Execute local VBScript remotely over the web using any non IE web browser/smart phone.

[Doge SIA]

Curious if anyone has a way of executing VBScript remotely via any web browser(not IE) that will initiate the shut down a system, or just execute any VBScript on demand.

To be clear, the VBScript sits on the local Windows system and is remotely activated over the web using any web browser enabled device.

For instance, here is a simple script that is located on the Windows system and will initiate the shutdown of the system. What methods are used to activate or run this VBScript from a smart phone or any web browser (non IE)?


strComputer = "." ' Local Computer

Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate,(Shutdown)}\\" & _
strComputer & "\root\cimv2")
Set colOs = objWMIService.ExecQuery("Select * from Win32_OperatingSystem")

For Each objOs in colOs
objOs.Win32Shutdown(1)
Next

 

[strongm]

The only browser that supports vbscript is IE. And even in IE, as of about a month ago, Microsoft disabled vbscr

https://www.tek-tips.com/postedit.cfm?id=7443587&action=editipt

support

But if - as it really looks - you just want to remotely run a command, then it would be worth looking at something like Powershell or psexec. But be aware that your example script will have problems, because it requires the calling thread to have a very specific privilege - SeShutdownPrivilege - to be held, which the remote call will not have. And no, running as administrator does not enable it; it is substantially more complex than that (there are specific shutdown methods that can be called remotely, although these days they require a certain amount of config on the target machines before it will work)

 

[Doge SIA]

Hi Strongman,

Thanks for the reply. IE is no longer an option and I abandoned IE about 8-9 years ago since it was too restrictive. I execute VBScript using any browser/smart phone via small web server as a front end to pass credentials and whatever variables I want to pass to my VBScript, write that data to an internal pre-configured Access database which passes the variables to VBScript, and viola, shutdown not only a single system but all 12 or more systems in my lab from a smart phone using the code I posted. The shutdown script I posted has been on duty for over 10 years and was the very first script I executed from a browser. I have other examples to start/stop processes, services, verify, or delete files, NT Event log queries, collect system data and a host of other basic admin functions using VBScript, batch and WMI. I collect and store the output in the back-end Access database or write to excel files.

I also have embedded psexec so I can install software remotely using ad-hac WMI queries.

I have been doing this for over 10 years and occasionally post on forums to see if anyone else has figured out a way to utilize the millions of VBScript floating around in an interesting and useful way. Most of the VBScript/WMI I am using comes from Ed Wilson's library or scripts I found on the web and embedded into this web server.

Anyway, I am not trying to promote my way of executing VBScript and I do not share the program outside of my client group, just curious how others have solved the problem. You can see a video of how I make it work on Youtube. I posted a quick video the other day of a very simple UserName popup script and how I get that to execute from a browser, and remotely start and stop a command prompt.

https://youtu.be/4Jad0EP-d40

 

[strongm]

So can I just check - the illustrated solution is to install a webserver, plus a certain amount of configuration for each script, on the machine(s) you want to run the remote script on? I ask, because that is certainly what your demo video implies, and perhaps I've missed something.

 

[Doge SIA]

No, the web server DOES NOT need to exist on the remote systems. I just happen to run the web server on all my systems but that doesn't mean the web server needs to run on remote systems. This can be executed on remote systems without installing the web server on remote systems just like basic admin VBScript/WMI to collect some data or perform some action on 1000 remote machines as long as you have the right permissions, access, etc. Once a method is added to the web server it becomes part of the console and reused.

For instance, I have an instance to stop a process on remote or local systems that accepts the process name. I can use that to stop any process without creating a new method for each process. I simply reuse the process stop link and pass whatever process I want to stop to the script.

That video is a simple demo of a local method on systems where the web server is running just to show how it works in a very simple example. The admin section of the console is designed for local execution.

It gets much more interesting when running remote methods.

There are multi device methods that use a text file as input, and single device methods as well that pass credentials and variables to the backend scripts and remotely connect to systems just like you would expect from a VBScript running psexec/WMI to do whatever.

I just posted a couple more videos showing remote file collection and remote process creation/termination real-time viewing. These are basic admin VBScript/WMI that are embedded into the web server for both local and remote system data collection and management.


Remote collection of all System32/.exe file information and built-in reporting

https://youtu.be/9H-vxuvHBK0

Real-time remote process creation and termination monitor using VBScript and a web server

https://youtu.be/0KNkTrqj2h4