7

Can Mallory see my command line options on recent versions of Windows? (Google is not helping here)

Mallory is a non-administrator user on server X, as am I. I run foo.exe -x=s3cr3t

Can Mallory see -x=s3cr3t on say Windows 7, 8 or 10?

I ask because when using Process Explorer, as a non-admin user, I seem to be able to see command line options for System user processes. A SuperUser user claims the that they cannot see them, though they are Windows 10 and I am on Windows 7

Neil McGuigan
  • 3,429
  • 1
  • 18
  • 22

1 Answers1

3

I cannot confirm this ability in Windows 10, however it is possible in Win 7,8. Not only is it possible with Process Explorer, but also in Task Manager, and via command prompt with WMIC.

From superuser.com:

Open task manager (by CTRL-SHIFT-ESC, CTRL-ALT-DELETE or any other method).

For Windows 7 (and probably Windows XP):

Go to "Processes" tab. The on the "View" menu, select "Select Columns...". Check the checkbox of "Command Line" and click OK. (You may have to scroll down to find it) For Windows 8:

Go to "Details" tab. Right-click on any of the columns (eg. Names, PID etc.) and select "Select columns". Check the checkbox of "Command Line" and click OK. (You may have to scroll down to find it) A column of Command lines of will be added to the currently displayed columns.

[...cut...]

You can do it without Process Explorer, too, using Windows' WMI service. Run the following from the command prompt:

WMIC path win32_process get Caption,Processid,Commandline

Community
  • 1
Matt Butler
  • 263
  • 1
  • 5