Me, myself & IT

Bugs in Objects of Windows Script Host

Purpose

Reason

Background Information

Bug № 1

Demonstration

Implementation

Bug № 2

Demonstration

Bug № 3

Demonstration

Bug № 4

Demonstration

Fix

Purpose

Reason

Background Information

The following table is a list of the WSH objects and the typical tasks associated with them.

Object	What you can do with this object
WScript Object	Set and retrieve command line arguments Determine the name of the script file Determine the host file name (wscript.exe or cscript.exe) Determine the host version information Create, connect to, and disconnect from COM objects Sink events Stop a script's execution programmatically Output information to the default output device (for example, a dialog box or the command line)
WshArguments Object	Access the entire set of command-line arguments
WshNamed Object	Access the set of named command-line arguments
WshUnnamed Object	Access the set of unnamed command-line arguments
WshNetwork Object	Connect to and disconnect from network shares and network printers Map and unmap network shares Access information about the currently logged-on user
WshController Object	Create a remote script process using the Controller method CreateScript()
WshRemote Object	Remotely administer computer systems on a computer network Programmatically manipulate other programs/scripts
WshRemoteError Object	Access the error information available when a remote script (a WshRemote object) terminates as a result of a script error
WshShell Object	Run a program locally Manipulate the contents of the registry Create a shortcut Access a system folder Manipulate environment variables (such as WINDIR, PATH, or PROMPT)
WshShortcut Object	Programmatically create a shortcut
WshSpecialFolders Object	Access any of the Windows Special Folders
WshUrlShortcut Object	Programmatically create a shortcut to an Internet resource
WshEnvironment Object	Access any of the environment variables (such as WINDIR, PATH, or PROMPT)
WshScriptExec Object	Determine status and error information about a script run with Exec() Access the StdIn, StdOut, and StdErr channels

Bug № 1

The UserDomain property does not work on Windows 98 and Windows Millennium Edition unless the USERDOMAIN environment variable is set. The variable is not set by default.

Demonstration

1. Create the text file wscript.vbs with the following content in an arbitrary, preferable empty directory:

   Rem Copyright © 1997-2026, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>
   
   With WScript
       .Echo(.CreateObject("WScript.Shell").Environment("PROCESS").Item("USERDOMAIN"))
       .Echo(.CreateObject("WScript.Network").UserDomain)
       .CreateObject("WScript.Shell").Environment("PROCESS").Remove("USERDOMAIN")
       .Echo(.CreateObject("WScript.Network").UserDomain)
       .CreateObject("WScript.Shell").Environment("PROCESS").Item("USERDOMAIN") = .Name
       .Echo(.CreateObject("WScript.Network").UserDomain)
   End With

   JScript VBScript WScript WScript.CreateObject() WScript.Echo() WScript.Name WScript.Shell Environment Environment Item() Remove() WScript.Network UserDomain

2. Start the Command Processor Cmd.exe, then execute the VBScript wscript.vbs created in step 1. with the Console Based Script Host CScript.exe:

   CSCRIPT.EXE wscript.vbs

   Microsoft Windows [Version 6.1.7601]
   Copyright (c) 2009 Microsoft Corporation. All rights reserved.
   
   Microsoft (R) Windows Script Host Version 5.8
   Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.
   
   AMNESIAC
   AMNESIAC
   
   Windows Script Host

Implementation

// Copyright © 1997-2026, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>

#define STRICT
#define WIN32_LEAN_AND_MEAN

#include <windows.h>

BOOL	WINAPI	GetDomainNameW(LPWSTR szBuffer, LPDWORD dwBuffer)
{
	TOKEN_USER	tu[SECURITY_MAX_SID_SIZE / sizeof(TOKEN_USER) + 2];
	SID_NAME_USE	snu;

	HANDLE	hToken;
	DWORD	dwToken;
	BOOL	bToken;

	if (!OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, FALSE, &hToken)
	 && (GetLastError() != ERROR_NO_TOKEN
	  || !OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken)))
		return FALSE;

	bToken = GetTokenInformation(hToken, TokenUser, tu, sizeof(tu), &dwToken);

	CloseHandle(hToken);

	return bToken && LookupAccountSidW((LPCWSTR) NULL, tu[0].User.Sid, (LPWSTR) NULL, 0UL, szBuffer, dwBuffer, &snu);
}

Bug № 2

Demonstration

1. Create the text file wscript.vbs with the following content in an arbitrary, preferable empty directory:

   Rem Copyright © 1997-2026, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>
   
   With WScript.CreateObject("WScript.Shell")
       WScript.Echo(.Exec("CMD.EXE /U /D /C ECHO").StdOut.ReadAll())
       WScript.StdOut.Write(.Exec("CMD.EXE /U /D /C ECHO").StdOut.ReadAll())
   End With

2. Start the Command Processor Cmd.exe, then execute the VBScript wscript.vbs created in step 1. with the Console Based Script Host CScript.exe:

   CSCRIPT.EXE wscript.vbs

   Microsoft Windows [Version 6.1.7601]
   Copyright (c) 2009 Microsoft Corporation. All rights reserved.
   
   Microsoft (R) Windows Script Host Version 5.8
   Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.
   
   E
     C H O   i s   o n . 

   OUCH¹: the ReadAll() method of the StdErr and StdOut properties of the WshScriptExec object (instantiated via the Exec() method of the WshShell object WScript.Shell) fails to support Unicode!

   OUCH²: the Echo() method of the WScript object fails to output character strings with embedded NUL alias vbNullChar characters!

   OUCH³: the Write() and WriteLine() methods of the StdErr and StdOut properties of the WScript object WScript output character strings with embedded NUL alias vbNullChar characters!

Bug № 3

Deletes a key or one of its values from the registry.

WScript.CreateObject("WScript.Shell").RegDelete(strName)

Returns the value of a key or value-name from the registry.

WScript.CreateObject("WScript.Shell").RegRead(strName)

Creates a new key, adds another value-name to an existing key (and assigns it a value), or changes the value of an existing value-name.

WScript.CreateObject("WScript.Shell").RegWrite(strName, anyValue [,strType])

Demonstration

1. Create the UTF-16LE encoded text file wscript.vbs with the following content in an arbitrary, preferable empty directory:

   Rem Copyright © 1997-2026, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>
   
   With WScript.CreateObject("WScript.Shell")
       For Each strAlphabet In Array("ΑΒΓΔΕΖΗΘΙΚΛΜΝΞΟΠΡΣΤΥΦΧΨΩαβγδεζηθικλμνξοπρστυφχψω", _
                                     "ЁЂЃЄЅІЇЈЉЊЋЌЍЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯёђѓєѕіїјљњћќѝўџабвгдежзийклмнопрстуфхцчшщъыьэюя")
           WScript.Echo(strAlphabet)
           .RegWrite "HKEY_CURRENT_USER\WScript\" & strAlphabet, strAlphabet, "REG_SZ"
           WScript.Echo(.RegRead("HKEY_CURRENT_USER\WScript\" & strAlphabet))
           WScript.Echo(.Exec("CMD.EXE /D /C ECHO " & strAlphabet).StdOut.ReadAll())
           WScript.Echo(.Exec("REG.EXE QUERY HKEY_CURRENT_USER\WScript").StdOut.ReadAll())
           .RegDelete("HKEY_CURRENT_USER\WScript\" & strAlphabet)
       Next
   End With

2. Start the Command Processor Cmd.exe, then execute the VBScript wscript.vbs created in step 1. with the Console Based Script Host CScript.exe:

   CSCRIPT.EXE wscript.vbs

   Microsoft Windows [Version 6.1.7601]
   Copyright (c) 2009 Microsoft Corporation. All rights reserved.
   
   Microsoft (R) Windows Script Host Version 5.8
   Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.
   
   ΑΒΓΔΕΖΗΘΙΚΛΜΝΞΟΠΡΣΤΥΦΧΨΩαβγδεζηθικλμνξοπρστυφχψω
   ??G????T?????????S??F??Oaß?de??????µ???p?st?f???
   ??G????T?????????S??F??Oaá?de??????æ???p?st?f???
   
   HKEY_CURRENT_USER\WScript
       ??G????T?????????S??F??Oaá?de??????æ???p?st?f???    REG_SZ    ??G????T?????????S??F??Oaá?de??????æ???p?st?f???
   
   ЁЂЃЄЅІЇЈЉЊЋЌЍЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯёђѓєѕіїјљњћќѝўџабвгдежзийклмнопрстуфхцчшщъыьэюя
   ??????????????????????????????????????????????????????????????????????????????????????????????
   ??????????????????????????????????????????????????????????????????????????????????????????????
   
   HKEY_CURRENT_USER\WScript
       ??????????????????????????????????????????????????????????????????????????????????????????????    REG_SZ    ??????????????????????????????????????????????????????????????????????????????????????????????

   OUCH¹: the RegDelete(), RegRead() and RegWrite() methods of the WshShell object WScript.Shell convert their arguments from Unicode to ANSI!

   OUCH²: the non-ASCII characters á and æ in the output of the Command Processor Cmd.exe and the output of the Registry Console Tool Reg.exe result from a superfluous OEM to ANSI conversion – here from code page 850 to code page 1252 alias Windows-1252!

3. Overwrite the text file wscript.vbs with the following content:

   Rem Copyright © 1997-2026, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>
   
   ' Greek homoglyphs
   
   Const A = &h391
   Const B = &h392
   Const C = &h3F9 ' c = &h3F2
   Const E = &h395
   Const H = &h397
   Const I = &h399
                   ' j = &h3F3
   Const K = &h39A
   Const M = &h39C
   Const N = &h39D
   Const O = &h39F ' o = &h3BF
   Const P = &h3A1
   Const T = &h3A4
                   ' v = &h3BD
   Const X = &h3A7
   Const Y = &h3A5
   Const Z = &h396
   
   strUnicode = ChrW(A) & ChrW(B) & ChrW(C) & ChrW(E) & ChrW(H) & ChrW(I) & ChrW(K) & ChrW(M) & ChrW(N) & ChrW(O) & ChrW(P) & ChrW(T) & ChrW(X) & ChrW(Y) & ChrW(Z)
   
   With WScript.CreateObject("WScript.Shell")
       WScript.Echo(strUnicode)
       .RegWrite "HKEY_CURRENT_USER\WScript\" & strUnicode, strUnicode, "REG_SZ"
       WScript.Echo(.RegRead("HKEY_CURRENT_USER\WScript\" & strUnicode))
       WScript.Echo(.Exec("CMD.EXE /D /C ECHO " & strUnicode).StdOut.ReadAll())
       WScript.Echo(.Exec("REG.EXE QUERY HKEY_CURRENT_USER\WScript").StdOut.ReadAll())
       .RegDelete("HKEY_CURRENT_USER\WScript\" & strUnicode)
   End With

4. Execute the VBScript wscript.vbs overwritten in step 3. with the Console Based Script Host CScript.exe:

   CSCRIPT.EXE wscript.vbs

   Microsoft Windows [Version 6.1.7601]
   Copyright (c) 2009 Microsoft Corporation. All rights reserved.
   
   Microsoft (R) Windows Script Host Version 5.8
   Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.
   
   ΑΒϹΕΗΙΚΜΝΟΡΤΧΥΖ
   ???????????????
   ???????????????
   
   HKEY_CURRENT_USER\WScript
       ???????????????    REG_SZ    ???????????????

5. Overwrite the text file wscript.vbs with the following content:

   Rem Copyright © 1997-2026, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>
   
   ' Cyrillic homoglyphs
   
   Const A = &h410 ' a = &h430
   Const B = &h412
   Const C = &h421 ' c = &h441
   Const E = &h415 ' e = &h435
   Const H = &h41D
   Const I = &h406 ' i = &h456
   Const J = &h408 ' j = &h458
   Const M = &h41C
   Const O = &h41E ' o = &h43E
   Const P = &h420 ' p = &h440
   Const S = &h405 ' s = &h455
   Const T = &h422
   Const X = &h425 ' x = &h445
                   ' y = &h443
   
   strUnicode = ChrW(A) & ChrW(B) & ChrW(C) & ChrW(E) & ChrW(H) & ChrW(I) & ChrW(J) & ChrW(M) & ChrW(O) & ChrW(P) & ChrW(S) & ChrW(T) & ChrW(X)
   
   With WScript.CreateObject("WScript.Shell")
       WScript.Echo(strUnicode)
       .RegWrite "HKEY_CURRENT_USER\WScript\" & strUnicode, strUnicode, "REG_SZ"
       WScript.Echo(.RegRead("HKEY_CURRENT_USER\WScript\" & strUnicode))
       WScript.Echo(.Exec("CMD.EXE /D /C ECHO " & strUnicode).StdOut.ReadAll())
       WScript.Echo(.Exec("REG.EXE QUERY HKEY_CURRENT_USER\WScript").StdOut.ReadAll())
       .RegDelete("HKEY_CURRENT_USER\WScript\" & strUnicode)
   End With

6. Execute the VBScript wscript.vbs overwritten in step 3. with the Console Based Script Host CScript.exe:

   CSCRIPT.EXE wscript.vbs

   Microsoft Windows [Version 6.1.7601]
   Copyright (c) 2009 Microsoft Corporation. All rights reserved.
   
   Microsoft (R) Windows Script Host Version 5.8
   Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.
   
   АВСЕНІЈМОРЅТХ
   ?????????????
   ?????????????
   
   HKEY_CURRENT_USER\WScript
       ?????????????    REG_SZ    ?????????????

   OUCH³: …

Bug № 4

Deletes a specified file.

object.DeleteFile ( filespec[, force] );

• object
  Required. Always the name of a FileSystemObject.

• filespec
  Required. The name of the file to delete. The filespec can contain wildcard characters in the last path component.

• force
  Optional. Boolean value that is true if files with the read-only attribute set are to be deleted; false (default) if they are not.

[…]

An error occurs if no matching files are found.

The documentation for the DeleteFolder() method of the File System Object Scripting.FileSystemObject specifies:

Deletes a specified folder and its contents.

object.DeleteFolder ( folderspec[, force] );

• object
  Required. Always the name of a FileSystemObject.

• folderspec
  Required. The name of the folder to delete. The folderspec can contain wildcard characters in the last path component.

• force
  Optional. Boolean value that is true if folders with the read-only attribute set are to be deleted; false (default) if they are not.

[…]

An error occurs if no matching folders are found.

Demonstration

1. Create the text file wscript.vbs with the following content in an arbitrary, preferable empty directory:

   Rem Copyright © 1997-2026, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>
   
   Const WindowsFolder = 0
   
   With WScript.CreateObject("Scripting.FileSystemObject")
       strFolder = .BuildPath(.GetSpecialFolder(SystemFolder), "Temp")
       strFile = .BuildPath(strFolder, "wscript.tmp")
   
       With .CreateTextFile(strFile)
           .WriteLine(strFile)
           .Close()
           WScript.Echo(strFile)
       End With
   
       On Error Resume Next
       .DeleteFile strFile, vbTrue
       If Err.Number <> 0 Then WScript.Echo(Err.Source & ": " & Err.Description)
       On Error Goto 0
   
       With .CreateFolder(.BuildPath(strFolder, "WScript"))
           strFolder = .Path
           WScript.Echo(strFolder)
       End With
   
       On Error Resume Next
       .DeleteFolder strFolder, vbTrue
       If Err.Number <> 0 Then WScript.Echo(Err.Source & ": " & Err.Description)
   End With

   GetSpecialFolder Method BuildPath Method CreateTextFile Method WriteLine Method Close Method Folder Object Path Property Note: this VBScript creates a (text) file wscript.tmp and a folder WScript in the shared TEMP directory %SystemRoot%\Temp\ of the system and deletes them both.

2. Start the Command Processor Cmd.exe in your (unprivileged) standard user account, then execute the VBScript wscript.vbs created in step 1. with the Console Based Script Host CScript.exe:

   CSCRIPT.EXE wscript.vbs

   Microsoft Windows [Version 6.1.7601]
   Copyright (c) 2009 Microsoft Corporation. All rights reserved.
   
   Microsoft (R) Windows Script Host Version 5.8
   Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.
   
   C:\Windows\Temp\wscript.tmp
   Runtime error in Microsoft VBScript: Permission denied.
   C:\Windows\Temp\WScript
   Runtime error in Microsoft VBScript: Permission denied.

   OUCH: the DeleteFile() and DeleteFolder() methods of the File System Object Scripting.FileSystemObject fail to delete filesystem objects with a bogus Permission denied error message!

3. Display the access permissions of both just created filesystem objects and of their parent directory:

   ICACLS.EXE "%SystemRoot%\Temp\wscript.tmp" /Q
   ICACLS.EXE "%SystemRoot%\Temp\WScript" /Q
   ICACLS.EXE "%SystemRoot%\Temp" /Q

   C:\Windows\Temp\wscript.tmp NT AUTHORITY\SYSTEM:(I)(F)
                               AMNESIAC\Stefan:(I)(F)
                               BUILTIN\Administrators:(I)(F)
   
   Successfully processed 1 files; Failed processing 0 files
   
   C:\Windows\Temp\WScript NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
                           AMNESIAC\Stefan:(I)(F)
                           CREATOR OWNER:(I)(OI)(CI)(IO)(F)
                           BUILTIN\Users:(I)(CI)(S,WD,AD,X)
                           BUILTIN\Administrators:(I)(OI)(CI)(F)
   
   Successfully processed 1 files; Failed processing 0 files
   
   C:\Windows\Temp: Access denied
   Successfully processed 0 files; Failed processing 1 files

   Note: the just created filesystem objects grant FILE_ALL_ACCESS to their owner – the bogus Permission denied error message can therefore not result from any access to them!

   Oops³: the access permissions to their parent folder but deny unprivileged users to enumerate its contents – the precondition required to support wildcard characters!

4. Delete the just created filesystem objects:

   RMDIR "%SystemRoot%\Temp\WScript"
   ERASE "%SystemRoot%\Temp\wscript.tmp"

   The system cannot find the file C:\Windows\Temp\wscript.tmp

   OOPS: the internal Del alias Erase command of the Command Processor Cmd.exe suffers from the same bug!

5. (Optional) Overwrite the file %SystemRoot%\Temp\wscript.tmp with an empty file and delete it afterwards via the WMI Command-Line Utility WMIC.exe:

   COPY /Y NUL: "%SystemRoot%\Temp\wscript.tmp"
   WMIC.EXE /APPEND:"%SystemRoot%\Temp\wscript.tmp"

           1 file(s) copied.

Fix

Contact and Feedback

Use the X.509 certificate to send S/MIME encrypted mail.

Note: email in weird format and without a proper sender name is likely to be discarded!

I dislike HTML (and even weirder formats too) in email, I prefer to receive plain text.
I also expect to see your full (real) name as sender, not your nickname.
I abhor top posts and expect inline quotes in replies.

Terms and Conditions

• The software and the documentation on this site are provided as is without any warranty, neither express nor implied.
  In no event will the author be held liable for any damage(s) arising from the use of the software or the documentation.
• Permission is granted to use the current version of the software and the current version of the documentation solely for personal private and non-commercial purposes.
  An individuals use of the software or the documentation in his or her capacity or function as an agent, (independent) contractor, employee, member or officer of a business, corporation or organisation (commercial or non-commercial) does not qualify as personal private and non-commercial purpose.
• Without written approval from the author the software or the documentation must not be used for a business, for commercial, corporate, governmental, military or organisational purposes of any kind, or in a commercial, corporate, governmental, military or organisational environment of any kind.
• Redistribution of the software and the documentation is allowed only in unmodified form of its current version and free of charge.

Data Protection Declaration

The web service is operated and provided by

The web service provider stores a session cookie in the web browser and records every visit of this web site with the following data in an access log on their server(s):

• the (pseudonymised) IP address;
• the date and time of the request;
• the URL of the requested web page or file;
• the Referer and User-Agent HTTP headers sent by the web browser;
• the result (success or failure) of the request;
• the amount of data received and sent.