Code cracked! SS:WWW and CGI scripts

[dilettante]

AnalogX's SimpleServer:

http://WWW is

a lightweight web server for Windows that runs as a normal user application rather than an NT Service. It's a nice little web server that requires NEARLY ZERO configuration in order to server static pages and compiled CGI. It was never intended for production use, but in some instances it can be a great little tool.

I've had SimpleServer:

http://WWW version

1.23 running continuously for 2 1/2 years on a Windows 95 box exposed to the Internet (yes, with no reboots - it's on a UPS). Despite a raft of probes (probably from infected home installations of Apache and IIS) it has not been compromised.

By default it seems to try to run any file in /CGI-BIN/ as an EXE when referenced by an HTTP client. You can call a program MYCGI.EXE or MYCGI.CGI, either way it runs.

But what if you want to use Perl, or PHP, or... WSH as a CGI scripting engine?

Well despite hints at this and a lot of people asking "How?" all over the web I couldn't find the answer there. The author hasn't responded to my email requests. I assume that advanced configuration documentation was once provided, but none comes with the product and there isn't any on the web site or anywhere else to be found.


Never Give Up

There are a number of features in SimpleServer:

http://WWW that

can only be accomplished through undocumented configuration. I've probably spent about 50 hours fooling around to discover them, inspecting the server's EXE combined with much trial and error:
[ul][li]Changing the service port[/li]
[li]Controlling server logging[/li]
[li]Virtual hosts[/li]
[li]User authentication[/li]
[li]CGI scripts[/li][/ul]
Some of this can be achieved by changing Registry settings under:

[tt][HKEY_CURRENT_USER\Software\AnalogX\SimpleServer\WWW][/tt]

In particular you'll find the Port and logging entries pretty obvious there.

I hope to post a writeup in detail on my web site soon. I still have more to discover in order to get virtual hosts working. I have user authentication working but there are some more details there to work out in regard to users and virtual hosts.


Cracked the code: CGI scripting

The reason I'm posting this though is to describe what I've found out about CGI scripting with SimpleServer:WWW. I hope the author doesn't have an objection to this. I'm a bit suspicious because it wouldn't have taken much to publish what I had to reverse engineer.

I'm not a Perl or PHP guy, but the information here should be applicable to either. I was more interested in using the WSH CScript host to write CGI scripts in VBScript and JScript.

Ok, the usual caveat here: edit the Registry with care. Back it up first, etc. No warranty, your mileage may vary.

The answer is simple though. Just edit and save this Registry merge file, then import it via the Registry Editor (simply double-click on it from Explorer) and restart SimpleServer:WWW.

CGIScript.reg

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\AnalogX\SimpleServer\WWW\Associations]

[HKEY_CURRENT_USER\Software\AnalogX\SimpleServer\WWW\Associations\.js]
"Filename"="C:\\Windows\\System32\\CScript.exe"
"Commandline"="//nologo \"$1\" $2"

[HKEY_CURRENT_USER\Software\AnalogX\SimpleServer\WWW\Associations\.vbs]
"Filename"="C:\\Windows\\System32\\CScript.exe"
"Commandline"="//nologo \"$1\" $2"

[HKEY_CURRENT_USER\Software\AnalogX\SimpleServer\WWW\Associations\.wsf]
"Filename"="C:\\Windows\\System32\\CScript.exe"
"Commandline"="//nologo \"$1\" $2"

The creates an [tt]Associations[/tt] key under the [tt]WWW[/tt] key and adds three subkeys with two values each.

Edit the [tt]Associations[/tt] subkey(s) to fit your script file extension(s). Next edit each [tt]Filename[/tt] to point to your script host (which could be the PHP CGI interpreter, etc.). Finally edit the [tt]Commandline[/tt] to match the requirements of your script host.

Note that [tt]$1[/tt] is the full path and filename of the script source file the HTTP client requests. [tt]$2[/tt] inserts the query parameter string, though for normal GET/POST requests your CGI script should ignore the command line parameters and fet qyery parameters from the proper environment variable as usual.

Edits done? Save the .reg file and merge it. Restart SimpleServer:WWW. Drop scripts into /CGI-BIN/ and go.


Give It A Try

You can get SimpleServer:

http://WWW from

AnalogX SimpleServer:WWW. Installation is trivial. You'll find lot of other goodies at that site too.

My suggestion would be to:
[ul][li]First stop any port 80 web server you have running[/li]
[li]Install SimpleServer:WWW, and run it[/li]
[li]Configure the web root (a trivial matter, see the tiny [tt]http.txt[/tt] readme that comes with it)[/li]
[li]Stop SimpleServer:WWW[/li]
[li]Run the Registry Editor and navigate to the [tt]WWW[/tt] key[/li]
[li]Change the server's port to something else (8080, etc.)[/li]
[li]Exit the Registry Editor[/li]
[li]Restart your other web server if desired[/li]
[li]Restart SimpleServer:WWW[/li][/ul]
This gives you the basic configuration, using an alternate HTTP port.

After that you can perform the registry tweak described above to enable CGI scripting.


Demo

Here is a sample WSH CGI script written in VBScript:

dumpenv.vbs

Option Explicit
Dim colEnv, itmEnv

With WScript
  .Echo "Content-type: text/html"
  .Echo
  .Echo "<HTML><HEAD><TITLE>DumpEnv</TITLE></HEAD>"
  .Echo "<BODY><H1>Welcome to DumpEnv!</H1>"
  Set colEnv = CreateObject("WScript.Shell").Environment("Process")
  .Echo "<H2>Retrieve value by name:</H2>"
  .Echo "<P>SCRIPT_NAME = " & colEnv.Item("SCRIPT_NAME") & "</P>"
  .Echo "<H2>Dump all:</H2><P>"
  For Each itmEnv In colEnv
    .Echo itmEnv & "<BR>"
  Next
  Set colEnv = Nothing
  .Echo "</P></BODY></HTML>"
End With

Hit it by entering the URL:

[tt][ignore]

http://localhost:8080/cgi-bin/dumpenv.vbs

[/ignore][/tt]

I hope this has helped someone.