Windows CLI

🚀 Windows Command Line Interface Server Configuration

This project focuses on configuring a Windows command - line interface server, providing detailed configuration options and security features to ensure the stability and security of the server.

🚀 Quick Start

Configuration

Basic Configuration

{
  "port": 3000,              // The port to which the service is bound, default is 3000
  "host": "localhost",       // The binding address, set to an IP or domain name, default is localhost
  "restrictWorkingDirectory": true, // Whether to restrict the command execution directory, default is true
  "allowedPaths": [          // Allowed folder paths, by default include the current working directory and the user's home directory
    "%current%",
    "%home%"
  ],
  "commandLengthLimit": 2000, // The maximum length limit of commands to prevent long - command injection, default is 2000 characters
  "logCommands": true,        // Whether to log executed commands, default is true
  "timeout": 30000            // The maximum allowed running time of a command (in milliseconds), default is 30 seconds
}

Shell Configuration

{
  "shells": [                // List of supported shells, by default include cmd and bash
    "cmd.exe",
    "/bin/bash"
  ],
  "blockedCommands": [       // Blocked dangerous commands, by default include rm, del, etc.
    "rm",
    "del",
    "format",
    "erase",
    " Cipher ",
    "vssadmin",
    "wbadmin",
    "regsvr32",
    "msbuild"
  ],
  "blockedArguments": [      // Blocked dangerous arguments, by default include /c,/f, etc.
    "/c",
    "/f",
    "/q",
    "/s",
    "-rf",
    "--force",
    "--recursive"
  ],
  "enableInjectionProtection": true, // Whether to enable command injection protection, default is true
  "caseInsensitiveBlocking": true     // Whether to block commands case - insensitively, default is true
}

SSH Configuration

{
  "ssh": {
    "enabled": true,          // Whether to enable the SSH function, default is true
    "maxConcurrentSessions": 5,// The maximum allowed number of concurrent SSH sessions, default is 5
    "defaultTimeout": 30000   // The default command timeout (in milliseconds), default is 30 seconds
  }
}

📚 Resources

SSH Connection

• URI Format: ssh://{connectionId}
• Description: Each SSH connection corresponds to a resource, displaying the connection configuration information and automatically masking sensitive data.
• Example: ssh://raspberry - pi will display the connection configuration named "raspberry - pi".

SSH Global Configuration

• URI: ssh://config
• Description: Displays the configuration parameters of the entire SSH server, including the default timeout, maximum concurrent connections, etc., and automatically masks password information.

Current Directory

• URI: cli://currentdir
• Description: Displays the working directory of the current command - line interface server, which is the directory when the service starts by default.

CLI Global Configuration

• URI: cli://config
• Description: Displays all configuration information of the CLI server, including security settings, shell parameters, and SSH configuration.

🔒 Security Considerations

Built - in Security Features (Cannot be Turned Off)

1. Case - Insensitive Command Blocking: All command blocking is case - insensitive. For example, "DEL.EXE" and "del.cmd" will be blocked if "del" is in blockedCommands.
2. Intelligent Path Resolution: The server will resolve the full command path to prevent spoofing attacks. For example, "%SystemRoot%\system32\cmd.exe" will be correctly recognized as cmd.exe.
3. Automatic Masking of Sensitive Information: When displaying any configuration or log, sensitive information such as passwords and keys will be automatically replaced with placeholders.
4. Session Expiration Mechanism: Idle SSH sessions and command histories will have a timeout limit to prevent unauthorized access.

Optional Security Features

1. Two - way Authentication: Supports client certificate verification or otp one - time password login methods to enhance the security of SSH connections.
2. Logging and Auditing: All user operations will be recorded in detail, including command content, execution time, etc., for subsequent audit analysis.

Important Security Warnings

• Default Configuration Risks: Using the default port 3000 and default paths may increase the risk of unauthorized access. Please change the relevant configuration according to actual needs.
• Weak SSH Password Policy: By default, weak password protocols (such as DSA) are prohibited. It is recommended to enforce RSA or ECDSA encryption in the production environment.
• Regular Update Checks: Due to the risk of zero - day vulnerabilities, it is recommended to regularly check and update the CLI server to the latest version.

📄 License

This project is licensed under the MIT License, which allows users to freely use, modify, and distribute the code, but the copyright notice must be retained. Please refer to MIT License for specific license content.

💻 Usage Examples

Basic Usage

# Query all available resources
curl http://localhost:3000/_resources

# Get current directory information
curl http://localhost:3000/cli://currentdir

# Execute system commands
curl -X POST --data "command=dir" http://localhost:3000/