Hello all,<br>
After reading the post on
<a href="http://lists.grok.org.uk/pipermail/full-disclosure/2005-December/039634.html">http://lists.grok.org.uk/pipermail/full-disclosure/2005-December/039634.html</a>
about disabling secure configuartion verification in Checkpoint's
SecureClient I thought I'd post my own findings.<br>
My method of bypassing the check also requires Administrator privileges but does not require anything running in the background.<br>
Here are the steps I took to bypass the check. <br>
<br>
1. Download the free OPSEC Desktop SDK from <a href="http://www.opsec.com">www.opsec.com</a><br>
2. Prepare an scv dll using the sample scv plugin in the sdk, have the
plugin always return SCV_CHECK_PASSED in Status() function.<br>
3. Make a copy of that dll for each dll that is being used by the
policy, each time changing the #define PiName for the name of the check
you want to bypass (For example AntivirusMonitior, RegMonitor). Copy
the new dll's (dll name could be different) to Program
Files\Checkpoint\SecureRemote\scv<br>
4. Stop secureclient.<br>
5. Use the tool provided in the sdk PiReg.exe to unregsiter (-d flag)
the monitor dll's in Program Files\Checkpoint\SecureRemote\scv <br>
6. Use the same tool to register all of the dll's with the same PiName.<br>
7. Start secureclient.<br>
<br>
"Configuration Verified"<br>
<br>
---------------------<br>Avner Peled.<br>
<a href="mailto:avnerus@gmail.com">avnerus@gmail.com</a><br>