7 mo. ago • 96%

BatBadBut: You can't securely execute commands on Windows

flatt.tech BatBadBut: You can't securely execute commands on Windows

Introduction Hello, I’m RyotaK ( @ryotkak ), a security engineer at Flatt Security Inc. Recently, I reported multiple vulnerabilities to several programming languages that allowed an attacker to perform command injection on Windows when the specific conditions were satisfied. Today, affected vendors...

15 comments

CreateProcess spawns cmd.exe even when that isn't asked? I find that... a little insane.

Anti Commercial AI thingy

CC BY-NC-SA 4.0

8
- Seems like an ancient hack to allow bat files to be run via that function.
  
  I expect windows is full of stuff like that.
  
  5
  
  Yeah, backwards compatibility is good when it isn't a security issue.
  
  Anti Commercial AI thingy
  
  CC BY-NC-SA 4.0
  
  Inserted with a keystroke running this script on linux with X11
  
  #!/usr/bin/env nix-shell #!nix-shell -i bash --packages xautomation xclip sleep 0.2 (echo '::: spoiler Anti Commercial AI thingy [CC BY-NC-SA 4.0](https://creativecommons.org/licenses/by-nc-sa/4.0/) Inserted with a keystroke running this script on linux with X11 ```bash' cat "$0" echo '``` :::') | xclip -selection clipboard xte "keydown Control_L" "key V" "keyup Control_L"
  
  3
Not a fan of the name 🤷‍♀️

6
i’m not understanding how this is supposed to be so severe. if an attacker has the ability to change the arguments to a CreateProcess call, aren’t you hosed already? they could just change it to invoke any command or batch file they wanted.

2
- You wouldn't be hosed on Linux for example. Note that this applies to the arguments to the program, not just the program itself.
  
  In other words if I do run(["echo", untrusted_input]) it would be totally fine on Linux.
  
  4
  
  honestly i wouldn’t trust your linux example at all, what happens with run([“echo”, “&& rm -rf /“])
  
  -2
- That’s entirely dependent on the application. In many cases the command would be hard-coded in the application, in which case you’re right. But some applications have good reasons to pass user-supplied arguments to scripts. Imagine a case where an application generates PDFs through a batch script, for instance. It might make sense to let users specify the filename, but then it does need proper escaping. In such a case it’s a huge risk if it turns out the escaping rules suddenly changed because Windows silently invoked cmd.exe under the hood.
  
  3
  
  even in your hypothetical of a file name passed in through the args, either the attacker has enough access to run said tool with whatever args they want, or, they have taken over that process and can inject whatever args they want.
  
  either attack vector requires a prior breach of the system. you’re owned either way.
  
  the only way this actually works as an exploit is if there are poorly written services out there that blindly call through to CreateProcess that take in user sourced input without any sanitization, which if you’re doing that then no duh you’re gonna have a bad time.
  
  cmd.exe is always going to be invoked if you’re executing a batch script, it’s literally the interpreter for .bat files. the issue is, as usual, code that might be blindly taking user input and not even bothering to sanitize it before using it.
  
  -2

You've viewed 15 comments.