hacking contest

hacking exploits security forum
hacking
compliance articles
upgrade backup exec
information security consultant

Full Version: Disable Echo Command
Alexander01
possible? searched google, nothing interests found!
linux_dude
Do you want commands you execute to not have any output or not see anything at all?
Alexander01
this would be fine:

Microsoft Windows XP [Version 5.1.2600]
© Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\User>echo test > test.txt
'echo' is not recognized as an internal or external command,
operable program or batch file.

C:\Documents and Settings\User>

but there is no executable for the echo command so i dont know were to start..
linux_dude
I still have no clue why you're wanting these crazy system modificaitons, but here goes. Echo is not an exectuable, just like DIR isn't. It's physically built into cmd.exe. If you want that to happen, get yourself the pseudo source to an alternate cmd.exe and recompile it to not include 'echo' or whatever other dos-style commands you dont want existing.
PacMan03
linux_dude is correct about "echo" being built into cmd.exe.

You can think about it in the same way you would think about a
linux shell, where cmd.exe is your "shell." If you have ever
written your own shell or looked at the source code for an existing
one, you will realize that shells have quite a few built in commads.
This includes "echo", "cd", and much of the scripting language used
for .bat files.

Here is where linux_dude is wrong you don't need the source code
to "break" cmd.exe. Since you seem to be using Windows XP I will
use that in my example.

WARNING: make a backup copy of cmd.exe first!!

Open cmd.exe in your favorite hex editor. Now, search for "echo".

NOTE: Windows XP supports unicode so make sure you are searching
for a unicode string.

Your very first result should look like this:


0002F8D0 | 5000 4400 0000 0000 4100 5300 5300 4F00 | P.D.....A.S.S.O.
0002F8E0 | 4300 0000 4600 5400 5900 5000 4500 0000 | C...F.T.Y.P.E...
0002F8F0 | 4400 4500 4C00 0000 4500 4300 4800 4F00 | D.E.L...E.C.H.O.
0002F900 | 0000 0000 4500 4E00 4400 4C00 4F00 4300 | ....E.N.D.L.O.C.
0002F910 | 4100 4C00 0000 0000 4500 5200 4100 5300 | A.L.....E.R.A.S.


Now just change just change "4500 4300 4800 4F00" to "0000 0000
0000 0000", close your hex editor and run cmd.exe. BAM!

QUOTE

Microsoft Windows XP [Version 5.1.2600]
© Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>echo
'echo' is not recognized as an internal or external command,
operable program or batch file.

C:\WINDOWS\system32>
CloudyOne
i think what he means is,

some binders allow the option of opening something "hidden" meaning if it was a dos app, you never see ANYTHING.

I have also been wondering how to do this, if anybody can help please do smile.gif
sylver
cool thx for the nice information-i try to hexedit the cmd.exe...
Alexander01
QUOTE (PacMan03 @ Mar 9 2004, 05:32 AM)
linux_dude is correct about "echo" being built into cmd.exe.

You can think about it in the same way you would think about a
linux shell, where cmd.exe is your "shell." If you have ever
written your own shell or looked at the source code for an existing
one, you will realize that shells have quite a few built in commads.
This includes "echo", "cd", and much of the scripting language used
for .bat files.

Here is where linux_dude is wrong you don't need the source code
to "break" cmd.exe. Since you seem to be using Windows XP I will
use that in my example.

WARNING: make a backup copy of cmd.exe first!!

Open cmd.exe in your favorite hex editor. Now, search for "echo".

NOTE: Windows XP supports unicode so make sure you are searching
for a unicode string.

Your very first result should look like this:


0002F8D0 | 5000 4400 0000 0000 4100 5300 5300 4F00 | P.D.....A.S.S.O.
0002F8E0 | 4300 0000 4600 5400 5900 5000 4500 0000 | C...F.T.Y.P.E...
0002F8F0 | 4400 4500 4C00 0000 4500 4300 4800 4F00 | D.E.L...E.C.H.O.
0002F900 | 0000 0000 4500 4E00 4400 4C00 4F00 4300 | ....E.N.D.L.O.C.
0002F910 | 4100 4C00 0000 0000 4500 5200 4100 5300 | A.L.....E.R.A.S.


Now just change just change "4500 4300 4800 4F00" to "0000 0000
0000 0000", close your hex editor and run cmd.exe. BAM!

QUOTE

Microsoft Windows XP [Version 5.1.2600]
© Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>echo
'echo' is not recognized as an internal or external command,
operable program or batch file.

C:\WINDOWS\system32>

nice one dude!

thats what i wanna know! tnx!
DigitCrash
QUOTE (PacMan03 @ Mar 9 2004, 04:32 AM)
linux_dude is correct about "echo" being built into cmd.exe.

You can think about it in the same way you would think about a
linux shell, where cmd.exe is your "shell." If you have ever
written your own shell or looked at the source code for an existing
one, you will realize that shells have quite a few built in commads.
This includes "echo", "cd", and much of the scripting language used
for .bat files.

Here is where linux_dude is wrong you don't need the source code
to "break" cmd.exe. Since you seem to be using Windows XP I will
use that in my example.

WARNING: make a backup copy of cmd.exe first!!

Open cmd.exe in your favorite hex editor. Now, search for "echo".

NOTE: Windows XP supports unicode so make sure you are searching
for a unicode string.

Your very first result should look like this:


0002F8D0 | 5000 4400 0000 0000 4100 5300 5300 4F00 | P.D.....A.S.S.O.
0002F8E0 | 4300 0000 4600 5400 5900 5000 4500 0000 | C...F.T.Y.P.E...
0002F8F0 | 4400 4500 4C00 0000 4500 4300 4800 4F00 | D.E.L...E.C.H.O.
0002F900 | 0000 0000 4500 4E00 4400 4C00 4F00 4300 | ....E.N.D.L.O.C.
0002F910 | 4100 4C00 0000 0000 4500 5200 4100 5300 | A.L.....E.R.A.S.


Now just change just change "4500 4300 4800 4F00" to "0000 0000
0000 0000", close your hex editor and run cmd.exe. BAM!

QUOTE

Microsoft Windows XP [Version 5.1.2600]
© Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>echo
'echo' is not recognized as an internal or external command,
operable program or batch file.

C:\WINDOWS\system32>

thanks a lot for these nice little info!
linux_dude
Yah, yah. Hex it, recompile it. Whatever, I got my meaning across :-p
Just thinking too much along the unix lines.
Good Stuff~!
tweakz20
that's a good tip and all... but why don't you just use batch command "@echo off"??

it seems kind of stupid to do all of that for disableing a command that prints text on the screen... oh well
EzMe
c:\@echo off

I was thinking the same thing, why make it difficult while it is very easy smile.gif
PacMan03
tweakz20:
I'm not sure what Alexander01 had in mind but I think he wants to disable
the echo command as a method of securing a box. If the echo command is
disabled, you can't create files on the machine with echo+io redirection (for
example "echo bleh blah bluh>index.html").
Fuas
Dont think this would be a very good way to secure a box unless you secured all the poss ways to transfer a file to the box too (tftp, ftp, rcp, shares, email, ie bugs) or ppl could just transfer the file they need without echo.

as mentiond before you can @echo off to stop lines being displayd onto the screen.

or use a redirector to null to stop any programs reporting to cmd. ie

scan500 -p 139 xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx > nul:

will send the display to null.

or another way to stop it all is to create a bat file and use the start command to run it

ie

start /b file.bat

this will launch the file.bat into the b/ground hide from the user and still run all the commands contained.

if wanting to secure a box. then I would copy cmd.exe to cmd1.exe say. then edit cmd.exe and remove ALL the comands. type/copy/echo etc. would cripple the cmd.exe but would serve the purpose.

and the last way to start a program thats hidden to the desktop user is to start as a service.

use srunner, svcany, firedaemon etc. setup a service and your program will run hiden. even programs that display a screen to windows etc. all be hidden smile.gif
Kelso
Hey very nice information guys but is there a way to stop echo and ftp tftp net net1
with ONLY a bath or\and reg file(s) i belive that its possible but if anyone can help me lil' that wuld be great
hercules
QUOTE
another way to stop it all is to create a bat file and use the start command to run it

ie

start /b file.bat


Thanks for this note "Fuas" smile.gif
Paul
@kelso
just hex cmd.exe and replace it
and delete net.exe and copy cmd.exe net.exe same with other files will do
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.

 
Invision Power Board © 2001-2005 Invision Power Services, Inc.