{"id":7199,"date":"2020-05-23T10:46:39","date_gmt":"2020-05-23T10:46:39","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=7199"},"modified":"2020-05-23T10:48:34","modified_gmt":"2020-05-23T10:48:34","slug":"command-line-do-nothingness","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2020\/05\/23\/command-line-do-nothingness\/","title":{"rendered":"Command line do-nothingness"},"content":{"rendered":"\n<p>Yesterday I <a href=\"https:\/\/twitter.com\/Hexacorn\/status\/1263775330428506112?s=20\">came up<\/a> with a silly game &#8211; find commands that do nothing, when executed from command line. I didn&#8217;t specify rules very precisely, but the rough idea was that the commands shouldn&#8217;t modify the environment. <a href=\"https:\/\/twitter.com\/0gtweet\">Grzegorz<\/a> and a few other researchers joined me in this game and they added a lot of twisted and creative ideas (thx!).<\/p>\n\n\n\n<p>One may ask: why doing it at all? <\/p>\n\n\n\n<p>First of all it is fun. Secondly, it is a good research exercise as it brings ideas that may expose imperfections of a command line interpreter and tools. These in turn may lead to some new research avenues. In fact, many lolbin and persistence discoveries started with observing what commands and programs do, when executed (including checking the command line arguments they expect).<\/p>\n\n\n\n<p>This is a list of all commands we came up with:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">rem foo\n:foo goto foo\nfor %k in () do echo\nshift\nbreak\ngoto :eof\nif foo==foo goto :eof\nsetlocal\npushd . &amp; popd\ntype nul\n:: foo\necho &gt; nul\ncopy nul nul\ncopy nul .\ncopy nul con\ncall\ncall call\nendlocal\ncolor\ncmd \/c exit\ncmd \/r exit\ncd .\ncd .\\.\\.\\.\\.\\.\ncd .\/.\/.\/.\/.\/.\ntitle\nnul\ncmd \/c exit\ncmd \/r exit\ntitle<\/pre>\n\n\n\n<p>We also had a few cheats (stream redirection\/piping):<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ver &gt; nul\nvol &gt; nul\ntime \/t &gt;nul\nset foooooo=\ncopy nul nul &gt; nul\necho &gt; NUL\ncopy nul &gt; nul<\/pre>\n\n\n\n<p>And the funny bits discovered? Let&#8217;s have a look.<\/p>\n\n\n\n<ul><li>nul &#8211; non existing and non-sensical command, but you can still launch it and cmd.exe will report &#8220;Access is denied.&#8221;<\/li><li>copy nul nul &#8211; reports &#8220;1 file(s) copied.&#8221;<\/li><li>certutil &#8211; when launched w\/o any command line argument, it prints out non-sensical &#8220;CertUtil: -dump command completed successfully.&#8221;<\/li><li>hostname &#8211; when launched with an invalid command line argument it shows non-sensical &#8220;sethostname: Use the Network Control Panel Applet to set hostname. hostname -s is not supported.&#8221;<\/li><li>set &#8221; &#8221; &#8211; prints additional 2 extra lines that don&#8217;t show up when you run &#8220;set&#8221;<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/05\/cmds.png\"><img decoding=\"async\" loading=\"lazy\" width=\"553\" height=\"286\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/05\/cmds.png\" alt=\"\" class=\"wp-image-7201\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/05\/cmds.png 553w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/05\/cmds-300x155.png 300w\" sizes=\"(max-width: 553px) 100vw, 553px\" \/><\/a><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/05\/set.png\"><img decoding=\"async\" loading=\"lazy\" width=\"504\" height=\"111\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/05\/set.png\" alt=\"\" class=\"wp-image-7200\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/05\/set.png 504w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/05\/set-300x66.png 300w\" sizes=\"(max-width: 504px) 100vw, 504px\" \/><\/a><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Yesterday I came up with a silly game &#8211; find commands that do nothing, when executed from command line. I didn&#8217;t specify rules very precisely, but the rough idea was that the commands shouldn&#8217;t modify the environment. Grzegorz and a &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2020\/05\/23\/command-line-do-nothingness\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[36,58,18],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7199"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=7199"}],"version-history":[{"count":2,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7199\/revisions"}],"predecessor-version":[{"id":7203,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7199\/revisions\/7203"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=7199"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=7199"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=7199"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}