3 Things You Didn't Know about Windows Command Prompt

Key Takeaways

in this video I'm going to show you three things that you didn't know about the Windows command prompt and number one is going to be the star of the show and the most interesting thing that some hackers or penetration testers or red teamers might be able to use to hide their own code execution or commands that they run within the command line but before we dive in let me give some quick love to today's sponsor developers are constantly changing the digital landscape but building secure software isn't always easy especially in growing applications worked on across massive teams companies end up with mountains of code and they have to make a choice stay competitive or stay secure but with sneak you don't have to choose sneak helps bake security into the software development life cycle sneak helps you scale and streamline by automatically scanning your code dependencies containers and configuration files finding and fixing vulnerabilities in real time and it is super easy to use you can sign up for free with my link below import your repositories in there sneak just finds your vulnerabilities you can fix all these issues with just a single click sneak automatically opens a fixing pull request so you can just merge them into your repository and move on and it fits seamlessly into all of your existing tools Ides the command line CI CD pipelines Cloud infrastructure and more millions of developers love sneak and you can see for yourself get started for free with my link below and develop fast and stay secure with sneak okay so first things first let's hop on over to our computer screen I'm working in a Windows 11 virtual machine and I'm going to fire up the terminal I'm going to go ahead and open the command prompt and it is going to invoke Powershell by default but that's A-Okay because first things first I want to showcase what this com spec environment variable is so if you are using Powershell you're going to end up using Echo to display out onto standard outputs dollar sign EnV to denote hey we're going to be looking at an environment variable colon to denote that this is a PS drive and the variable name that we'd like called comspec I'll hit enter on that and by default it is C colon backslash Windows slash system 32 slash cmd.exe which if you aren't familiar with is just the regular command prompt right if I could go ahead and enter cmd.exe it would run the command prompt which is different bear in mind than hey straight Windows terminal uh in fact you'll notice kind of the color prompt Etc I won't be able to enter just PL Powershell on its own right I'm gonna actually be inside of the old school dos batch whatever you kind of want to refer to it cmd.exe command prompt so the environment variables are referenced in a different way in this case now I'm going to end up using percent signs to denote the variable that I want to use and that will still give me the exact same value you could determine these with the set command within strict original hardcore cmd.exe this displays all this on its own while in that Powershell Windows terminal you really want to end up dir or LS or getting all the contents out of the environment drive that PS Drive bear in mind I believe you need to follow that with a backslash or I might have that wrong oh yeah you don't need the dollar sign when you're trying to list out of that strict PES drive there you go so that works just fine for us now there's an interesting thing that I want to note here because I was focusing in on the com spec environment variable so here's a fun thing that you might not be familiar with and that is Trick number one that we're gonna get into I'm gonna get back to my old school original cmd.exe and I'm going to end up using the set variable one more time or the set command sorry to go ahead and actually change the value of com spec I'm gonna do something weird I'm going to set it to calc dot exe now this might be odd to you because calc.exe on its own is just the calculator application right but I'm going to go ahead and ask Uncle Google here and get into Wikipedia to better explain this the com spec variable is one of the environment variables used in DOS old school cmd.exe and it refers to the full path of the command line interpreter it can be also really anything else like you can set it if you want but it does something odd and this was kind of first noted by a fellow that I found on Twitter I believe this is Wade hickey or Wiki is his uh w h i c k e y and his actual Twitter hander is is not Wiki um but I saw something interesting where he was setting this com spec value and he was going to go ahead and actually change it from what it would have been and that it's no longer the original cmd.exe but if you ended up actually echoing anything like literally anything like literally oh hey here's a Please Subscribe if I hear one and piping it into some other command that ended up doing some command line interpretation or you know stuff that it might do on the command line and there were some oddballs in here that worked and that didn't work but if I were to use something like clip or clip.exe to put something into my clipboard oddly enough it invokes comp spec it it started that calc.exe for me now that's just weird right so I kind of was curious what more could be done here and he's shown in even his tweet that this could happen for other situations like you could pipe this into who am I still pops calc and who am I executes we could change this to like uh uh type let me change that again to the type command and that fires and actually fires twice which is weird I don't exactly know why I don't know if it's just because oh it's going to be reading centered and put in two different ways uh I'm not sure uh if anyone could School me and help me get a little bit more educated on that I'd be super duper grateful but you could do this just as well for like dir and others that would again fires twice but some of those are kind of weird like clip is small and simple enough it does have a side effect of you putting something into your clipboard uh however if I were to change this to maybe some command that doesn't do anything like uh break how about that still fires okay cool actually fires twice though so maybe that's not the best if you aren't familiar with break it is just the uh compatibility to do nothing it is literally like been true on Linux the command doesn't do anything and you might be familiar with other like commented commands things seem to like add a remark or REM it does nothing it like he literally after the word rem or for remark it won't let you be interpreting the rest of the command here so here's an oddball thing what if we took break and then piped it to REM break to do nothing and REM to just be the end of the command that it's like a comment that fires now this is really weird because it would be worthwhile to do something like actually with arguments right or something peculiar but this is point number one that I wanted to show you if something new that you didn't know about the Windows command prompt what if we were to go ahead and change this com spec variable to something like oh notepad we can tell notepad to try to open a file right so let me go ahead and create I'll put something way up in our C drive let's create a I didn't go to it let me go to a test.text cool I already have one actually created for me from some previous testing that just has the value uh in there you know of course as it should so let me try to go ahead and use notepad to open test dot text okay let's try now to use our brake pipe to REM technique but it doesn't invoke anymore it says the file name directory name or volume label syntax is incorrect that's kind of weird um so we could use some of our silly uh security research tools some simple small stuff like the process Explorer to see what's happening how and when right what if we were to go ahead and start to piecemeal this sort of thing let me go ahead and clear the screen one more time let me set com spec as to what it was and then try to invoke this but I don't see any process created underneath my cmd.exe process let me try to slow this down let's go one step at a time here let's remove the argument or the parameter that we're giving to this com spec variable and let's see what this looks like when we trigger it with break pipe to REM notepad says the system cannot find the PATH specified which is kind of odd but it does fire um so what is this thing here's our notepad process and since it can stay up for us we can actually take a look at uh how this was invoked now weirdly enough notepad within quotes is present there uh Slash s slash d slash C and then break in quotes with the space um now if you aren't familiar these would be arguments that would naturally go to cmd.exe right we've configured and changed what com spec is to notepad and it's totally okay to work with these parameters but it's expecting those to be like the file name that it's going to open in the notepad text editor now break always seems to get in the way here because that's the argument in a weird way that we invoke this with uh let me show you that in a different setup right what if I did that Echo a into I don't know which one worked for us who am I that fired again the who am I output is present there but now take a look at how this was invoked I have my echo a included as an argument quote unquote to notepad with this other leftover stuff that again is really rooted in what cmd.exe should do if I clear the screen let's take a look at cmb's help file uh so slash S would modify the treatment of the string after slash c d will disable execution of auto run commands from the registry um what is the slash S going to do okay now that's just manipulating how it might handle uh backslash C stuff which does get invoked in our case but we might be able to explore that and understand that a little bit better later anyway I thought this was super duper odd because it looks like that the second parameters that we end up giving this thing are going to be invoked uh as if it's part of the command that we're using to hide this like the break because honestly maybe this is kind of slick maybe at least in some weird way hey you're sort of again proxying or masquerading or hiding the original command that you want to run or the process that you want to start and hey for your actual invocation and execution you do something that isn't the command originally you're you're hiding it within the Comm spec variable Kudos and credit to hickey Wiki to be able to put this together here but I'm thinking what could we realistically do with this if seemingly I can't easily control the arguments here's some weird stuff you might have noticed that those double quotes are present there what if we tried to do the same thing in Powershell uh here let me open up uh terminal again now I'm using the real Windows terminal if I were to try and set the dollar sign e and V com spec variable to be notepad.exe uh note once I try to use break colon or pipe to REM this will not actually detonate because the Powershell syntax is going to be interpreting this rather than the old school dos capability and same with REM we are going to end up needing to invoke that through CMD C for our own testing sake for for playground for experimentation maybe if you were doing this as a technique in a real thing you would be able to invoke it through CMD on its own so this fires and take a look notepad.exe now is a child process no longer has a double quotes because it's not going to be literally interpreted like cmd.exe would want to do so we're thinking okay maybe we could do some of the other tricks that would break out of this slash S and slash D parameters that are just naturally included here right could we use like REM to try and cut that out no we get some really weird output that says dot com.exe dot bat all these things are not recognized as an internal or external command uh I don't know if you're familiar but this is actually the uh path extension variable that's the value of path EXT it's like trying to see oh can it run something and it's invoking path EXT odd and weird we could try and manipulate that we could set a value to this but then it wouldn't know to execute it naturally because it won't have the dot exe as part of its regular path EXT transfer I don't exactly know or understand that one's really weird to me and I've been trying to play with this and make more sense of it um but I will leave it as an exercise for the reader if folks want to explore that more anyway I did think it was weird and that you know what if we tried to like oh do some redirects uh after I've set this and then tried to run my CMD C break colon REM same error uh colon colon that breaks just as well maybe if I redirect also gets the weird path extension thing also gets the weird path extension thing I cannot track it down uh to be able to pass in arguments other than this notepad.exe all on its own even giving it just like something stupid that won't invoke or execute is then going to have this error where path.exe is some way somehow being executed as if it is a command weird and I'm not understanding how or why um I would love to be schooled and educated so please let me know in the comments if you happen to know but I thought huh okay we have a little bit of a trick here because we can just invoke whatever binary that we might want notepad and calc.exe as a super small stupid example we still oh why is process Monroe uh let's use let's check out we still always have these arguments forced to us so you could craft your very own executable that will ignore slash capital s slash d slash C and then maybe include arguments one way or the other or just do whatever you want it to do because it's you're executable that you might invoke in this weird not referring to it but somehow referring to it method um so is there still any way we could avoid these arguments that are getting in the way I tried to think on this and I was wondering huh could I fill this with more stuff like could I here let's let's close out our notepad so we get back to this as a session and let's take our environment variable and then just I don't know fill it with a bunch of Gunk fill it with like a characters or something we know those won't work but spaces seem to fly and I try to run this thing it's weird because all those spaces are maintained so I thought huh could I maybe push this to the edge and find some sweet spot or threshold where it'll be truncating the values that it might execute on the command line is that possible does that happen so I Googled I went around and looked up hey what is the maximum length of a command that you can enter on the Windows command line so please let me make this weird fact number two it's something that you didn't know but the Windows command line uh there is a limitation the maximum length of the string that you can enter at the command prompt is 8191 characters and now you know now you can tell all your friends your family hey write home about that uh tip your weight just tried the veal this is with the story that you can tell at parties the command prompt will only execute commands up to 8191 command uh characters in length and this is a really weird thing so let me show you something really really weird here I know it's odd I'm gonna open up idle uh on my host here so I can just use Python to actually take a space character and then multiply it by 800 or sorry 8191 characters now once I hit enter here it's going to generate this out in a small little expandable box so I'm going to click on that and you can see the blue single quote will denote the beginning of this and all those white space literally a space character has been fanned out up until this trailing ending uh single quote now if I copy this I'm going to open up just a regular cmd.exe on my host in Windows 10 here and I'm going to zoom in on this and then I'll enter like oh notepad.exe and notice my cursor is here but I'm going to right click and paste and now my cursor has gone way way way far away the question is where has my cursor gone because if I scroll out oh you can see my cursor there but it won't let me type any more into this command prompt window it won't let me let me type any more into this command prompt box here I go I'm on my keyboard here I'm gonna hit the space key but it is not letting me type anything else it it maximize the buffer here and with that I can run notepad.exe because it won't let me go anywhere further than 8191 characters but what if we were to try and bake this into our weird comspec variable right so let's go check out the rest of this Microsoft node here 's an interesting thing if we scroll through here we're thinking wait a second there's a win32 limitation for environment variables and that's 32 767 characters so maybe that is weird fact number three a little fun fact of the Windows command prompt your environment variables can be 32 776 characters in length while your command on its own could be 8191 but note here's the gimmick here's the catch here's what we'll run into the command prompt will ignore any environment variables that are inherited from the parent process and are longer than its own limitation of 8191 characters as appropriate to the operating system so let's do something weird let's take what we've learned here and open up ISE and let's create a new simple script we can call this just like uh where do we want to put this John uh is that this is like the cloud shoot I don't want that stuff just take me to my location here let's do this like play.ps1 here and let's go ahead and say hey here's our environment variable com spec we're going to put that equal to notepad.exe which is what uh 11 characters is that right we start at kernel column 15 and then we end at kernel or column 26 yeah so let's do that plus I think I can concatenate strings like that in Powershell with 8 191 uh minus I guess 11 characters right because that'll be the full length to make this whole 8191 work so let's use our CMD slash C now to invoke this in a weird way with brake pipe to REM I'll fire this up I'll hit a five and I this is because it's in a virtual machine it's not going to let us run scripts like that so let me go ahead and uh start up Powershell and set execution policy to remote signed that way I can run script on my own machine perfect goodbye me let's run that one more time with F5 and this doesn't work I have dot com.exe.bat Etc my path exp thing is getting in the way but that's odd uh should I add another space character there run one more time huh now I have no parameters being executed as an internal or external command what if we tweaked these numbers here now we're with this extra space character we have 12 characters but what if we took out a little bit more than that so we know that it will in fact fit if I run this still doesn't work for me that's odd and the reason that I say that is odd is because when I was poking at this earlier uh kind of breaking the fourth wall here here on my host like I have this running again on Windows 10 where I would take the exact same syntax granted I have a DOT exe at the end but if I try to run this it would trigger it would run my notepad.exe if I remove the dot exe so the syntax is literally the exact same it will still fire even you know hey subtracting enough spaces that it would give that path EXT error previously in my windows 11 virtual machine that's kind of weird that's kind of odd now obviously if we were to try to give this more data than it should have like if it were to hit that ooh we only uh added too many spaces and we've broken past the 8 900 or 8191 character length maximum then well it won't let it happen CMD is going to be truncated and we're ignoring that original command it's just going to be an empty string here so ultimately that will not work for us I cannot figure out even trying to push back and forward and actually execute this thing I I can't see it run with all those arguments avoided so at the end of the day what have we really solved for uh well we can invoke some other executable and some way uh if we Supply our own custom executable maybe that will handle those arguments and maybe do something specific that we want put in that location put it run it whatever way you want with some maybe obfuscation if you really want for your comspec variable and then you could trigger it with some strange command maybe that could get past some detection engineering some specific static signatures it could be using for oh defense or auditing Etc but I I can't make it all that flexible with other arguments and I just thought it was weird I just thought it was odd and I thought it would be interesting to show it to you because maybe then you at least are tricking and figuring out like huh uh well now I've learned at least three things that I didn't know before and weird fun facts you can see comspec be executed with some sort of executable commands you can only have a Windows command line command prompt input as 8191 characters or less and your environment variables can only be 32 767 characters as a maximum and now you know that and I'm sorry for forcing that into your brain hey thank you so much for watching hope you enjoyed this video maybe it was a little bit more of an exploration maybe there wasn't a clear answer we were just kind of seeing what we could see or some Discovery based stuff but I hope that was fun and might give you some other inspiration to explore and poke out why was it doing all those weird things and I don't honestly know um and I'm eager to learn from you if you would be willing to share your own expertise and knowledge in the comments so with that please do those YouTube algorithm things like comment subscribe Etc you know the drill and uh Hey huge Kudos and Shout out and thank you to today's sponsor if you haven't given sneak some love and uh I don't know take a look at what they have to offer please please do Link in the video description really the only reason we can keep cranking out videos and doing great stuff on this channel is because of their support and many others thank you so much for watching Everybody I'll see you in the next video take care