0

this might be trivial but I'm writing a VBScript template and I wanted to add the possibility to inject VBScript code from the internet inside VBScript and run it.

The code originally was:

Sub WebImport(URL)
    ' Import the VBS code at a given URL.
    ' and run it globally pushing the functions into the Main
    Dim Request    
    Set Request = createobject ("MSXML2.ServerXMLHTTP")
    Request.Open "GET", URL, false
    Request.Send
    ExecuteGlobal Request.ResponseText
    Set Request = Nothing
End Sub

I already wrote a function to import code, just like Python, and the principle is the same. It works flawlessly.

If the WebImport works as it should, I'll create a basic import that handles them in the same way.

I import the raw code from my own repository here.

It does everything correctly except executing the file globally in the Main scope, I tried with/without deleting the file, the result doesn't change at all, unfortunately...

Edit

This is the full script, it imports WebImport from scr/Functions and runs the code to inject the code from a given repo until it has to write a file, then 800a0046 vbscript at row 0, line 1 kicks in... I'm admin on the machine.

Option Explicit

'                                 VBScript Main File Model
' Author:                            
'      Fabio Craig Wimmer Florey (fabioflorey@hackermail.com)
'
' Reviewed By:                                                  Last Review:
'      Fabio Craig Wimmer Florey (fabioflorey@hackermail.com)     2022-03-29
'
' Description:
'      Main Subroutine


Import "src/Functions"
WebImport "https://raw.githubusercontent.com/nmoosaJHB/Docker-compose-SuiteCRM/714bada98abbb2ab497258c8ea9a726f234aaba3/public_html/vendor/gymadarasz/ace/demo/kitchen-sink/docs/vbscript.vbs"

Sub Main()
  ' Main Subroutine
  MakeHelloWorldFile "Hello.txt"
End Sub

Sub Import(Filename)
  '    Import Code from VBS File, DO NOT DELETE
    Dim Lib, Code, FSO
    Set FSO = CreateObject("Scripting.FileSystemObject")
    Set Lib = FSO.OpenTextFile(Filename & ".vbs")
    Code = Lib.ReadAll
    Lib.Close
    ExecuteGlobal Code
    Set Lib = Nothing
    Set FSO = Nothing
End Sub

Call Main
  • 1
    Why write out `TextResponse` to a file when you could execute it directly from `Request.responsetext`? – Tim Williams Mar 29 '22 at 21:49
  • @TimWilliams I tried to execute the `TextResponse` and it didn't work, so I placed it on there to see if the script could read and write the file. VBScript still responded file not found, so I decided to write to check wheter it was possibile to execute the code that way. I just added the old version! :) – Fabio Craig Wimmer Florey Mar 29 '22 at 21:54
  • Does your `Import` method work with a file saved from the URL you're trying to include? – Tim Williams Mar 29 '22 at 22:51
  • I update the body with more info @TimWilliams – Fabio Craig Wimmer Florey Mar 29 '22 at 23:45
  • Are you trying to solve a `File not found` error, as stated in the question title, or a `Permission denied` (800A0046) error as stated in the "Edit"? For the `File not found` error, take a look at this [answer](https://stackoverflow.com/a/70043076/15764378) to force the script's directory to be the current directory. – LesFerch Mar 30 '22 at 01:03
  • If there is a problem with the XHR response trying to output it to file isn’t going to help. You need to diagnose what is causing `ResponseText` to fail. Would start by [checking the `Request.Status`](https://stackoverflow.com/a/208913/692942), if you are not receiving a HTTP 200 range response you will not be receiving the expected text. – user692942 Mar 30 '22 at 07:46
  • The problem is your `Import()` procedure, the `FileSystemObject` does not support passing a relative path to the `OpenTextFile()` method, you need to pass a complete path. See [Open Relative path in VBS with OpenText and SaveAs method](https://stackoverflow.com/a/25944232). Adding the line below your `FSO` declaration in `Import()` will fix the code `Dim path: path = FSO.GetParentFolderName(WScript.ScriptFullName) & "\"` you then change the `OpenTextFile()` line to `Set Lib = FSO.OpenTextFile(path & Filename & ".vbs")` and it will call your `WebImport()` procedure. – user692942 Mar 30 '22 at 09:08

1 Answers1

0

The problem here is not the XHR call that works without needing to try outputting the response to a file. The issue is the FileSystemObject does not support relative paths you need to provide the relative path using code like;

Dim path: path = FSO.GetParentFolderName(WScript.ScriptFullName) & "\"

With the following changes to the Import() procedure the code will run WebImports() from the src\Functions.vbs file.

'Use the correct directory separator
Import "src\Functions"

'... other code excluded for clarity

Sub Import(Filename)
  '    Import Code from VBS File, DO NOT DELETE
    Dim Lib, Code, FSO
    Set FSO = CreateObject("Scripting.FileSystemObject")
    'Get path based off the script
    Dim path: path = FSO.GetParentFolderName(WScript.ScriptFullName) & "\"
    'Append path to the filename
    Set Lib = FSO.OpenTextFile(path & Filename & ".vbs")
    Code = Lib.ReadAll
    Lib.Close
    ExecuteGlobal Code
    Set Lib = Nothing
    Set FSO = Nothing
End Sub
user692942
  • 16,398
  • 7
  • 76
  • 175