2

So I am running pentest on a device running Win7 and admin user set group policy to disable all mass storage devices and all usb's.

I have access to local user without privs.

Although my usb stick wont work and group policy rules wont let me my USB flash, USB modem or anything but my iPhone works as a USB storage device somehow (it is not jailbroken thus I can only reach to photos but still it works). I am only allowed to plug in usb keyboard and mouse actually (and yes rubberducky has been tried)

So I have two questions,

  1. Do you have any idea why this happens? How can I exploit this more? What is the solution/work around?
  2. Can I use this to bypass all the group policies?
  3. Lazy question alert Does anyone know any detailed info (aka how to exploit) about cve2014-1812?

PS: I am not sure if this is off-topic, I struggled to decide and maybe a little off topic my question is (Yoda v0.1 here) but I am not the admin of the system, but pentester so I posted here due to my point of view...

AviD
  • 72,138
  • 22
  • 136
  • 218
cengizUzun
  • 616
  • 1
  • 4
  • 12

2 Answers2

2

It's most likely connecting as a Media Device or Camera. There's a seperate GPO for each type of removable media. Perhaps this particular policy only enforces against flash drives.

This is quite common on androids.. I can switch my device to be a Camera and bypass our GPO for blocking removable devices.

guki117
  • 21
  • 1
  • I can not only click show images button, but also show files button. (somewhat similar to this http://www.imobie.com/support/img/import-photos-from-iphone-to-pc2.png) Moreover, I have realized that the autoplay screen pops up twice and if I try to click at first time it pops up, I get blocked, but than it closes itself and reopens, than I can use the device – cengizUzun Aug 22 '14 at 06:43
1

As @guki117 pointed out in his answer, the iPhone is connecting as a camera.

You should be able to exploit that with a basic digital camera with a removable memory card, put whatever files you want on the card, put it back in the camera and connect the camera with USB. The files should be right there.