As a software engineer this has caused me problems building some opensource c++ code with very long filenames in deeply nested paths. The workaround for one project was that I had to use the subst command map a drive letter to a path to shorten it enough for the build to succeed. It was so frustrating to me that this still existed in 20XX.

@@drescherjm just use the \\?\ prefix and be done with it.

@@DutchRider Thankfully I build the two problematic libraries in a different way now using vcpkg and don't have the issue. With that said I am not sure if the build tools (CMake and QMake) would allow for UNC paths. I have never tried that.

durrp

interesting... i wouner what happends if u do [set COMSPEC="cmd.exe(pipesign)cmd.exe"]... an endless loop?, or maby an loop that ends when some calling stack is full? ... maby someone could try this? or maby [set COMSPEC="cmd.exe >(pipesign)notepad.exe(pipesign)notepad.exe"]? sounds like the behaviour would be rly odd.... maby each cmd has its own stack?

It's the | char ..... That's the "pipe" command ... There's literally two commands on that one line.

@@eidodk no not the pipe itself, it's like AckZero wrote: it's the internal commands of CMD. type, dir and echo are internal commands, whereas clip and whoami are external commands (standalone programs or scripts). You can see in the video that calc.exe isn't run twice when John piped into clip and whoami.

@@eidodk Yeah exactly when you string commands together with pipe it executes one command at a time

yee

Windows is werid when ls doesent work

clear is a powershell cmdlet

@BrightHades5968 technically an alias for clear-host. But the alias is made to be friendly for linux users. Another example is "ls" which is one of the aliases for get-childitem

Also, he seems to needlessly reinvoke his SET command every time he runs CLS. It's just clearing the screen, not running a new instance of CMD!

Kind of forgot, but you can also split the pane within each tab. Just right-click the tab and click split pane. Just thought I'd share that bit too. Both methods would probably help keep things smooth when you're recording 👍 In any case, really cool stuff covered here. I think I learned more than 3 things though lol I didn't know set on its own would display the environment variables

You can also switch shells on-the-fly same as in Linux: PS currentPath> cmd currentPath> wsl /currentPath>exit currentPath> exit PS currentPath>

test.bat "String" echo DB "%1", FF>>tmp.deb debugoutput.txt The output of a attached string into a memory location from a batch file using debug in DOS have no quote bytes.

Yup gotta keep Windows and top security companies always on their toes huh lols 😆 always vulnerabilities and penetrations for them to constantly forever keep patching out or working around always. Glad this kind of stuff goes online so Windows and the like can see what's going on under the hood, cuz I bet there is alot that goes unseen/unuploaded/unshared and are kept as potential 0 Days. Tbh I think Windows needs to rework more than just this, they need a new design cuz Windows 7 was my last fave OS version and then it got all weird with the new stuff.

@user-rb5we8ms4m Hell yeah! Oh wait... it's a scam.. what a shame

my thinking too

That's 100% correct. There's nothing funny going on here. The thing does exactly what you asked of it.

No! COMSPEC is a path to the command to be interpreted, NOT a path plus a variable to be passed to that command. Notepad isn't saying "I can't find this file", windows is saying "I cant find a file called 'notepad test.txt'".

The Win32 limitation for environment variables is 32,767 characters. 😂

microsoft? fix it?? ummmm there track record isnt good lol

Sometimes, when searching for vulns in my environment, I see they're systems having CVE created when I was a little child getting my first PC. This is not a big deal really ;)

Did he not mention you inherit environment variables from the parent? Ie, Process inherits theirs from the Userprofile, which inherits it from the System environment variables. Any changes are in their own container and gets passed on, if you in cmd.exe 'set PITA=Yes', then 'cmd.exe' (you start new subprocess cmd.exe) and type 'echo %PITA%', it outputs 'Yes' because it inherits it from the parent (process in this case). Type 'exit' and you are back in the parent cmd.exe process. Userprofile < inherits from System |------CreateProcess (Explorer, or whatever) < inherits from userprofile +----cmd.exe set %PITA%=Yes < inherits from Explorer, or whatever | `---cmd.exe = echo %PITA% = Yes < inherits from cmd.exe +----cmd.exe echo %PITA = %PITA% < inherits from Explorer, or whatever But start a new cmd.exe (new Terminal tab or start from start menu) and 'echo %PITA%' does not exist, it just prints '%PITA%'. If you have access to change System envvars, you are already admin., if you have access to change User envvars, you are not a limited process. At some point you need to be a parent to manipulate a childs envvars through child process or other ways, but you would then likely have access.

@@TilKenneth Just to clarify. Variables are generally stored in the registry keys. Of course, You can track the changes in user/system registry but formatting of the output in sysmon logs is not that simple - there is no log like "variable changed". In case of processess ofc, precisely theyre stored in PEB structure in process memory and they are inherited by child. The starting values are taken from registry too. Im not sure if there is special process privilege for editing systemwide envvars. My point is, if you were able to produce events for vars in registry, security monitoring would be much easier. BTW, who cares about security monitoring in microsoft, they need you rather to pay for they're edr to do this, but to my taste it is much to pricey. I prefer to save on software and invest in people, against the market unfortunately.

@@TilKenneth is that a technical way of saying..its running as admin and looking for the file in user admin not user john.... i think if he moves test.exe to c:\ from c:\users\john\ it shouldnt kick the file not found

If it ain't broke don't fix it!

Then you would just be invoking the desired executable just as you regularly would, wouldn't you?

@@_JohnHammond Indeed, just wanted to ensure my thoughts

He's just saying this is something new for most people, Mr. Dunning Krueger

You broke mobile comment display lol

Who would have thought? 🫢

Woooow grape! Cmd is very dangerous chutiya

So you tell me that you were using legacy microsoft code? What could have gone wrong ;)?

@@ukaszgeras6600 i can guess that own microsoft cmd can use in bad things like reverse shell etc... Not just in good😅. Our microsoft frends made it too wrong🫢🫨😅🤷‍♂️

@@gamergaminghx1625 only thing you need to set the reverse shell is the process or thread in victim process. No matter how you spawn this, the more legacy features you got, the more vector attacks youll find.