How to pass password with special characters in cmd? - cmd

Question

I am using plink to ssh to many servers and execute commands. But, unable to execute commands on console when password has special characters.
Usage: plink.exe -ssh -pw "password" user#myhost "command to execute"
apof~!##$%^&*()_+{}|:"sdfsdfs!df - Success when escaped " with \.
apof~!##<>$%^&*()_+{}|:"sdfsdfs!df - Success when escaped " with \.
apof~!##$%^&*()_+{}|:"<>sdfsdfs!df - Failed. Escaped " with \. Failure message: > was unexpected at this time.
apof~!##$%^&*()_+{}|:"><sdfsdfs!df - Failed. Escaped " with \. Failure message: < was unexpected at this time.
apof~!##$%^&*()_+{}|:"<sdfsdfs!df - Failed. Escaped " with \. Failure message: The system cannot find the path specified.
apof~!##$%^&*()_+{}|:">sdfsdfs!df - Failed. Escaped " with \. Failure message: The system cannot find the path specified.
Looks like when < or > appear after ", the escape does not work. Many I know how to handle this?

Answer 1

Realized that the issue is not with plink to escape the special characters, but with how cmd handles special characters. For this, I created a simple Java class to take the command line argument and print it:
public class MyTest {
public static void main(String args[]) {
System.out.println(args[0]);
}
}
I passed inputs with special characters to this application and here is the output:
C:\>java MyTest "apof~!##$%^&*()_+{}|:"<>?-=`[]\;',./sss"
> was unexpected at this time.
C:\>java MyTest "apof~!##$%^&*()_+{}|:\"<>?-=`[]\;',./sss"
> was unexpected at this time.
C:\>java MyTest "apof~!##$%^&*()_+{}|:\"^<^>?-=`[]\;',./sss"
apof~!##$%^&*()_+{}|:"<>?-=`[]\;',./sss
C:\>java MyTest "apof~!##$%^&*()_+{}|:\"^<^>?-=`[]\;',./s\"sasfafds"
apof~!##$%^&*()_+{}|:"<>?-=`[]\;',./s"sasfafds
C:\>java MyTest "apof~!##$%^&*()_+{}|:\"^<^>?-=`[]\;',./s\"sasf<>afds"
apof~!##$%^&*()_+{}|:"<>?-=`[]\;',./s"sasf<>afds
C:\>java MyTest "apof~!##$%^&*()_+{}|:\"^<^>?-=`[]\;',./s\"sasf<>af\"ds"
apof~!##$%^&*()_+{}|:"<>?-=`[]\;',./s"sasf<>af"ds
C:\>java MyTest "apof~!##$%^&*()_+{}|:\"^<^>?-=`[]\;',./s\"sasf<>af\"dasd<>fs"
> was unexpected at this time.
C:\>java MyTest "apof~!##$%^&*()_+{}|:\"^<^>?-=`[]\;',./s\"sasf<>af\"dasd^<^>fs"
apof~!##$%^&*()_+{}|:"<>?-=`[]\;',./s"sasf<>af"dasd<>fs
C:\>java MyTest "apof~!#<>#$%^&*()_+{}|:\"^<^>?-=`[]\;',./s\"sasf<>af\"dasd^<^>fs"
apof~!#<>#$%^&*()_+{}|:"<>?-=`[]\;',./s"sasf<>af"dasd<>fs
From this analysis, it is found that only special character to be escaped is " and any < or > symbol occurring after alternate " has also to be escaped with ^. This document pointed me to the escape part.
Below is the python function which I have written for generating the escaped parameter:
def escapepassword(initpassword):
passsplit = list(initpassword)
quotesflag=False
index = -1
for token in passsplit:
index += 1
if quotesflag and (token in ("<", ">")):
passsplit[index] = "^" + token
else:
if token == '"':
passsplit[index] = "\\\""
quotesflag = not quotesflag
return "".join(passsplit)
Still I had issues with calling the executable with escaped arguments. I was using the following way of executing the command:
subprocess.Popen('plink.exe -ssh -batch -pw' + escapepassword(password) + ' ' + username + '#' + ipaddress + ' "' + command + '"', stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
Or to say in Java, it would be:
Runtime.getRuntime().exec("plink.exe -ssh -batch -pw" + escapepassword(password) + " " + username + "#" + ipaddress + " \"" + command + "\"");
This has given much trouble. The way python or Java execute the process is different. The special characters gets escaped and gets passed to the process. Hence, it creates much more issues. To handle this, I changed the above code to:
commandtoexecute = ['plink.exe', '-ssh', '-batch', '-pw', password, username + '#' + ipaddress, command]
subprocess.Popen(commandtoexecute, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
In Java, could be written as:
Runtime.getRuntime().exec(new String [] {"plink.exe", "-ssh", "-batch", "-pw", password, username + "#" + ipaddress, command);
Here, command had space in between, for e.g. ls -al, but this is the way to pass arguments to start a process. When I tried passing command between ", it had given error saying command not found because " was also getting passed for execution on the remote system.
Note:
I had used the command WMIC path win32_process get name,Commandline | find "plink.exe" to see the commandline arguments. The output is html escaped, however, it has helped to find the arguments passed.