Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Getting Script Name from wscript.exe Process

Tags:

vbscript

I am using this code:

Dim name
name = CreateObject("WScript.Shell").ExpandEnvironmentStrings("%computername%")
Set wmi = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" _ 
    & name & "\root\cimv2")
For Each hwnd In wmi.InstancesOf("Win32_Process")
    If hwnd.Name = "wscript.exe" Then
        'get name and possibly location of currently running script
    End If
Next

I am successfully listing all processes and picking out the wscript.exe. However, I have searched and have found no way to find the name of the script running in wscript.exe, ie. is it myscript.vbs or jscript.js or anything. Bonus if there is a way to find the whole path of the script.

EDIT:

With more searching, I found a solution. In the above script, the hwnd variable stores the handle for the wscript.exe process. There is a property for handles: hwnd.CommandLine. It shows how to call it from the command line, so it would be something like:

"C:\Windows\System32\wscript.exe" "C:\path\to\script.vbs"

So I can parse the hwnd.CommandLine string to find the path and name of all running scripts.

like image 429
Bob Avatar asked Jul 22 '26 02:07

Bob


1 Answers

You have ScriptName and ScriptFullName properties.

' in VBScript
WScript.Echo WScript.ScriptName
WScript.Echo WScript.ScriptFullName

// in JScript
WScript.Echo(WScript.ScriptName);
WScript.Echo(WScript.ScriptFullName);

[EDIT] Here you go (use .CommandLine property):

Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" _
    & "." & "\root\cimv2")

Set colProcesses = objWMIService.ExecQuery( _
    "Select * from Win32_Process " _
    & "Where Name = 'WScript.exe'", , 48)

Dim strReport
For Each objProcess in colProcesses
    ' skip current script, and display the rest
    If InStr (objProcess.CommandLine, WScript.ScriptName) = 0 Then
        strReport = strReport & vbNewLine & vbNewLine & _
            "ProcessId: " & objProcess.ProcessId & vbNewLine & _
            "ParentProcessId: " & objProcess.ParentProcessId & _
            vbNewLine & "CommandLine: " & objProcess.CommandLine & _
            vbNewLine & "Caption: " & objProcess.Caption & _
            vbNewLine & "ExecutablePath: " & objProcess.ExecutablePath
    End If
Next
WScript.Echo strReport
like image 69
Panayot Karabakalov Avatar answered Jul 24 '26 09:07

Panayot Karabakalov



Donate For Us

If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!