You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
`gsudo` was born in 2019 as a productivity tool and is open-source. It has been downloaded over 700k times so far and has enjoyed a warm reception from users.
10
+
11
+
Microsoft initially declined to create a similar tool, citing security concerns. However `gsudo`'s documentation [challenged this view](security.md) arguing that absolute security is unattainable without altering Windows itself, and that the default same-desktop UAC is not completely secure either.
12
+
13
+
In February 2024, Microsoft reversed its stance and released [Sudo for Windows](https://devblogs.microsoft.com/commandline/introducing-sudo-for-windows/).
14
+
15
+
Surprisingly, Microsoft's sudo does not leverage new OS features to enhance security. Its mechanisms are akin to `gsudo`, making their security models comparable. The question of which one is more secure depends on which version of each are you comparing, and how many open bugs it has. The initial release of Microsoft's sudo presented some [critical issues](https://www.tiraniddo.dev/2024/02/sudo-on-windows-quick-rundown.html) that they will hopefully address very soon. `gsudo` has fixed similar issues in the past and may in the future.
| Source code available |[Yes](https://github.com/gerardog/gsudo)| Not for `sudo.exe`, but [promised](https://github.com/microsoft/sudo/blob/f8f1d05/README.md#contributing)|
27
+
28
+
### Security Impersonation Features
29
+
30
+
| Feature |`gsudo`| Sudo for Windows |
31
+
| ------- | ------- | ------------------ |
32
+
| Run with custom Integrity | Yes (`-i`, `--integrity`) | No |
33
+
| Run as System | Yes (`-s`, `--system`) | No |
34
+
| Run as TrustedInstaller | Yes (`--ti`)| No |
35
+
| Run as user | Yes (`-u user`) | No |
36
+
37
+
### User Experience
38
+
39
+
| Feature |`gsudo`| Sudo for Windows |
40
+
| ------- | ------- | ------------------ |
41
+
| Easy to install and update | Yes (winget, choco, scoop) | No (Windows Insider build required) |
42
+
| See less UAC Pop-ups | Yes ([Credentials Cache](credentials-cache.md)) | No |
43
+
| Elevate current shell | Yes | No |
44
+
| Elevate commands using current shell | Yes | No |
45
+
| Red # indicator for elevation on CMD | Yes | No |
46
+
47
+
### Additional Features
48
+
49
+
| Feature |`gsudo`| Sudo for Windows |
50
+
| ------- | ------- | ------------------ |
51
+
| Run in new window | Yes | Yes |
52
+
| Option to keep new window open until a key is pressed |[Yes](tips/elevation-in-new-window.md)| No |
53
+
| Option to keep new window's shell open |[Yes](tips/elevation-in-new-window.md)| No |
54
+
| Run with Input Disabled |[Yes](https://gerardog.github.io/gsudo/docs/security#what-are-the-risks-of-running-gsudo)| Yes |
| Auto-complete of last 3 commands | Yes (with [gsudoModule](usage/powershell.md#gsudo-powershell-module)) | No |
63
+
| Auto-complete of options | Yes (with [gsudoModule](usage/powershell.md#gsudo-powershell-module)) | No |
64
+
| Red # indicator for elevation | Yes (with [gsudoModule](usage/powershell.md#gsudo-powershell-module)) | No |
65
+
66
+
## What if I install both?
67
+
68
+
If you have both Microsoft Sudo and `gsudo` installed, they both should work independently.
69
+
70
+
The `sudo` keyword will run Microsoft's sudo instead of `gsudo` because the typical install of `Sudo for Windows` (which is via a Windows Insider build) puts it in `c:\Windows\System32\sudo.exe`. This folder appears first in the `PATH` environment variable, therefore when running `sudo`, the Microsoft `sudo.exe` will take precedence over gsudo's `sudo` alias.
Copy file name to clipboardexpand all lines: docs/docs/security.md
+17-13
Original file line number
Diff line number
Diff line change
@@ -4,17 +4,17 @@ title: Security Considerations
4
4
hide_title: true
5
5
---
6
6
7
-
## Why Windows doesn't have a `sudo` command? Should it have one?
7
+
## Why doesn't Windows have a `sudo` command? Should it have one?
8
8
9
9
To answer this question, we first have to take a look back at the history.
10
10
11
11
In August 2002, Chris Paget released a white paper describing a form of attack against event-driven systems that he termed Shatter Attack. It allowed processes in the same session to bypass security restrictions by abusing Windows Message loop.
12
12
13
-
Microsoft response was to add "User Interface Privilege Isolation" (UIPI) and the "User Access Control" (UAC) popup to the next major release: Windows Vista. Privileged processes would then run "elevated" at high integrity level, out of reach of processes at lower, non-admin, levels.
13
+
Microsoft's response was to add "User Interface Privilege Isolation" (UIPI) and the "User Access Control" (UAC) popup to the next major release: Windows Vista. Privileged processes would then run "elevated" at high integrity level, out of reach of processes at lower, non-admin, levels.
14
14
15
-
I assume that at this point Microsoft decided not to make a `sudo` tool for windows. It would be an unwanted bridge between two worlds that intended to isolate.
15
+
I assume that at this point, Microsoft decided not to make a `sudo` tool for windows. It would be an unwanted bridge between two worlds that intended to isolate.
16
16
17
-
But that insulation quickly proved weak. Let me [quote Raymond Chen from Microsoft](https://devblogs.microsoft.com/oldnewthing/20160816-00/?p=94105):
17
+
However, that insulation quickly proved to be weak. Let me [quote Raymond Chen from Microsoft](https://devblogs.microsoft.com/oldnewthing/20160816-00/?p=94105):
18
18
19
19
> There’s a setting that lets you specify how often you want to be prompted by UAC. You can set any of four levels:
20
20
>
@@ -28,40 +28,44 @@ But that insulation quickly proved weak. Let me [quote Raymond Chen from Microso
28
28
> - Always notify
29
29
> - Meh
30
30
>
31
-
> The reason why all the other options collapse into Meh is that the `Notify only when apps try to change settings` option can be subverted by any app simply by injecting a thread into (...)
31
+
> The reason why all the other options collapse into Meh is that the `Notify only when apps try to change settings` option can be subverted by any app simply by injecting a thread (... a hacking technique explained ...)
32
32
33
-
And, up to this day, Windows 10 & 11, defaults to "Meh". Microsoft default is: user convenience at the expense of lesser security.
33
+
And, up to this day, Windows 10 & 11, defaults corresponds to that "Meh". Microsoft's default stance is user convenience at the expense of lesser security.
34
34
35
35
---
36
36
37
37
[Windows 11 UAC Settings: Default mode is recommended only if you **don't** run untrusted software.]
38
38
39
39
---
40
40
41
-
Over time, no less than a hundred UAC-bypass techniques were disclosed. Many of them still work in an updated Windows 11. Windows Defender, or your antivirus of choice, will stop them (hopefully). But if you disable your AV, UAC bypass is easy.
41
+
Over time, more than a hundred UAC-bypass techniques have been disclosed. Many of them still work in an updated Windows 11. It is Windows Defender, or your antivirus of choice, who may stop them (hopefully). But if you disable your AV, UAC bypass is easy.
42
42
43
-
Microsoft did not patch them. Instead, they assumed publicly that `UAC/UIPI` in default mode is not a security boundary. I will [quote Microsoft documentation](https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/disable-user-account-control#:~:text=More%20important%2C%20Same%2Ddesktop%20Elevation,be%20considered%20a%20convenience%20feature.) :
43
+
And Microsoft can't just patch them all without loosing 'convenience' features. They instead, they assumed publicly that `UAC/UIPI` in default mode is not a security boundary. I will [quote Microsoft documentation](https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/disable-user-account-control#:~:text=More%20important%2C%20Same%2Ddesktop%20Elevation,be%20considered%20a%20convenience%20feature.) :
44
44
45
45
> Same-desktop Elevation in UAC isn't a security boundary. It can be hijacked by unprivileged software that runs on the same desktop. Same-desktop Elevation should be considered a convenience feature.
46
46
47
-
Which means: <b>UAC does not protect you from threats. It's a convenience tool that protects you from shooting yourself in the foot.</b>
47
+
Which to me, it means: <b>UAC is a convenience tool. It does not protect you from threats, it works as a warning that protects you from shooting yourself in the foot.</b>
48
48
49
-
And, in my opinion, it's not doing the best possible job:
49
+
And if UAC is a convenience tool, in my opinion it's not doing the best possible job:
50
50
51
51
- You waste important time by switching between elevated and unelevated windows. You must manually carry your command and context to the elevated window, each time, back and forth.
52
52
- ... or you suffer from "elevation fatigue". For example, you elevate a whole console beforehand, and you do all your stuff there, likely running non-admin or untrusted stuff as admin.
53
53
54
-
**In conclusion:**
54
+
**In conclusion:**
55
55
56
-
- Same-desktop UAC is a vulnerable convenience feature, and so is `gsudo`. In any case, **the only thing that protects you from malware is you and your Antivirus.**.
56
+
- Same-desktop UAC is a vulnerable convenience feature.
57
+
-`gsudo` is also a vulnerable convenience feature.
58
+
- Whether you use `gsudo` or not, **the only thing that protects you from malware is not UAC, it is you and your Antivirus.**.
59
+
60
+
So, if you decide to use `gsudo`, here are the risks:
57
61
58
62
## What are the risks of running gsudo?
59
63
60
64
gsudo could be used as an attack vector for escalation of privileges. Using antivirus software and avoiding running untrusted software
61
65
62
66
-**Abusing an elevation made with gsudo:**
63
67
64
-
A medium integrity process could drive the gsudo-elevated process.
68
+
A medium integrity process could drive the gsudo-elevated process.
65
69
66
70
When gsudo elevates **in the same console**, it creates a connection between a medium and a high integrity process. A malicious process (at medium integrity) can then drive the medium integrity console: sending keystrokes to the high integrity app, or scrapping its screen.
0 commit comments