BatBadBut: You can't securely execute commands on Windows
BatBadBut: You can't securely execute commands on Windows
Introduction Hello, I’m RyotaK ( @ryotkak ), a security engineer at Flatt Security Inc. Recently, I reported multiple vulnerabilities to several programming languages that allowed an attacker to perform command injection on Windows when the specific conditions were satisfied. Today, affected vendors...
![BatBadBut: You can't securely execute commands on Windows](https://programming.dev/pictrs/image/c7cb9838-59d6-4aa7-92c4-71ddc830eb17.png?format=webp&thumbnail=256)
You're viewing a single thread.
CreateProcess
spawnscmd.exe
even when that isn't asked? I find that... a little insane.Anti Commercial AI thingy
10 0 ReplySeems like an ancient hack to allow bat files to be run via that function.
I expect windows is full of stuff like that.
5 0 ReplyYeah, backwards compatibility is good when it isn't a security issue.
Anti Commercial AI thingy
Inserted with a keystroke running this script on linux with X11
#!/usr/bin/env nix-shell #!nix-shell -i bash --packages xautomation xclip sleep 0.2 (echo '::: spoiler Anti Commercial AI thingy [CC BY-NC-SA 4.0](https://creativecommons.org/licenses/by-nc-sa/4.0/) Inserted with a keystroke running this script on linux with X11 ```bash' cat "$0" echo '``` :::') | xclip -selection clipboard xte "keydown Control_L" "key V" "keyup Control_L"
5 0 ReplyI can barely live with that licence thingy, but don't paste that tutorial into your comment ffs.
4 0 ReplyI've gotten the question often enough about why and how. You don't have to open it 🤷
Anti Commercial AI thingy
Inserted with a keystroke running this script on linux with X11
#!/usr/bin/env nix-shell #!nix-shell -i bash --packages xautomation xclip sleep 0.2 (echo '::: spoiler Anti Commercial AI thingy [CC BY-NC-SA 4.0](https://creativecommons.org/licenses/by-nc-sa/4.0/) Inserted with a keystroke running this script on linux with X11 ```bash' cat "$0" echo '``` :::') | xclip -selection clipboard xte "keydown Control_L" "key V" "keyup Control_L"
2 0 ReplySeems like my client doesn't show it as a drop-down I thought it was like the reddit spoiler that where the same size but blacked out. Sorry.
3 0 ReplyBad client! Bad! *wags finger*
3 0 Reply