File Transfer and cmd.exe with MSPaint

Let’s pretend you are on a locked down environment, and you want to transfer files or get a command prompt. There are many ways to “break out” of Windows restrictions, but here are two fun ones using MSPaint!

File Transfer:

Open MSPaint and open a new file:


In the file dialog box, enter the desired URL for the file transfer:

You will receive an error. Take notice that the file is downloaded to your Temporary Internet Files:


Copy it to a new location and run it. Enjoy!


How it works:

When you attempt to open up a file, MSPaint downloads a copy of the file to your Temporary Internet Files prior to parsing the file to make sure it is a valid file format. If it’s not a valid image format, it pops an error, but the file still remains in the file system.


Create a Command Prompt:

Open MSPaint and resize the canvas so it is 6 pixels by 1 pixels. Make sure to select Pixels and unselect Maintain aspect ratio:


Select the view tab, check Gridlines, and Zoom in until you can clearly see 6 pixels:


Use the custom RGB ability feature in paint create the custom color for each pixel. You can use the pencil tool to apply the color to each pixel.

Pixel 1 = R(10), G(0), B(0)

Pixel 2 = R(13), G(10), B(13)

Pixel 3 = R(100), G(109), B(99)

Pixel 4 = R(120), G(101), B(46)

Pixel 5 = R(0), G(0), B(101)

Pixel 6 = R(0), G(0), B(0)



Save the document as a 24-bmp file and then once saved browse to the location in the file system for where the document was saved and change the file type from .bmp to a .bat file. Once the change to the file type has been made, you can run the batch file which will open a command prompt for you.


How it works:


The above is the output of the file through a hex editor. The custom colors that were created equal cmd.exe in hex, which is the reason why running the batch file gives you access to the command prompt.


Leave a Reply

Your email address will not be published. Required fields are marked *