I want to hide system commands issued from system()

Question

Writing a program in c++ and I want to issue a system command from the system() function but I don't want the user to see the command (because the command includes a pwd) in the executable window. I need to copy a file from the user's directory onto the server without allowing user access to the server or displaying the pwd. Figured having a .exe that does this is the easiest way.

Ex:

system("FILETRANSFER_SW.exe -pw helloWORLD11!@ C:/temp.txt F:/tempfolder/")

But the executable window is showing this command, hence defeating the purpose of trying to hide the password.

I tried issuing system("@echo OFF") at the beginning of the program but that does not suppress the following commands, they still show up in the executable window.

Any suggestions?

Thanks...

Answer 1

The command line of running processes is considered public information in most operating systems.

Therefore it is a very bad idea to pass passwords on the command line.

There are two common workarounds to this problem, both of which require the support of the executable being called:

• instead of passing the username/password on the command line, pass the name of a file containing the username/password
• re-set the command line of the running process from within the called executable.

The first solution is easy and universally possible, the second one has a race condition and is harder to implement, because there's no cross-platform way to do it (on some OSes, changing argv will help).

Answer 2

I'm assuming from your command line that you're using Windows. If it doesn't need to be portable I would suggest you use the CreateProcess() API instead of calling system().

The CreateProcess() API can take a command-line and you can set up the STARTUP_INFORMATION parameter to hide the new process window (wShowWindow = SW_HIDE).

The command line will be hidden from the casual user, but as others have pointed out, it's not that hard to retrieve. Since you are creating a new process, I would suggest writing the sensitive data to that process' standard input. That way the process can just read it and proceed normally.

Answer 3

Using CreateProcess() API will hide the sensitive data from a user, but a power user can easily get the command line associated with the process using a free utilty, e.g. Process Explorer

Answer 4

Another solution is to send the password between your programs, encrypted with something like 3DES, or AES.

You could use a pipe to comunicate between both programs, and don't use the command line at all.

But any of this schemes is not really secure they can be circumvent rather easily. If you want more security you should use some kind of challenge-response protocol with the server.