I need a Client-Side command shell invoked by VBScript hosted on Internet Explorer

I have a simple solution for this.  You register an application to handle a file type say .MAG for example.  You tell IE not to browse this file type using itself. So your web-server can divert  to a file say MyFile.mag and your exe file will start running and can thendo anything it wants.  Your exe file decodes the mag file (it will receive a command line like /o "My File name.mag")

A further extension to this idea is to create an asp page like this one set up for .sar files.  This ASP page will create download file dynamically passing the URL extension into the file.

At night time there is a scheduled task which deletes the contents of the dynamic download files.

Hope this helps:~)

PS You can cheat by using a .reg file to create the IE browser extension handles. Or you can create some VB code.

See next post for the registry file needed.

---------------createsar.asp example dynamic download file

%
' Generates an on-the-fly download file
' the url will be saved into a generated file
' the URL MUST HAVE an action parameter
'example http://tp-server/createsar.asp?action=invoice&entry=123456

Dim sExtension

sExtension = ".sar"
Dim FS
Set FS = Server.CreateObject("Scripting.FileSystemObject")

dim sFile
dim sLocation
dim sAction
sAction=Request.QueryString("Action")
sLocation="r:\downloads\sars\"

dim lc
lc=1
Do
  sFile="r:\downloads\sars\" & saction & cstr(lc) & sExtension
  If Not fs.FileExists(sFile) Then
    Exit Do
  End If
  lc=lc+1
loop

dim fname
set fname=fs.CreateTextFile(sfile,true)
fname.WriteLine(request.querystring)
fname.Close
set fname=nothing
set fs=nothing

response.redirect "http://tp-server/downloads/sars/"+saction+cstr(lc) + sExtension

%>

Woops just noted the above could be improved:

response.redirect "http://tp-server/downloads/sars/" & saction & cstr(lc) & sExtension

Here is an example reg file which installes the registry tweaks so that the exe resource.exe will get fired when the op  double clicks a .sqr file or tries to download one from the intranet.

-----------------------------------example.reg
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.SAR]
@="SaracsResources.Start"

[HKEY_CLASSES_ROOT\SaracsResources.Start]
@="Saracs Resources"
"BrowserFlags"=dword:00000008
"EditFlags"=dword:00010000

[HKEY_CLASSES_ROOT\SaracsResources.Start\DefaultIcon]
@="\"r:\\saracs\\resource.exe\",0"

[HKEY_CLASSES_ROOT\SaracsResources.Start\shell]

[HKEY_CLASSES_ROOT\SaracsResources.Start\shell\edit]

[HKEY_CLASSES_ROOT\SaracsResources.Start\shell\edit\command]
@="\"C:\\WINNT\\NOTEPAD.EXE\"  \"%1\""

[HKEY_CLASSES_ROOT\SaracsResources.Start\shell\open]

[HKEY_CLASSES_ROOT\SaracsResources.Start\shell\open\command]
@="\"r:\\saracs\\resource.exe\" \"/O\" \"%1\""

[HKEY_CLASSES_ROOT\SaracsResources.Start\shell\print]

[HKEY_CLASSES_ROOT\SaracsResources.Start\shell\print\command]
@="\"r:\\saracs\\resource.exe\" \"/P\" \"%1\""

[HKEY_CLASSES_ROOT\SaracsResources.Start\shell\printto]

[HKEY_CLASSES_ROOT\SaracsResources.Start\shell\printto\command]
@="\"r:\\saracs\\resource.exe\" \"/PT\" \"%1\" \"%2\" \"%3\" \"%4\" \"%5\" \"%6\""

The final tip........notice above the the exe located in a server file r:\saracs\resource.exe is started on the client side.
The trick which will save you buckets of time is to make the resource.exe open a text file: resource.txt which contains the latest version of the real exe which will actually do the work needed.

The problem is that you will not be able to change your exe if it needs enhancements/bug fixes.  You will need to get maybe  200 users off the server, which can take all day.  Using this method you don't need to bother.

Because you can change the url on your web-site is a few seconds, you just need to add a decode for the new action that is passed to you app.

So each time you recompile your handler you give it a name like

res201.exe, next time res202.exe, etc.  When the compile is complete edit the file resource.txt with the new name e.g.

----------resource.txt file example
res202.exe


How to create resource.exe:
1) Create an app with a dummy form.  This app just needs the form to have the icon that you want to use.

2) add a module to the app amd make the startup object to be Sub Main

Sub Main()

Dim lLFN As Long
Dim sEXEPath As String
Dim sLinkFile As String
Dim sMes As String

On Error Resume Next

Do

    ' Are we running in IDE ot EXE mode
    Err.Clear
    Debug.Print 1 / 0
    IDE = Err.Number <> 0
    Err.Clear
   
    ' get the file which the pointer to the real exe
    If IDE Then
        sLinkFile = "r:\saracs\resource" + ".txt"
    Else
        sLinkFile = App.Path + "\" + App.EXEName + ".txt"
    End If
   
    ' open the file
    lLFN = FreeFile
    Open sLinkFile For Input Shared As #lLFN
    If Err.Number <> 0 Then
        sMes = "Could not open file: " + sLinkFile + vbCrLf + Err.Description
        Exit Do
    End If
   
    On Error GoTo 0
   
    ' read the data from the file
    sEXEPath = Input(LOF(lLFN), lLFN)
   
     ' remove an accidental CR/LF
    lLFN = InStr(sEXEPath, vbCrLf)
    If lLFN > 1 Then
        sEXEPath = Left(sEXEPath, lLFN - 1)
    End If
   
    ' Create the name of the EXE to shell to
    ' also add the command lines passed by the web-site
    Dim ok
    sEXEPath = App.Path + "\" + sEXEPath + " " + Command
    On Error Resume Next
   
    ' fire the appication
    ok = Shell(sEXEPath, vbNormal)
    If ok < 1 Then
        sMes = "Could not open file: " + sEXEPath _
        + vbCrLf + "Link file: " + sLinkFile + vbCrLf + Err.Description
        Exit Do
    End If
   
    End
Loop

MsgBox sMes, vbExclamation, App.Title

End Sub

Further, you don't need to create an exe file to handle your functions, you can edit the .reg file to run a VB script  so instead f r:\\saracs\resource.exe etc.....just wscript.exe

Bit like this:

HKEY_CLASSES_ROOT\SaracsResources.Start\shell\open\command]
@="\"r:\\saracs\\resource.exe\" \"%1\""
 
Say is you registered file type mag in this way, rename your vbs files to .mag should work ok.

Woops - Bit like this:

HKEY_CLASSES_ROOT\SaracsResources.Start\shell\open\command]
@="\"wcript.exe\" \"%1\""
 

Alternatively, most browsers are set to respond to the telnet:// protocol, by launching the appropriate app.  You could alway put a link in your web page to    telnet://yourserver:port, using the following HTML:

    <a href="telnet://yourserver:port">Open telnet session</a>

That should do it, too...

J.