0

I want to run untrusted software in a way that can only destroy files belonging to that software.

I believe such is common on GNU/Linux, e.g. running Apache as user "www" that only has read access for its data and read/write access for its temp files.

How do i achieve the same on Windows?

6
  • 1
    Please include all information necessary to understand the question into the question itself instead of just providing a like to somewhere else. But in general - malware running as a limited user only affects data accessible by this user but of course privilege escalation or infecting accessible systems on the network might still be possible. " If so, how to do that?" - do what? Dec 8 '17 at 6:06
  • @SteffenUllrich Sounds like an answer, which is no, so i've simplified the question to only risk that account. Dec 8 '17 at 6:27
  • Without the link, this question is very broad. I think the question really is about "process döppelganging". The link itself is useful, it's just that the question should still be clear without the link.
    – S.L. Barth
    Dec 8 '17 at 9:01
  • @CeesTimmerman I took the liberty of making a big edit. I think the question is on-topic now. If you disagree with my edit, you can roll it back. You seem to know how SE works, but just in case: you can roll back by clicking on the "edited .. ago" above my usercard. That takes you to the revision history, where you can select an earlier version to roll back to.
    – S.L. Barth
    Dec 8 '17 at 9:10
  • 2
    Well, as you already observed, you can put things in a different account with limited rights. A term to search for is "privilege escalation"; the ways in which an attacker can give themselves more privileges than you intended. Even VM's aren't entirely safe; IIRC the VENOM vulnerability (CVE-2015-3456) allowed software to break out of the VM.
    – S.L. Barth
    Dec 8 '17 at 12:19
2

Depends on the malware you have "developed", the real answer is simply NO. I've seen malware starting with guest user rights and escalating to Admin.

If you need an alternative solution to a VM in order to run Malware on your pc with full PC controls and no consequences is DeepFreeze.

Once installed, you can run anything or delete anything on your PC. It will always boot back up normal, same as the moment you installed DeepFreeze. Disable it and all the changes are written permanently. If enabled it will always boot back in normal state no matter what you do, even if you delete /system32.. :)

5
  • By replacing the disk driver, it appears to turn the entire session into a sandbox, leaving RAM and ThawSpace vulnerable, yet somehow still allowing for updates. Dec 8 '17 at 16:41
  • So don't create ThawSpace. Yes RAM does remain vulnerable. I haven't been able to keep any updates or changes. To my knowledge Win Updates are allowed only on Enterprise version which are issued and controlled by the admin / server.
    – JsEveryDay
    Dec 8 '17 at 16:54
  • Sounds unsafe. I like to keep local copies of my photos, my Home system up to date, and my browser open. Dec 8 '17 at 19:03
  • Ok so this is not for debugging or testing purposes. You want your pc to be ready to run malware all day and you to be safe? GoodLuck.
    – JsEveryDay
    Dec 8 '17 at 19:24
  • Using a physical machine is safer but more cumbersome than a VM. Dec 9 '17 at 23:38
1

You don't. A standard Windows user has access to tens (hundreds if self-installed apps are allowed) of automated protocol and file handlers, all of which can access hundreds of undocumented persistent registry keys, scheduled tasks, and other apps that persist and can be DLL hijacked.

Then there's the UAC layer which has dozens of bypasses, leading to privilege escalation -- in addition to hundreds if not thousands of SYSTEM-level privilege escalations through things like drivers and font-scalar engines (too-numerous to even list how many methods there are).

Once elevated, that sort of defeats the whole purpose of this conversation, but WMI subscription and many other precaution techniques become available. It's even worse when the computer is on a Windows Server Domain.

I might argue that you also can't reduce privileges on a Unix or Linux host in the same way, but you seem to be convinced that a single binary with restricted permissions is somehow in some sort of sandbox. It's not. Even in chroot, it is not. I did a Google search for chroot escapes and there's nearly 100k hits.

4
  • So all consumer operating systems are unsafe, no matter the additional security software and settings? Dec 8 '17 at 16:28
  • @Cees: Unsafe to run unknown malicious code? Yes. There is even a book on Bootkits and Rootkits that covers when a piece of malicious logic, carefully-constructed, can escalate privs and modify the boot material, firmware, or other elements.
    – atdre
    Dec 8 '17 at 18:20
  • I know, and life itself is unsafe, so one has to draw the line somewhere. Could a standard user harm another standard user on Windows, more than on GNU? Dec 8 '17 at 19:05
  • @Cees: I don't know. The line is drawn through technical competency: you either know the risks because you understand them (i.e. you are a domain expert who can calibrate probability statements using confidence intervals) or you don't (or you pretend to know, but you still don't know). The OSCP Certification covers access-expansion techniques for both Windows and Linux/Unix (and GNU coreutils like su), so maybe that's the best line-in the sand?
    – atdre
    Dec 8 '17 at 19:52
0

So, how did you make this "malware" if you don't know basic things?

It depends on many factors: 1. Your source code. We are not telepaths, so we can't analyze your code and give you an answer. 2. All about user group of this user and rights. If it's just user, which can't see others files, so he can't hurt anything except his files.

By the way, It's all about the code and I think that you just want to use some scripts. We don't know which script, your programming language and a lot of other things which are necessary. You can't just type two symbols and say to your malware to harm only one user, it's more complex task.

1
  • I know many basic things, but can't know them all, hence my question on how to emulate Linux permissions on Windows by manner of a limited account for that software. The account guides i found only save the system, not the user data. I'm looking for a "Run as untrusted" menu option or somesuch. Dec 8 '17 at 12:43
0

DropMyRights was developed for XP and appears to stop viruses. I might try that or the recommended PsExec instead to see it they stop a batch file that attempts to overwrite a text file in the documents folder of a normal user account...

It appears that the simplest way to run software without it reading and writing your files is this:

  1. Make a new standard user
  2. Install ShellRunas
  3. Run shellrunas /reg
  4. Rightclick the suspicious file
  5. Click "Run as different user..."
  6. Login with the new user account.

Example using standard user:

C:\WINDOWS\system32>whoami
pc\squee

C:\WINDOWS\system32>echo test > testSquee.txt
Toegang geweigerd.

C:\WINDOWS\system32>cd \Users\Squee

C:\Users\Squee>echo test > testSquee.txt

C:\Users\Squee>type testSquee.txt
test

C:\Users\Squee>echo test > C:\Temp\testSquee.txt

New user for untrusted software:

C:\WINDOWS\system32>whoami
pc\nny

C:\WINDOWS\system32>cd \Users\Squee
Toegang geweigerd.

C:\WINDOWS\system32>type \Users\Squee\testSquee.txt
Toegang geweigerd.

C:\WINDOWS\system32>type C:\Temp\testSquee.txt
test

C:\WINDOWS\system32>echo hi > C:\Temp\testSquee.txt

C:\WINDOWS\system32>type C:\Temp\testSquee.txt
hi

Doesn't look very secure, but that's probably an ACL that inherits write for others. Maybe Sandboxie is the most foolproof option.

Not the answer you're looking for? Browse other questions tagged or ask your own question.