The command prompt has been disabled by your administrator?

Posted by Tariq • Thursday, February 5. 2009 • Category: One liners, Security

I came across an old enough post on Didier's blog about Group policies that have disabled cmd.exe from running. Didier mentions a few ways to get cmd.exe to run. The suggestion I like the most is to find the DisableCMD string in cmd.exe and change it to DisableAMD using a hex editor. Thankfully there is a tool which will allow us to patch cmd.exe in one tiny line.

The tool is Swiss File Knife and it is fantabulous. Luckily it is available on Windows as well as Linux. Oh yeah, the command!

Well first make a copy of your cmd.exe (%SYSTEMROOT%\System32\cmd.exe) file, mine is called cmd2.exe.

sfk replace cmd2.exe -binary /440069007300610062006c00650043004D004400/440069007300610062006c00650041004D004400/

A quick explanation of what is being changed

  D   i   s   a   b   l   e   C   M  D           ... to...
 440069007300610062006c00650043004D004400
  D   i   s   a   b   l   e   A   M  D    
 440069007300610062006c00650043004D004400

You can check your changes are all right if you see the following.

xxd cmd2.exe | egrep -A1 "D.i.s.a"

00040d0: 4400 6900 7300 6100 6200 6c00 6500 5500  D.i.s.a.b.l.e.U.
00040e0: 4e00 4300 4300 6800 6500 6300 6b00 0000  N.C.C.h.e.c.k...
--
0013d40: 7e05 ffff 4400 6900 7300 6100 6200 6c00  ~...D.i.s.a.b.l.
0013d50: 6500 4100 4d00 4400 0000 6689 18e9 def4  e.A.M.D...f.....
--
004a400: 2000 2000 2000 4400 6900 7300 6100 6200   . . .D.i.s.a.b.
004a410: 6c00 6500 2000 6500 7800 6500 6300 7500  l.e. .e.x.e.c.u.
--
004aad0: 2000 4400 6900 7300 6100 6200 6c00 6500   .D.i.s.a.b.l.e.
004aae0: 2000 6400 6500 6c00 6100 7900 6500 6400   .d.e.l.a.y.e.d.

Defined tags for this entry: cmd.exe, gpo, one liners, patch, security, sfk, swiss file knife, windows, xxd

Related entries by tags:

Vote for articles fresher than 90 days!

Current karma: 4.29 of 5, 7 vote(s) 13422 hits

0 Trackbacks

Trackback specific URI for this entry

No Trackbacks

4 Comments

Display comments as (Linear | Threaded)

The Snark on 2009-09-21 12:34: Works like a charm!
I administered the changes using a binary editor, but the result is the same.
Milk on 2009-11-18 00:14: Wow! Omg I"ve been searching for this since yesterday, I used a hex editor cus I couldnt get your thing to work but I just ctrl-fed the top hex number and found it and next to it it said the disable cmd thing and I just replaced the c with an A

THANKS SO MUCH!
bob on 2010-07-16 21:39: does the program work on win7 x64?
bob on 2010-07-16 21:48: Nvm my last comment, it works for 7....

but when i double click it, a cmd window pops up and closes in 2secs.

What's with that???

Gl.ib.ly