Running VBS script on server from IIS (ASP)

Question

I am trying to run a VBS file from within an ASP file on a server (IIS-6) I have changed the security so one have to login to the server to access the ASP-page (this so that ASP is given permission to the place where the VBS files are stored).

So, I have a default.asp page that looks like this:

<%response.write "hello" 'just for debugging purposes.
set objshell = server.createobject("wscript.shell")
objShell.Run "c:\test\test.vbs",0,true '0=no interaction, true=wait for command to finish%>

The VBS file is just an empty file (some remarks) so what SHOULD happen, is the wscript should run, do nothing, close wscript.exe and return that it is done.

What happens in the above example is that on the server wscript.exe starts, and the webpage waits for the command to finish. But the wscript.exe never quits/stops by itself. If I end the wscript.exe process then the page will continue loading. But the VBS will not have been executed.

So I have tried a few modifications, I added code to the VBS file to write a file with the time of the execution, so I KNOW that it does not run the VBS file.

I have also tried other variants of the objshell.run/exec commands:

objsshell.exec("cscript.exe /B /H:Cscript c:\test\test.vbs") ' nothing happens at all.
objsshell.exec("wscript.exe /B /H:Cscript c:\test\test.vbs") ' wscript and "hangs"

Anyone have any tips on how I get the VBS command to run, and the Wscript.exe process to exit?

Answer 1

I would like to answer my own question after a couple of hours of fiddling about, because I think my findings will be interesting for more than me.

1. To find out what is going on go to Services, check the box "interact with desktop" for the World Wide Web service. That way all errors and msgboxes show up on the console.

By writing the following small asp-page we got a console/cmd-window to make som tests with:

<%
set objshell=server.createobject("WScript.Shell")
objshell.run "cmd.exe"
%>

When you do this along with "interact with desktop" you get a Commandline window and if you in this window write

echo %userprofile%

You get the user that is running the cmd-window. In our case it was "Default User".

1. while testing to run vbs scripts we found that "Default user" didnt have the wscript.dll registered, and we couldnt get it to register either. We never got into why.

2. Cscript however did not need to be registered, and also had less interaction with the desktop, so less things that could stop the script. We also found that you need the FULL PATH to all files requested in the VBS file (this was probably one of the big issues, as we worked with relative paths).

So after a lot of fiddling, the final ASP-code that works, waits for the VBS-script to do its thing, then continues to load the page is:

<%
set objshell=server.createobject("WScript.Shell")
objshell.run "cmd.exe /c ""cscript c:\test\test.vbs " + request("any_parameters") + " Another_hardcoded_parameter""",1,true
set objshell=nothing
response.redirect("/a_new_page_with_info_from_vbs_file.asp")
%>

Use either windows integrated authentication or set a user with access to these files as the anonymous user for the website which works, but is not very safe.