, filtering Internet access, denying usage if when fees/fines are due, and so on. There are two modes that the DESKQUEST software can run in: “Windows Desktop Mode” and “Menu-ed Desktop Mode”.
Advantages to fooling this system
- Use system computers without a valid DESKQUEST log-in
- Bypass the daily use policy for unlimited time at stations
- Override reservations that were pre-made by other users
Vulnerability
The vulnerability relies on the delayed employment of the DeskQuest.exe executable by Windows task scheduler. In order to bypass the “Windows Desktop Mode” on stations with the Windows operating system, simply create a batch file with this source:
:a @taskkill /F /T /IM DeskQuest.exe @goto a
To use this script, you must restart a computer by forced shutdown, plug in a thumb drive with the batch file on it, and run the file in the few seconds you have at startup before the DeskQuest UI comes up. Then, as soon as DeskQuest.exe is launched, the script will shut it down and let you know that the process and any applicable child processes were terminated. At this point, you will have successfully fooled the Re’Quest™ Reservation Software for an unlimited duration. Everything returns to normal after the computer is restarted.
Additional Resources
1
0
