-2

Developing my toolkit and I want to have a safe edition of cmd.exe and bash on a usb. Why? These can be tampered with by attackers and I want a version I know is safe from manipulation. Any suggestions? Is this even possible today? I've read old stories about it. I've considered cygwin but it's only executable from Windows (currently don't have access to Windows) but unable to find any other possibilities. Is this not possible since it's tied locally?

Thank you!

edit: changed "bootable" to "portable" to lessen confusion.

closed as unclear what you're asking by Steffen Ullrich, Neil Smithline, TheJulyPlot, CaffeineAddiction, Jeff Ferland Apr 18 '18 at 18:43

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Do you want them to execute from the USB or do they have to be bootable? I know the title says bootable but by reading the question I am not sure. – toom Apr 17 '18 at 6:51
  • For now it's unclear what you are asking. Please provide more details especially with regards to your premises and your goals. – Tom K. Apr 17 '18 at 10:51
  • 2
    How will you run cmd.exe if you don't have access to Windows? – Neil Smithline Apr 17 '18 at 13:28
  • 1
    "bootable" was the wrong term. "portable" is more accurate. @toom – Simonhawk Apr 17 '18 at 16:54
  • 1
    I still don't really understand what you want to do. Even with a read-only USB drive, if the host is untrusted, how can you be sure that it will run the apps off the USB correctly? In general, if you can't trust the host system, you just take it offline and examine the drive on a secure computer. It sounds like you're trying to perform trustworthy operations on an untrusted computer. I'm not sure that's doable. – Neil Smithline Apr 17 '18 at 19:56
3

The idea is fundamentally flawed, and cannot be salvaged.

To start with the first problem: plugging in an USB "stick" (mass storage device) in a computer will cause that computer to configure its USB and file systems drivers in order to access any files stored on that USB stick. If the system is infected, this process may already modify those files - either physically on disk, or when loading them into RAM.

So even if your CMD.EXE was correct on USB stick, you can't count on it staying that way or being loaded correctly.

The next problem, assuming CMD.EXE loads correctly, is that it needs to execute. The Win32 process will have several system DLL's loaded. Those could be infected as well. You can't override this by providing your "own" alternative DLL's. This is in fact a security mechanism, because this protects you against loading alternative infected DLL's and getting infected. Of course, in your scenario the system is already infected.

But even if your CMD.EXE loads, even if the system DLL's are unaffected, the process gets a limited view of the PC on which it's running. You cannot know anymore whether you are truly running as Administrator with full overview, all such assumptions are flawed once the system is compromised.

  • Interesting. I understand the points you make and sounds reasonable. Thanks for answering. This is probably why I don't find much on this topic. But it's weird because I've read this in incident response articles (although that weren't current) so it made me believe it was possible. But with the changes as OSs growth, looks like this option is limited. Thanks again, you taught me something new. – Simonhawk Apr 18 '18 at 16:29
-1

There is a functioning solution (even if not meeting the exact desired solution above) and it's called a bootable USB drive. If you want to put a usb with a shell program on it into your computer, and then call that shell from that mnt, that's a tough one. If you don't need it to work like that, then just use lubuntu or Puppy linux to create a bootable flash drive. You'll have full access to the OS (unless encrypted). Many, many things can be done with this kind of USB. As for windows, that's a different story. But I can confirm the above is possible (and fun IMO) with linux.

For making the bootable USB: https://rufus.akeo.ie/

One of my favorite USB only deployments of linux: http://puppylinux.com/

  • this is 100% not what I want. -1 – Simonhawk Apr 18 '18 at 16:25
  • @Simonhawk ...thanks man. Sorry for trying to help. -1 for your bad attitude. (goes both ways man). – bashCypher Apr 19 '18 at 1:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.