Protect computer security, keep CMD off

When we input or run the command, we usually use CMD to do it. You can use it to enter the registry or some hidden places in the system. If the virus passes through cmd, the consequences will be unimaginable. Hold the cmd off?

A preface

Open the intrusion data on the network and see it! Most of the intrusions are done under cmd, and the typical ones are overflowed. A system permission cmdshell, and then plant a Tcmd and other backdoors bound to cmd.exe. There are also exploits of web applications to get a webshell and then use the low-privileged cmdshell to enhance permissions, and finally plant backdoors … … various attacks indicate that the intrusion and cmd.exe are related, because a cmd.exe is An interface that a user interacts with the system is the primary target of the intruder entering the system. Of course, we can't sit here and wait, how to prevent others from getting your cmdshell through overflow, how to know that others have entered the system and get cmdshell, how to catch the intruder when someone logs in to our machine? Now let us create a cmd The ultimate defense line.

二原理

One of the more preventive methods on the network is to set permissions on cmd.exe, which can really play a big role, but the permissions are more difficult to determine. And if someone else uploads cmd.exe, they can still break through, and then use cmc.exe to bind cmd.exe to a port or get cmdshell. Today I introduce a new method to everyone, do not need to set the permissions of cmd! First talk about the principle, or open your cmd command window, run the command cmd /?, see what you got! Figure 1.

Note the following:

If /D is not specified on the command line, when CMD.EXE starts, it looks for the following REG_SZ/REG_EXPAND_SZ registry variable. If one or both of them exist, these two variables will be executed first.

HKEY_LOCAL_MACHINESoftwareMicrosoftCommand ProcessorAutoRun

and/or

HKEY_CURRENT_USERSoftwareMicrosoftCommand ProcessorAutoRun

This means that if there are two key values ​​HKEY_LOCAL_MACHINESoftwareMicrosoftCommand ProcessorAutoRun and HKEY_CURRENT_USERSoftwareMicrosoftCommand ProcessorAutoRun and you are not using Cmd.exe /D to start the cmd process will execute the two key-valued programs before starting cmd.exe. Hey, what do you think of, since you can execute your own program or script before cmd.exe, we can completely control the action of cmd.exe.