3

I have batch scripts that are scheduled to run daily. Some of the scripts have password in them. I'd like to protect the batch from being read or opened by those not authorized to open or read them.

My question is: What is a good way to protect batch file? Are there free or open source tool that compiles a batch file?

0

9 Answers 9

9

You can use NTFS ACLs to protect the files from users who are not authorized to execute them. Users who are authorized to execute them, by definition, can read the passwords (in the obfuscated form, if you choose to obfuscate them). Access to execute implies access to read. If the script can de-obfuscate the password so can the user.

Assuming you're trying to protect the passwords from the users who are allowed to execute the scripts, what you're saying isn't possible. You're really saying:

We have passwords that we need to give to users so they can use some software, but we don't want the user to know what the passwords are.

By definition the user's has to be able to recover the passwords in order to use them. Any obfuscation or encoding of the passwords that you perform is just a "speed bump" for a determined user to find out what the passwords are.

So long as the execution context of this script is the user you have to give them the passwords. Whether you attempt to obfuscate the passwords or not is your business, but you're still giving them the passwords.

3

I'd use something like BATCH2EXE and "compile" the batch file so they can't modify it. :-)

There's several of them out there. Some free, some cost a little.

Do a Google search for "batch2exe" or "bat2exe" and you'll see what I mean.

I've used various ones off and on throughout the years.

2

A quick and easy way to obfuscate batch files is to add the string "FF FE 0D 0A" at the start of the hex code (use a free hex editor). Often used by malware authors, this tricks text editing programs such as Notepad or Notepad++ into opening the file as if it were Unicode (when it is in-fact ASCII), resulting in garbled junk text. If however, the batch file is run, it will be processed by cmd.exe, not notepad.exe, thus running the obfuscated code (Windows cmd will read everything as ASCII).

This will not stop anyone who REALLY wants to see what's happening under the hood, but it will stop anyone who is not too savvy in reverse engineering. Hope this helps.

0
1

Could you have the password as a parameter to the batch file? Something like C:\MyBatchFile.bat MyPassword? Then inside the batch file, use %1 where the password is needed.

You would then add the password parameter as part of the invocation in the Task Scheduler. Now all the bat files could be out in the open, without revealing any secrets. then you just need to secure the Task Scheduler, which may or may not be easier.

0

Not that I'm aware of, and "compiling" a batch file wouldn't stop a determined individual from reverse engineering the resulting executable and gaining the password.

I would look at using ACLs in NTFS to deal with this.

0
0

In most cases we don't keep passwords in the batch or configuration files. If we really need to do so, We are using some encryption mechanism to do that. The program that uses those parameter is responsible for the decryption. If it is a program written by you perhaps you may use this approach. :)

0

Assuming the users you don't want to see the password also don't have the logon details for the account running the batch files and they don't have sufficient privileges to access that account's profile, you can create environment variables within that profile and use those variables in the batch files instead of the passwords themselves. This method is foolproof but it's not smartproof. i.e. Anyone with a bit of skill will not be stopped by that or an other method.

As for compiling batch files, that was a bit of a fad about a decade or so ago. Few still do it since there's absolutely no point to it. For every compiler you will be able to find a decompiler. Also take note of Evan's comments about obfuscation.

0

As someone already mentioned, it is never a good idea to have a readable password in a batch or a script file, especially since some of the scripting languages allow you to execute scripts from a web site. The best way to do this is to pass the password as a parameter. Here is what I do with my biterscripting scripts ( http://www.biterscripting.com ) .

Below is a sample script.

# Script sample.txt
# Input argument - login, password
var string login, password

somecommand $login $password

I call this script using the following entry on task manager.

"C:\biterScripting\biterScripting.exe" "sample.txt login("mylogin") password("mypassword")

You can use the same approach when having visitors execute your scripts as part of your web server.

Patrick

0

In your batch file you could put a "NET SEND" to send yourself a message whenever someone runs a file.

Also, you could script a check that the user belongs to a certain group, and if not, exit the script.

1
  • 2
    Net Send is deprecated in Vista/7/2008/2008R2
    – MDMarra
    Dec 9, 2011 at 20:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .