Hello,

I am trying to develop an simple desktop background that shows some system
information using WMI. A .vbs script is allready working and this script
works in an html application too. The problem is that you can't make an .hta
your desktop wallpaper and a simple html file with this vbscript causes an
error "ActiveX Can't Create Object":

Set objWMIService = GetObject("winmgmts:" & "!\\mycomputername\root\cimv2")

Has anybody an idea how to adjust security settings to make this work or
what else I could try?

Kind regards,
Sebastian

Re: HTML & VBScript -> security problem!? by mayayana

mayayana
Wed Dec 28 21:25:01 CST 2005

WinXP SP2? They made a mess of it, setting
a default whereby the Desktop is roughly
equivalent to the Restricted Zone, while you
are neither informed nor given a choice about
the change. If you want to reset to the pre-SP2
option of getting a warning prompt with unsafe
objects, see here:

http://www.jsware.net/jsware/iewacky.php3#scrinfo

In general it will also work to set the object
in question as safe for scripting and initialization,
but I don't know how that works in the case
of WMI....I don't know whether that's a specific
COM object. It seems to be some kind of
pseudo-COM.
In the case of normal ActiveX a specific
object can be marked safe as long as you're
not concerned about it being expoited through
IE or OE. To do that, add these two keys to
the Registry:

HKCR\CLSID\XXX\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}

HKCR\CLSID\XXX\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}

The last CLSID part, starting with {7DD958....
is a key with no values. "XXX" represents the
CLSID of the object. If you don't know what that
is, look up HKCR\[ProgID]\CLSID, take the
default value, and then find that in HKCR\CLSID.
"[ProgID]" in that path represents the object's
ProgID, such as "Scripting.FileSystemObject"
I don't have WMI installed so I don't know whether
it has a ProgID.
--
mayayanaXX1a@mindXXspring.com
(Remove Xs for return email.)
Sebastian <Sebastian@discussions.microsoft.com> wrote in message
news:9419E662-3CA6-46F6-9B88-BDAD2247F18B@microsoft.com...
> Hello,
>
> I am trying to develop an simple desktop background that shows some system
> information using WMI. A .vbs script is allready working and this script
> works in an html application too. The problem is that you can't make an
.hta
> your desktop wallpaper and a simple html file with this vbscript causes an
> error "ActiveX Can't Create Object":
>
> Set objWMIService = GetObject("winmgmts:" &
"!\\mycomputername\root\cimv2")
>
> Has anybody an idea how to adjust security settings to make this work or
> what else I could try?
>
> Kind regards,
> Sebastian



Re: HTML & VBScript -> security problem!? by Sebastian

Sebastian
Wed Dec 28 22:05:02 CST 2005

Thank you very much for your quick response.
Editing the "Local Zone" was the key :-)
With the help of ShowLocal.vbs I was able to change the local zone settings
and enable execution of unsafe objects and get this thing to work on my
dekstop background...

I also took a quick look at the registry but could not find an real wmi
progid, I doubt that you can mark wmi safe for activex...

Anyway I find it more secure allowing the local zone to execute unsafe
objects than allowing any site that has "safe-object-execution" permission to
access wmi! (if something bad gets into the local zone you allready have lost
(even without executing it) and probably another hole in your system or an
"fatal user error" *g*)
[And if I would like to exploit a system I would not count on that
workaround and use hta which has nearly all permisions by default]

Once again, thank you very much!

"mayayana" wrote:

> WinXP SP2? They made a mess of it, setting
> a default whereby the Desktop is roughly
> equivalent to the Restricted Zone, while you
> are neither informed nor given a choice about
> the change. If you want to reset to the pre-SP2
> option of getting a warning prompt with unsafe
> objects, see here:
>
> http://www.jsware.net/jsware/iewacky.php3#scrinfo
>
> In general it will also work to set the object
> in question as safe for scripting and initialization,
> but I don't know how that works in the case
> of WMI....I don't know whether that's a specific
> COM object. It seems to be some kind of
> pseudo-COM.
> In the case of normal ActiveX a specific
> object can be marked safe as long as you're
> not concerned about it being expoited through
> IE or OE. To do that, add these two keys to
> the Registry:
>
> HKCR\CLSID\XXX\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}
>
> HKCR\CLSID\XXX\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}
>
> The last CLSID part, starting with {7DD958....
> is a key with no values. "XXX" represents the
> CLSID of the object. If you don't know what that
> is, look up HKCR\[ProgID]\CLSID, take the
> default value, and then find that in HKCR\CLSID.
> "[ProgID]" in that path represents the object's
> ProgID, such as "Scripting.FileSystemObject"
> I don't have WMI installed so I don't know whether
> it has a ProgID.
> --
> mayayanaXX1a@mindXXspring.com
> (Remove Xs for return email.)
> Sebastian <Sebastian@discussions.microsoft.com> wrote in message
> news:9419E662-3CA6-46F6-9B88-BDAD2247F18B@microsoft.com...
> > Hello,
> >
> > I am trying to develop an simple desktop background that shows some system
> > information using WMI. A .vbs script is allready working and this script
> > works in an html application too. The problem is that you can't make an
> ..hta
> > your desktop wallpaper and a simple html file with this vbscript causes an
> > error "ActiveX Can't Create Object":
> >
> > Set objWMIService = GetObject("winmgmts:" &
> "!\\mycomputername\root\cimv2")
> >
> > Has anybody an idea how to adjust security settings to make this work or
> > what else I could try?
> >
> > Kind regards,
> > Sebastian
>
>
>

Re: HTML & VBScript -> security problem!? by mayayana

mayayana
Wed Dec 28 22:25:57 CST 2005


> Anyway I find it more secure allowing the local zone to execute unsafe
> objects than allowing any site that has "safe-object-execution" permission
to
> access wmi!

Woops! Good point.