4 ms·

And today I learned that Windows supports running Javascript as shell script. huh

by bdamm 3y ago

parasti 3y ago
It's technically JScript.
jraph 3y ago
Yes, the same way one could write VBS (Visual Basic Script). I think Windows 98 already had this ability. Possibly Windows 95 as well. It's a variant of the language called JScript, which is what was used in old versions of IE too.
- p_l 3y ago
  It was about Windows 98 that Windows Scripting Host ended up prominent. WSH btw allowed you to run any language that you had interpreter for - they had to support necessary COM interfaces (and to be truly usable, allow you to call COM objects), and register their interpreter class with ActiveScripting (WSH internal) engine. Then you could use them not just for desktop automation, but also for scripts inside Internet Explorer (essentially, classic IE used WSH engines to implement scripts, iirc) I've seen WSH (including HTAs) used with Perl, Python, Tcl, Rexx...so long as you install the interpreter with compatible COM service, you could use it.
mark_and_sweep 3y ago
Been using this for years. Mostly really useful. Sometimes tricky to get right since the available APIs are semi-well documented and it's JScript, which is some sort of old Internet Explorer-ish version of JavaScript. By the way, there are also HTAs, which are Microsoft HTML Applications. You can create a simple double-clickable GUI with these using only HTML and JScript.
- jeroenhd 3y ago
  Pretty crazy how Microsoft basically invented the Electron app as HTAs all the way back in 1999. Of course we browsers weren't as capable as they are today, but "I just want a HTML+CSS GUI" had been a solved problem for over ten years when Electron first came out.
  - jraph 3y ago
    Yes, and XULRunner allowed this too, using Gecko, Firefox's web engine, to render HTML-like markup specifically designed to build native-like GUIs. Apparently XULRunner was first released in 2006, but Thunderbird, which uses (used?) the same technology, was released as early as 2003, and maybe this was existing in the Mozilla Suite even before.
    - mook 3y ago
      Thunderbird never quite used XULRunner, I think; they always built their own binary (though at some point quite a lot of the shared stuff moved into the XRE stuff). Think of it as they had a fork of Firefox (much like Firefox had a stripped down fork of the SeaMonkey stuff). Also, I think one of the Start Menus (might have been XP‽) was kind of HTA-ish? Not sure about that part, though.
      - jraph 3y ago
        > they always built their own binary > Think of it as they had a fork of Firefox Yep indeed, you are right. Notable projects using actual XULRunner included Songbird (a music player) and BlueGriffon, an WYSIWYG HTML editor (a successor of Nvu and KompoZer, themselves succeeding Netscape Composer). Both released after 2006 indeed. I liked XUL, I strongly believe Mozilla could have dominated the market taken by Electron, had they pushed XULRunner more, and perhaps make it transition to pure HTML, like they did to Firefox's core, because that's what people know and because XUL was a maintenance burden. I think XUL tags made more sense than HTML to build UIs, though, and with XUL, Gecko have had a CSS flex-like mechanism for a long time by the way. [1] https://en.wikipedia.org/wiki/Songbird_%28software%29 https://en.wikipedia.org/wiki/Songbird_%28software%29 [2] https://en.wikipedia.org/wiki/BlueGriffon https://en.wikipedia.org/wiki/BlueGriffon
        vidarh 3y ago
        There was an experiment back in the hazy past around that time called Entity that did something similar. It was never complete enough to be a competitor to XULRunner, but it was fascinating for two reasons: 1) You could write event handlers in multiple languages, including C. If you wrote them in C, it spawned gcc and compiled it into a library, and dynamically loaded it... The overall idea of a polyglot runtime like that was fun. 2) #1 is only really weird because this could be done at runtime. One of the demo apps was an editor for the GUI itself, where you could add buttons to the editor, then write that event handler in C, and have it compiled and loaded into the editor itself... It was a fascinating starting point, though full of heavy duty foot guns, and I'm still sad nobody took it further.
Roark66 3y ago
It is very common for malware to contain java script payloads that try to obfuscate themselves like like this: Seemingly_random_code(seemingly_random_string) The seemingly_random_code decompresses/decodes whatever is in the seemingly_random_string and hands over control to it. Interestingly the decoded code is another version of the same with different code and string. This goes on for ~100 layers deep then at the end it just downloads and executes some file from the net.
- yjftsjthsd-h 3y ago
  > This goes on for ~100 layers deep then at the end it just downloads and executes some file from the net. I understand doing one layer. I guess I could maybe see two layers. But why would it bother with 100 layers? Either the antivirus or reverse-engineering tool can grab the final product or it can't.
  - rightbyte 3y ago
    With enough conditional evals() with dynamic inputs you can make the search space unsearchable big.
    - heavenlyblue 3y ago
      The search space is linear as the algorithm is linear.
      - sigmoid10 3y ago
        This stuff is mostly done to make static analysis harder.
  - tsimionescu 3y ago
    Typically scanning tools have some limit to how much they probe complex formats, to avoid stalling the entire system while they're scanning. It's very much conceivable that a scan tool will try to resolve code like this for 10 layers, and then if the result is not found to be malicious, consider it safe. This is similar to how compilers will often have recursion limits for things like generics, though in that case it's easier to reject the program if the recursion limit is reached.
technion 3y ago
Malware delivered as an email with a link to a zip file containing a .js file is one of the most common methods of delivery, right behind word macros. The "map the .js extension to notepad.exe" is a common security trick with a measurable, immediate drop in malware in large orgs. You can deploy it via GPO or InTune. Personal promotion, I built this as a better alternative: https://github.com/technion/open_safety https://github.com/technion/open_safety Note the built in .js parser hasn't basically ever updated, if you're writing for this you're writing like you're targetting IE5.
- notpushkin 3y ago
  > It creates the file "example.com" in the same directory containing the EICAR test string. This should set off appropriate alarms Huh, neat!
xinayder 3y ago
And it's even funnier that the solution the author gives is "hey execute this javascript code that uninstalls a program and deletes itself afterwards" like, really? can't you write that in C? I don't think most Win32 apps use JavaScript for their installers.
- deleted 3y ago
  [deleted]
- mananaysiempre 3y ago
  > can't you write [a self-deleting executable] in C? The point of the exercise is that, on Windows, you can’t, because Windows won’t let anyone delete executables that are currently in use (try it, you won’t be able to delete one either). Upgrading shared DLLs in the face of this fact is why installers for Windows programs often have to have you reboot the system (and in more civilized times asked you to close other programs before installation to reduce the probability of hitting a locked DLL). It’s also why there’s a registry key[1] containing a list of rename and delete actions to be performed on next reboot (usually accessed via the MOVEFILE_DELAY_UNTIL_REBOOT flag to MoveFileEx). You can’t (straightforwardly[2]) make a self-deleting batch script, either, because the command interpreter parses a command at a time and so wants the batch file to exist. The Windows Scripting Host, on the other hand, will parse the whole file at once, close it, and then forget about it, so you can write self-deleting WSH scripts. The workaround used by the uninstaller under discussion is instead for the executable to inject some code into the Windows Explorer (on the assumption that it’s always running and the user has to have access permissions for it) that accomplishes the deletion through return-oriented programming, so that the stack it’s executing from can then disappear into the wind (apparently? I’m not seeing how they plan to clean that up). On a POSIX system you are explicitly allowed to delete any open file—including an executing one—making it languish in a kind of system-managed limbo (and take up disk space, invisibly) until it’s closed. The tradeoff is then that it’s impossible to ensure you’ve opened the same file as somebody else when all you have is its name. (I think you can at least check for success, provided you also have the device and inode numbers for it.) [1] https://superuser.com/questions/58479/is-there-a-registry-key-to-tell-windows-to-delete-a-file-at-next-startup/58481 https://superuser.com/questions/58479/is-there-a-registry-ke... [2] https://stackoverflow.com/questions/20329355/how-to-make-a-batch-file-delete-itself/20333575 https://stackoverflow.com/questions/20329355/how-to-make-a-b...
xxs 3y ago
about what a sibling mentioned 'JScript' - not javascript; the infamous Microsoft EEE (the 2nd part) It has been there for decades.
dolmen 3y ago
This feature has existed for more than 25 years. My concern is more than Raymond Chen suggest that using it is still the recommended way. So much malware came through WScript.
- criddell 3y ago
  Well, he did warn you it would be indistinguishable from malware…
- pie_flavor 3y ago
  Scripting is normal functionality for an OS to support. I don't know why people pretend JScript/WScript are evil but Bash is fine.
queuebert 3y ago
What could possibly go wrong?
orangea 3y ago
So does macos: https://developer.apple.com/library/archive/releasenotes/InterapplicationCommunication/RN-JavaScriptForAutomation/Articles/Introduction.html https://developer.apple.com/library/archive/releasenotes/Int...

And today I learned that Windows supports running Javascript as shell script. huh

by bdamm 3y ago

And today I learned that Windows supports running Javascript as shell script. huh

parasti 3y ago

It's technically JScript.

jraph 3y ago

Yes, the same way one could write VBS (Visual Basic Script). I think Windows 98 already had this ability. Possibly Windows 95 as well. It's a variant of the language called JScript, which is what was used in old versions of IE too.

p_l 3y ago
It was about Windows 98 that Windows Scripting Host ended up prominent. WSH btw allowed you to run any language that you had interpreter for - they had to support necessary COM interfaces (and to be truly usable, allow you to call COM objects), and register their interpreter class with ActiveScripting (WSH internal) engine. Then you could use them not just for desktop automation, but also for scripts inside Internet Explorer (essentially, classic IE used WSH engines to implement scripts, iirc) I've seen WSH (including HTAs) used with Perl, Python, Tcl, Rexx...so long as you install the interpreter with compatible COM service, you could use it.

mark_and_sweep 3y ago

Been using this for years. Mostly really useful. Sometimes tricky to get right since the available APIs are semi-well documented and it's JScript, which is some sort of old Internet Explorer-ish version of JavaScript. By the way, there are also HTAs, which are Microsoft HTML Applications. You can create a simple double-clickable GUI with these using only HTML and JScript.

jeroenhd 3y ago
Pretty crazy how Microsoft basically invented the Electron app as HTAs all the way back in 1999. Of course we browsers weren't as capable as they are today, but "I just want a HTML+CSS GUI" had been a solved problem for over ten years when Electron first came out.
- jraph 3y ago
  Yes, and XULRunner allowed this too, using Gecko, Firefox's web engine, to render HTML-like markup specifically designed to build native-like GUIs. Apparently XULRunner was first released in 2006, but Thunderbird, which uses (used?) the same technology, was released as early as 2003, and maybe this was existing in the Mozilla Suite even before.
  - mook 3y ago
    Thunderbird never quite used XULRunner, I think; they always built their own binary (though at some point quite a lot of the shared stuff moved into the XRE stuff). Think of it as they had a fork of Firefox (much like Firefox had a stripped down fork of the SeaMonkey stuff). Also, I think one of the Start Menus (might have been XP‽) was kind of HTA-ish? Not sure about that part, though.
    - jraph 3y ago
      > they always built their own binary > Think of it as they had a fork of Firefox Yep indeed, you are right. Notable projects using actual XULRunner included Songbird (a music player) and BlueGriffon, an WYSIWYG HTML editor (a successor of Nvu and KompoZer, themselves succeeding Netscape Composer). Both released after 2006 indeed. I liked XUL, I strongly believe Mozilla could have dominated the market taken by Electron, had they pushed XULRunner more, and perhaps make it transition to pure HTML, like they did to Firefox's core, because that's what people know and because XUL was a maintenance burden. I think XUL tags made more sense than HTML to build UIs, though, and with XUL, Gecko have had a CSS flex-like mechanism for a long time by the way. [1] https://en.wikipedia.org/wiki/Songbird_%28software%29 https://en.wikipedia.org/wiki/Songbird_%28software%29 [2] https://en.wikipedia.org/wiki/BlueGriffon https://en.wikipedia.org/wiki/BlueGriffon
      - vidarh 3y ago
        There was an experiment back in the hazy past around that time called Entity that did something similar. It was never complete enough to be a competitor to XULRunner, but it was fascinating for two reasons: 1) You could write event handlers in multiple languages, including C. If you wrote them in C, it spawned gcc and compiled it into a library, and dynamically loaded it... The overall idea of a polyglot runtime like that was fun. 2) #1 is only really weird because this could be done at runtime. One of the demo apps was an editor for the GUI itself, where you could add buttons to the editor, then write that event handler in C, and have it compiled and loaded into the editor itself... It was a fascinating starting point, though full of heavy duty foot guns, and I'm still sad nobody took it further.

Roark66 3y ago

It is very common for malware to contain java script payloads that try to obfuscate themselves like like this: Seemingly_random_code(seemingly_random_string) The seemingly_random_code decompresses/decodes whatever is in the seemingly_random_string and hands over control to it. Interestingly the decoded code is another version of the same with different code and string. This goes on for ~100 layers deep then at the end it just downloads and executes some file from the net.

yjftsjthsd-h 3y ago
> This goes on for ~100 layers deep then at the end it just downloads and executes some file from the net. I understand doing one layer. I guess I could maybe see two layers. But why would it bother with 100 layers? Either the antivirus or reverse-engineering tool can grab the final product or it can't.
- rightbyte 3y ago
  With enough conditional evals() with dynamic inputs you can make the search space unsearchable big.
  - heavenlyblue 3y ago
    The search space is linear as the algorithm is linear.
    - sigmoid10 3y ago
      This stuff is mostly done to make static analysis harder.
- tsimionescu 3y ago
  Typically scanning tools have some limit to how much they probe complex formats, to avoid stalling the entire system while they're scanning. It's very much conceivable that a scan tool will try to resolve code like this for 10 layers, and then if the result is not found to be malicious, consider it safe. This is similar to how compilers will often have recursion limits for things like generics, though in that case it's easier to reject the program if the recursion limit is reached.

technion 3y ago

Malware delivered as an email with a link to a zip file containing a .js file is one of the most common methods of delivery, right behind word macros. The "map the .js extension to notepad.exe" is a common security trick with a measurable, immediate drop in malware in large orgs. You can deploy it via GPO or InTune. Personal promotion, I built this as a better alternative: https://github.com/technion/open_safety https://github.com/technion/open_safety Note the built in .js parser hasn't basically ever updated, if you're writing for this you're writing like you're targetting IE5.

notpushkin 3y ago
> It creates the file "example.com" in the same directory containing the EICAR test string. This should set off appropriate alarms Huh, neat!

xinayder 3y ago

And it's even funnier that the solution the author gives is "hey execute this javascript code that uninstalls a program and deletes itself afterwards" like, really? can't you write that in C? I don't think most Win32 apps use JavaScript for their installers.

deleted 3y ago
[deleted]
mananaysiempre 3y ago
> can't you write [a self-deleting executable] in C? The point of the exercise is that, on Windows, you can’t, because Windows won’t let anyone delete executables that are currently in use (try it, you won’t be able to delete one either). Upgrading shared DLLs in the face of this fact is why installers for Windows programs often have to have you reboot the system (and in more civilized times asked you to close other programs before installation to reduce the probability of hitting a locked DLL). It’s also why there’s a registry key[1] containing a list of rename and delete actions to be performed on next reboot (usually accessed via the MOVEFILE_DELAY_UNTIL_REBOOT flag to MoveFileEx). You can’t (straightforwardly[2]) make a self-deleting batch script, either, because the command interpreter parses a command at a time and so wants the batch file to exist. The Windows Scripting Host, on the other hand, will parse the whole file at once, close it, and then forget about it, so you can write self-deleting WSH scripts. The workaround used by the uninstaller under discussion is instead for the executable to inject some code into the Windows Explorer (on the assumption that it’s always running and the user has to have access permissions for it) that accomplishes the deletion through return-oriented programming, so that the stack it’s executing from can then disappear into the wind (apparently? I’m not seeing how they plan to clean that up). On a POSIX system you are explicitly allowed to delete any open file—including an executing one—making it languish in a kind of system-managed limbo (and take up disk space, invisibly) until it’s closed. The tradeoff is then that it’s impossible to ensure you’ve opened the same file as somebody else when all you have is its name. (I think you can at least check for success, provided you also have the device and inode numbers for it.) [1] https://superuser.com/questions/58479/is-there-a-registry-key-to-tell-windows-to-delete-a-file-at-next-startup/58481 https://superuser.com/questions/58479/is-there-a-registry-ke... [2] https://stackoverflow.com/questions/20329355/how-to-make-a-batch-file-delete-itself/20333575 https://stackoverflow.com/questions/20329355/how-to-make-a-b...

xxs 3y ago

about what a sibling mentioned 'JScript' - not javascript; the infamous Microsoft EEE (the 2nd part) It has been there for decades.

dolmen 3y ago

This feature has existed for more than 25 years. My concern is more than Raymond Chen suggest that using it is still the recommended way. So much malware came through WScript.

criddell 3y ago
Well, he did warn you it would be indistinguishable from malware…
pie_flavor 3y ago
Scripting is normal functionality for an OS to support. I don't know why people pretend JScript/WScript are evil but Bash is fine.

queuebert 3y ago

What could possibly go wrong?

orangea 3y ago

So does macos: https://developer.apple.com/library/archive/releasenotes/InterapplicationCommunication/RN-JavaScriptForAutomation/Articles/Introduction.html https://developer.apple.com/library/archive/releasenotes/Int...