Restrict command execution

[SmoothieNoIce]

Hello.

I really like your idea of being able to monitor cmd and powershell in real time. I'm currently extending this program to hook into the Readfile() input to monitor cmd's started by psexec, because some penetration test tool may use psexec to run the cmd(like impacket-psexec).

I'm currently trying to block specific commands, although I'm using traceapi I still don't have an idea of how to do it, if you're interested can we discuss it?

This is the log of traceapi running echo hi from a cmd started by psexec.

LOGD: Ready for clients.  Press Ctrl-C to stop.
20241212124214938 4628 50.60: trcapi32: 000 -ReadFile(,,,,) -> 1
20241212124214938 4628 50.60: trcapi32: 000 +SetFilePointer(2a8,0,0,1)
20241212124214938 4628 50.60: trcapi32: 000 -SetFilePointer(,,,) -> 0
20241212124214938 4628 50.60: trcapi32: 000 +ReadFile(2a8,79a7f0,1,32ff7cc,0)
20241212124214938 4628 50.60: trcapi32: 000 -ReadFile(,,,,) -> 1
20241212124214938 4628 50.60: trcapi32: 000 +SetFilePointer(2a8,0,0,1)
20241212124214938 4628 50.60: trcapi32: 000 -SetFilePointer(,,,) -> 0
20241212124214938 4628 50.60: trcapi32: 000 +ReadFile(2a8,79a7f0,1,32ff7cc,0)
20241212124214938 4628 50.60: trcapi32: 000 -ReadFile(,,,,) -> 1
20241212124214938 4628 50.60: trcapi32: 000 +SetFilePointer(2a8,0,0,1)
20241212124214938 4628 50.60: trcapi32: 000 -SetFilePointer(,,,) -> 0
20241212124214938 4628 50.60: trcapi32: 000 +ReadFile(2a8,79a7f0,1,32ff7cc,0)
20241212124214938 4628 50.60: trcapi32: 000 -ReadFile(,,,,) -> 1
20241212124214938 4628 50.60: trcapi32: 000 +SetFilePointer(2a8,0,0,1)
20241212124214938 4628 50.60: trcapi32: 000 -SetFilePointer(,,,) -> 0
20241212124214938 4628 50.60: trcapi32: 000 +ReadFile(2a8,79a7f0,1,32ff7cc,0)
20241212124214938 4628 50.60: trcapi32: 000 -ReadFile(,,,,) -> 1
20241212124214938 4628 50.60: trcapi32: 000 +SetFilePointer(2a8,0,0,1)
20241212124214938 4628 50.60: trcapi32: 000 -SetFilePointer(,,,) -> 0
20241212124214938 4628 50.60: trcapi32: 000 +ReadFile(2a8,79a7f0,1,32ff7cc,0)
20241212124214938 4628 50.60: trcapi32: 000 -ReadFile(,,,,) -> 1
20241212124214938 4628 50.60: trcapi32: 000 +SetFilePointer(2a8,0,0,1)
20241212124214938 4628 50.60: trcapi32: 000 -SetFilePointer(,,,) -> 0
20241212124214938 4628 50.60: trcapi32: 000 +ReadFile(2a8,79a7f0,1,32ff7cc,0)
20241212124214938 4628 50.60: trcapi32: 000 -ReadFile(,,,,) -> 1
20241212124214938 4628 50.60: trcapi32: 000 +SetFilePointer(2a8,0,0,1)
20241212124214938 4628 50.60: trcapi32: 000 -SetFilePointer(,,,) -> 0
20241212124214938 4628 50.60: trcapi32: 000 +ReadFile(2a8,79a7f0,1,32ff7cc,0)
20241212124214938 4628 50.60: trcapi32: 000 -ReadFile(,,,,) -> 1
20241212124214938 4628 50.60: trcapi32: 000 +GetFileType(2a8)
20241212124214938 4628 50.60: trcapi32: 000 -GetFileType() -> 3
20241212124214938 4628 50.60: trcapi32: 000 +SetFilePointer(2a8,0,0,1)
20241212124214938 4628 50.60: trcapi32: 000 -SetFilePointer(,,,) -> 0
20241212124214938 4628 50.60: trcapi32: 000 +GetFileType(338)
20241212124214938 4628 50.60: trcapi32: 000 -GetFileType() -> 3
20241212124214938 4628 50.60: trcapi32: 000 +WriteFile(338,79a7f0,8,32ff7a4,0)
20241212124214938 4628 50.60: trcapi32: 000 -WriteFile(,,,,) -> 1
20241212124214938 4628 50.60: trcapi32: 000 +GetConsoleOutputCP()
20241212124214954 4628 50.60: trcapi32: 000 -GetConsoleOutputCP() -> 1b5
20241212124214954 4628 50.60: trcapi32: 000 +GetConsoleOutputCP()
20241212124214954 4628 50.60: trcapi32: 000 -GetConsoleOutputCP() -> 1b5
20241212124214954 4628 50.60: trcapi32: 000 +GetConsoleTitleW(32ff5d0,104)
20241212124214954 4628 50.60: trcapi32: 000 -GetConsoleTitleW(Administrator: C:\Windows\system32\cmd.exe,) -> 2a
20241212124214954 4628 50.60: trcapi32: 000 +GetConsoleTitleW(3425778,104)
20241212124214954 4628 50.60: trcapi32: 000 -GetConsoleTitleW(Administrator: C:\Windows\system32\cmd.exe,) -> 2a
20241212124214954 4628 50.60: trcapi32: 000 +SetConsoleTitleW(Administrator: C:\Windows\system32\cmd.exe - echo  hi)
20241212124214954 4628 50.60: trcapi32: 000 -SetConsoleTitleW() -> 1
20241212124214954 4628 50.60: trcapi32: 000 +GetFileType(338)
20241212124214954 4628 50.60: trcapi32: 000 -GetFileType() -> 3
20241212124214954 4628 50.60: trcapi32: 000 +WriteFile(338,79a7f0,4,32ff364,0)
20241212124214954 4628 50.60: trcapi32: 000 -WriteFile(,,,,) -> 1
20241212124214954 4628 50.60: trcapi32: 000 +SetConsoleTitleW(Administrator: C:\Windows\system32\cmd.exe)
20241212124214954 4628 50.60: trcapi32: 000 -SetConsoleTitleW() -> 1
20241212124214954 4628 50.60: trcapi32: 000 +SetConsoleMode(338,0)
20241212124214954 4628 50.60: trcapi32: 000 -SetConsoleMode(,) -> 0
20241212124214954 4628 50.60: trcapi32: 000 +GetConsoleMode(338,7925ac)
20241212124214954 4628 50.60: trcapi32: 000 -GetConsoleMode(,) -> 0
20241212124214954 4628 50.60: trcapi32: 000 +GetConsoleMode(2a8,7925b0)
20241212124214954 4628 50.60: trcapi32: 000 -GetConsoleMode(,) -> 0
20241212124214954 4628 50.60: trcapi32: 000 +GetConsoleOutputCP()
20241212124214954 4628 50.60: trcapi32: 000 -GetConsoleOutputCP() -> 1b5
20241212124214954 4628 50.60: trcapi32: 000 +GetConsoleOutputCP()
20241212124214954 4628 50.60: trcapi32: 000 -GetConsoleOutputCP() -> 1b5
20241212124214954 4628 50.60: trcapi32: 000 +GetFileType(338)
20241212124214954 4628 50.60: trcapi32: 000 -GetFileType() -> 3
20241212124214954 4628 50.60: trcapi32: 000 +WriteFile(338,79a7f0,2,32ff4e0,0)
20241212124214954 4628 50.60: trcapi32: 000 -WriteFile(,,,,) -> 1
20241212124214954 4628 50.60: trcapi32: 000 +GetFileType(338)
20241212124214954 4628 50.60: trcapi32: 000 -GetFileType() -> 3
20241212124214954 4628 50.60: trcapi32: 000 +WriteFile(338,79a7f0,17,32ff4e4,0)
20241212124214954 4628 50.60: trcapi32: 000 -WriteFile(,,,,) -> 1
20241212124214954 4628 50.60: trcapi32: 000 +GetFileType(2a8)
20241212124214954 4628 50.60: trcapi32: 000 -GetFileType() -> 3
20241212124214954 4628 50.60: trcapi32: 000 +SetFilePointer(2a8,0,0,1)
20241212124214954 4628 50.60: trcapi32: 000 -SetFilePointer(,,,) -> 0
20241212124214954 4628 50.60: trcapi32: 000 +ReadFile(2a8,79a7f0,1,32ff7cc,0)

Here is my code to get cmd command from ReadFile()

static BOOL(WINAPI* pReadFile)(
	HANDLE hFile,
	LPVOID lpBuffer,
	DWORD nNumberOfBytesToRead,
	LPDWORD lpNumberOfBytesRead,
	LPOVERLAPPED lpOverlapped
	) = ReadFile;

static std::string inputBuffer;

BOOL WINAPI HookedReadFile(
	HANDLE hFile,
	LPVOID lpBuffer,
	DWORD nNumberOfBytesToRead,
	LPDWORD lpNumberOfBytesRead,
	LPOVERLAPPED lpOverlapped
) {
	BOOL result = pReadFile(hFile, lpBuffer, nNumberOfBytesToRead, lpNumberOfBytesRead, lpOverlapped);
	if (result && lpNumberOfBytesRead && *lpNumberOfBytesRead > 0) {
		DWORD fileType = GetFileType(hFile);

		if (fileType == FILE_TYPE_PIPE) {
			// read characters
			std::string data(static_cast<char*>(lpBuffer), *lpNumberOfBytesRead);
			inputBuffer += data;

			if (inputBuffer.find("\n") != std::string::npos) || inputBuffer.find("\r") != std::string::npos) {
				std::cout << ("Intercepted Pipe ReadFile: " + inputBuffer + "\n").c_str() << std::endl;
			}
		        inputBuffer.clear();
		}
	}

	return result;
}