AutoHotkey Community

It is currently May 26th, 2012, 10:31 am

All times are UTC [ DST ]




Post new topic Reply to topic  [ 8 posts ] 
Author Message
 Post subject: Passwords in Exe Files?
PostPosted: August 8th, 2008, 9:39 am 
Offline

Joined: June 26th, 2007, 4:12 pm
Posts: 43
Hello, if I use runas in a script then I need to include my user account name and password. If I compile this into an exe file how secure is it? For example, would it be possible for the file to get hacked in some way if I inadvertantly hit a bad website while browsing? My apologies if this is a daft question. I just switched to using a Limited User Account on Windows XP. Currently I'm rightclicking and using Runas from explorer but I'd like to automate some tasks and want to avoid manually entering a password each time.

Thanks,

CaH


Report this post
Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: August 8th, 2008, 10:30 am 
Let the exe read the pw from an restricted area? So an attack would have to be done during its transmission. Good enough?


Report this post
Top
  
Reply with quote  
 Post subject:
PostPosted: August 8th, 2008, 1:15 pm 
Offline

Joined: June 26th, 2007, 4:12 pm
Posts: 43
Thanks for the reply - not sure I understand it! What I was thinking of doing was compiling an exe file containing my password. You seem to be suggesting accessing a file from a restricted area but what would that be C:\Program Files? Not sure how to create a restricted area or how to or why to pass a password to an exe file. What would i store the password in a text file. Sorry, I'm a complete beginner when it comes to this.

CaH


Report this post
Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: August 8th, 2008, 2:51 pm 
Offline

Joined: July 21st, 2008, 4:16 pm
Posts: 726
Location: Calgary, AB, Canada
First, search the forums for something called "Exe2Ahk". Your password is not safe in your exe.

Second, I think he means storing your password in something that has it's own password, or is hidden away. Problem is, you would need to have that extra info in your code, and if it's decompiled... Then people can go searching.

What I would really suggest is to have your program start with a single InputBox, that asks for your password. Enter your password once, and it saves to a variable for use everytime you need it. If you use this method, there is next to no chance for it to be put at risk. Win/Win. You only enter it once, it doesn't get found by others. Even if decompiled, the password only exists during "Run-Time", so they have no idea how to get at it.


Report this post
Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: August 8th, 2008, 3:38 pm 
Offline

Joined: June 26th, 2007, 4:12 pm
Posts: 43
Thanks for the reply. I'll check out Exe2Ahk. This is an example of what I'm using at the moment. I amended something I found in the forum:

Code:
Loop
{
  InputBox,pw,Password,,Hide,150,100
  If ErrorLevel
    Exit

  User=Myname ; or User=%A_UserName% or User=Mike
  GoSub,PassCheck
 
}


PassCheck:
  RunAs,%User%,%pw%
  RunWait,hh.exe,,UseErrorLevel
  RunAs
  If ErrorLevel=ERROR
    msgbox Password incorrect
  Else
  {
    RunAs, %User%,%pw%
   runwait devcon disable PCI\VEN_10EC, , hide
   RunAs
   Exit
   }
Return

How would I store the password variable for future use?

Thanks again,

CaH


Report this post
Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: August 8th, 2008, 5:41 pm 
Offline
User avatar

Joined: August 30th, 2005, 8:43 pm
Posts: 8666
Location: Salem, MA
if you compile the exe with a password and a /nodecompile option, the password is pretty safe. There is no way to completely block the source code being read, but that will stop the casual browser.

_________________
Image
(Common Answers) - New Tutorials Forum - Humongous FAQ


Report this post
Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: August 8th, 2008, 10:37 pm 
Offline

Joined: June 26th, 2007, 4:12 pm
Posts: 43
Hi, how do I do that. Looking at the Ahk2Exe that I have there seems to be one box for entering a password or typing N/A. How do I do both?

CaH


Report this post
Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: August 9th, 2008, 5:37 am 
Offline
User avatar

Joined: August 30th, 2005, 8:43 pm
Posts: 8666
Location: Salem, MA
there are a few scripts in the S&F subforum for "Those who Compile" that give you full options without using the command line to compile.

_________________
Image
(Common Answers) - New Tutorials Forum - Humongous FAQ


Report this post
Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 8 posts ] 

All times are UTC [ DST ]


Who is online

Users browsing this forum: azure, bobbysoon, BrandonHotkey, Google [Bot], iBob35555VR, Tilter_of_Windmills, tomoe_uehara and 68 guests


You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Powered by phpBB® Forum Software © phpBB Group