-2

Developing my toolkit and I want to have a safe edition of cmd.exe and bash on a usb. Why? These can be tampered with by attackers and I want a version I know is safe from manipulation. Any suggestions? Is this even possible today? I've read old stories about it. I've considered cygwin but it's only executable from Windows (currently don't have access to Windows) but unable to find any other possibilities. Is this not possible since it's tied locally?

Thank you!

edit: changed "bootable" to "portable" to lessen confusion.

Improve this question
11
  • 1
    Do you want them to execute from the USB or do they have to be bootable? I know the title says bootable but by reading the question I am not sure.
    – toom
    Apr 17, 2018 at 6:51
  • For now it's unclear what you are asking. Please provide more details especially with regards to your premises and your goals.
    – Tom K.
    Apr 17, 2018 at 10:51
  • 2
    How will you run cmd.exe if you don't have access to Windows?
    – Neil Smithline
    Apr 17, 2018 at 13:28
  • 1
    "bootable" was the wrong term. "portable" is more accurate. @toom
    – Simonhawk
    Apr 17, 2018 at 16:54
  • 1
    I still don't really understand what you want to do. Even with a read-only USB drive, if the host is untrusted, how can you be sure that it will run the apps off the USB correctly? In general, if you can't trust the host system, you just take it offline and examine the drive on a secure computer. It sounds like you're trying to perform trustworthy operations on an untrusted computer. I'm not sure that's doable.
    – Neil Smithline
    Apr 17, 2018 at 19:56

2 Answers 2

Reset to default
3

The idea is fundamentally flawed, and cannot be salvaged.

To start with the first problem: plugging in an USB "stick" (mass storage device) in a computer will cause that computer to configure its USB and file systems drivers in order to access any files stored on that USB stick. If the system is infected, this process may already modify those files - either physically on disk, or when loading them into RAM.

So even if your CMD.EXE was correct on USB stick, you can't count on it staying that way or being loaded correctly.

The next problem, assuming CMD.EXE loads correctly, is that it needs to execute. The Win32 process will have several system DLL's loaded. Those could be infected as well. You can't override this by providing your "own" alternative DLL's. This is in fact a security mechanism, because this protects you against loading alternative infected DLL's and getting infected. Of course, in your scenario the system is already infected.

But even if your CMD.EXE loads, even if the system DLL's are unaffected, the process gets a limited view of the PC on which it's running. You cannot know anymore whether you are truly running as Administrator with full overview, all such assumptions are flawed once the system is compromised.

Improve this answer
1
  • Interesting. I understand the points you make and sounds reasonable. Thanks for answering. This is probably why I don't find much on this topic. But it's weird because I've read this in incident response articles (although that weren't current) so it made me believe it was possible. But with the changes as OSs growth, looks like this option is limited. Thanks again, you taught me something new.
    – Simonhawk
    Apr 18, 2018 at 16:29
-1

There is a functioning solution (even if not meeting the exact desired solution above) and it's called a bootable USB drive. If you want to put a usb with a shell program on it into your computer, and then call that shell from that mnt, that's a tough one. If you don't need it to work like that, then just use lubuntu or Puppy linux to create a bootable flash drive. You'll have full access to the OS (unless encrypted). Many, many things can be done with this kind of USB. As for windows, that's a different story. But I can confirm the above is possible (and fun IMO) with linux.

For making the bootable USB: https://rufus.akeo.ie/

One of my favorite USB only deployments of linux: http://puppylinux.com/

Improve this answer
2
  • this is 100% not what I want. -1
    – Simonhawk
    Apr 18, 2018 at 16:25
  • @Simonhawk ...thanks man. Sorry for trying to help. -1 for your bad attitude. (goes both ways man).
    – bashCypher
    Apr 19, 2018 at 1:16

Not the answer you're looking for? Browse other questions tagged .