launching a MS window that runs a .exe

**Philip Ronan** · Dec 1 '06, 03:05 PM

Re: launching a MS window that runs a .exe

In article <J9LIuw.2CF@arl .army.mil>,
neiderer@osprey .arl.army.mil (Andrew Neiderer ) wrote:

I think I am asking the right newsgroup. If not maybe someone could
tell me where to ask this "beginner" question.
>
I want to click on an image (.jpg) that launches a Microsoft window
(cmd.exe or command.com) which executes some .exe, e.g googleearth.exe .
I know this is simple
for most of you but I am just starting XHTML. I think it begins with

You can't start applications directly. What you need to do is provide
the user with a document that opens the application indirectly.

For example, to launch Google Earth, your link should point to a KML
file. If Google Earth is installed and the user's browser is set up
correctly, the KML file will be passed to Google Earth by the browser.

More info here: http://earth.google.com/kml/kml_tut.html

--
If you really must contact me by email, visit

http://rumkin.com/tools/compression/base64.php

and decode the following string of characters:
RW1haWw6IHBoaWx yb25hbkBibHVleW 9uZGVyLmNvLnVr

**Andy Dingley** · Dec 1 '06, 04:05 PM

Re: launching a MS window that runs a .exe

Andrew Neiderer wrote:

I want to click on an image (.jpg) that launches a Microsoft window
(cmd.exe or command.com) which executes some .exe, e.g googleearth.exe .

It's not possible. If it were possible, that would be a major bug and
would need to be fixed immediately in that browser.

Maybe your page just starts Google earth and is safe. How would you
distinguish this from my page, which is Evil and starts "format c:/"
instead? You see the problem, for why web browsers _can't_be_
permitted to escalate privileges from merely display documents to
starting programs.

There are ways around this. One way would be to embed an executable
ActiveX control on the page and allow that to run with serious
privileges. Then how do you prove the ActiveX control itself is safe
and trustworthy? There's still no widespread consensus on how to do
this reliably and flexibly which is why ActiveX hasn't ever taken the
web by storm.

**Pete** · Dec 6 '06, 05:15 AM

Re: launching a MS window that runs a .exe

Andy Dingley wrote:

There are ways around this. One way would be to embed an executable
ActiveX control on the page and allow that to run with serious
privileges.

I'd like to be able to run an executable via a link in a browser on our
intranet. Do you have any leads on where I might find an activex
control such as you mention?

Thanks, Peter

**Andy Dingley** · Dec 6 '06, 09:35 AM

Re: launching a MS window that runs a .exe

Pete wrote:

I'd like to be able to run an executable via a link in a browser on our
intranet. Do you have any leads on where I might find an activex
control such as you mention?

If you're after Google Earth, then the best way is probably a link to a
..kmz file. You can get users to set permissions on .kmz files to be
quite generous and to open GE automatically. There'll be a certain
amount of per-user config to do for each browser though.

**Pete** · Dec 6 '06, 10:07 PM

Re: launching a MS window that runs a .exe

Andy Dingley wrote:

Pete wrote:
>

>I'd like to be able to run an executable via a link in a browser on our
>intranet. Do you have any leads on where I might find an activex
>control such as you mention?

>
If you're after Google Earth, then the best way is probably a link to a
.kmz file.

Thanks, Andy, but what I'd like to be able to do is run an arbitrary
..exe file. In this particular case, it would be our "Customer
Relationship Management" program, but I'm interested in a general
purpose solution.

Peter

**David Stone** · Dec 7 '06, 12:45 PM

Re: launching a MS window that runs a .exe

In article <45774452.40509 05@pobox.com>, Pete <pjetson@pobox. com>
wrote:

Andy Dingley wrote:

Pete wrote:

I'd like to be able to run an executable via a link in a browser on our
intranet. Do you have any leads on where I might find an activex
control such as you mention?

If you're after Google Earth, then the best way is probably a link to a
.kmz file.

>
Thanks, Andy, but what I'd like to be able to do is run an arbitrary
.exe file. In this particular case, it would be our "Customer
Relationship Management" program, but I'm interested in a general
purpose solution.

The same principle applies - provide a link to a file which is
associated with your CRM application.

**Pete** · Dec 7 '06, 11:05 PM

Re: launching a MS window that runs a .exe

David Stone wrote:

In article <45774452.40509 05@pobox.com>, Pete <pjetson@pobox. com>
wrote:
>

>Andy Dingley wrote:

Pete wrote:
>
>I'd like to be able to run an executable via a link in a browser on our
>intranet. Do you have any leads on where I might find an activex
>control such as you mention?
>
If you're after Google Earth, then the best way is probably a link to a
.kmz file.

>>
>Thanks, Andy, but what I'd like to be able to do is run an arbitrary
>.exe file. In this particular case, it would be our "Customer
>Relationship Management" program, but I'm interested in a general
>purpose solution.

>
The same principle applies - provide a link to a file which is
associated with your CRM application.

I've tried this, and it's just not practical. I'm not sure of exactly
what happens (does Windows load the entire 168Mb data file into memory
first, before looking for the association?), but it takes over 30
seconds (yes, I've timed it - my workmates didn't believe it either) for
the program to load. To the users, it appears that nothing happens. So
they click again, and again, then curse a few times, click again, go
have a coffee, and when they get back, the application is open.

What I'm looking for is a way of just running any arbitrary .exe file.
Does anyone know of a way to do this?

One of the replies to the original poster stated that it could be done
with an activex control, but I've searched and haven't been able to find
one. Was the poster just saying that technically it would be possible,
rather than that someone had actually done it and here's the link to or
name of the control?

Peter

**Ben Bacarisse** · Dec 8 '06, 02:05 AM

Re: launching a MS window that runs a .exe

Pete <pjetson@pobox. comwrites:

David Stone wrote:

>In article <45774452.40509 05@pobox.com>, Pete <pjetson@pobox. com>
>wrote:
>>

>>Andy Dingley wrote:
>Pete wrote:
>>I'd like to be able to run an executable via a link in a
>>browser on our
>>intranet. Do you have any leads on where I might find an activex
>>control such as you mention?
>If you're after Google Earth, then the best way is probably a
>>link to a
>.kmz file.
>>Thanks, Andy, but what I'd like to be able to do is run an
>>arbitrary .exe file. In this particular case, it would be our
>>"Customer Relationship Management" program, but I'm interested in a
>>general purpose solution.

>The same principle applies - provide a link to a file which is
>associated with your CRM application.

>
I've tried this, and it's just not practical. I'm not sure of exactly
what happens (does Windows load the entire 168Mb data file into memory
first, before looking for the association?), but it takes over 30
seconds (yes, I've timed it - my workmates didn't believe it either)
for the program to load. To the users, it appears that nothing
happens. So they click again, and again, then curse a few times,
click again, go have a coffee, and when they get back, the application
is open.
>
What I'm looking for is a way of just running any arbitrary .exe
file. Does anyone know of a way to do this?

I never thought I'd be answering this type of question so let me add a
couple of caveats: I do not know much about Windows and this kind of
thing of thing is only safe in a tightly controlled intranet
environment (hence it is not really a valid www.authoring question).

This is what I would do on a GNU/Linux system. If the CRM application
needs to be run on "huge_file.data ", I would write a small file that
contains a reference to the data, e.g.:

"huge_file. crm" containing:

http://my.server.org/huge_file.data

and arrange for .crm files to be served as a distinct MIME type (a
small edit to the server config). On client machines, this MIME type
is associated with an equally tiny wrapper script that takes the reference
and feeds it to the crm program. Of course, this is only possible for
applications that are generous about how they takes input or data
(Linux program often are) and requires some control of both server and
client machines.

--
Ben.

**Harlan Messinger** · Dec 8 '06, 03:05 PM

Re: launching a MS window that runs a .exe

Pete wrote:

David Stone wrote:

>In article <45774452.40509 05@pobox.com>, Pete <pjetson@pobox. comwrote:
>>

>>Andy Dingley wrote:
>Pete wrote:
>>I'd like to be able to run an executable via a link in a browser
>>on our
>>intranet. Do you have any leads on where I might find an activex
>>control such as you mention?
>If you're after Google Earth, then the best way is probably a
>>link to a
>.kmz file.
>>>
>>Thanks, Andy, but what I'd like to be able to do is run an arbitrary
>>.exe file. In this particular case, it would be our "Customer
>>Relationshi p Management" program, but I'm interested in a general
>>purpose solution.

>>
>The same principle applies - provide a link to a file which is
>associated with your CRM application.

>
I've tried this, and it's just not practical. I'm not sure of exactly
what happens (does Windows load the entire 168Mb data file into memory
first, before looking for the association?)

It doesn't. Windows only knows the name that's given, and it doesn't
even check it for either validity or existence. Only the application
knows what the application plans to do with the file, or how it intends
to react if the file doesn't exist, so Windows isn't in a position to do
anything with it.

VK · Dec 8 '06, 04:35 PM

Re: launching a MS window that runs a .exe

Pete wrote:

What I'm looking for is a way of just running any arbitrary .exe file.
Does anyone know of a way to do this?
>
One of the replies to the original poster stated that it could be done
with an activex control, but I've searched and haven't been able to find
one. Was the poster just saying that technically it would be possible,
rather than that someone had actually done it and here's the link to or
name of the control?

A few notes (see the source at the bottom):

1) obviously the script will not work (will show "Security exception"
alert) within the default sandbox.

2) a phychological drawback of it is that IE's end users in your
company may get accustomed to see security warning dialog AND press Yes
in it (while the mantra should be "simply say no"). Thus it is highly
suggested to eliminate the security warning step by adjusting intranet
settings.

3) if you are copying the source over Google Groups be aware that
Google james strings with at-sign in it (must be an e-mail protection
mesure?). In the particular the string:
Components.clas ses['@mozilla.org/file/local;1']
has to be
Components.clas ses['at-sign and the rest

4) this script works for IE 5.0 or higher and for any Gecko-based
browser (including Firefox of course).

5) Don't forget that backslash in Windows path is the escape character
in JavaScript: so always double it: c:\\windows\\no tepad.exe

6) Enjoy! :-)

<html>
<head>
<title>Exe</title>
<meta http-equiv="Content-Type"
content="text/html; charset=iso-8859-1">
<script type="text/javascript">
/*
Copyright (c) 2005 VK [schools_ring_at _yahoo.com]
Permission is hereby granted, free of charge, to any person obtaining
a copy
of this software and associated documentation files (the "Software") ,

to deal in the Software without restriction, including without
limitation the
rights to use, copy, modify, merge, publish, distribute, sublicense,
and/or
sell copies of the Software, and to permit persons to whom the
Software is furnished
to do so, subject to the following conditions:</p>
The above copyright notice and this permission notice shall be
included in
all copies or substantial portions of the Software.</p>
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY
KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY , FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT .
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY

CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
*/

var Shell = {
'$err' : function(m) {
var msg = m || 'Security exception';
window.alert('[Shell] script object\n\n' + msg);
}
, 'MSIE' : ( (typeof window != 'undefined')
&& (typeof window.ActiveXO bject != 'undefined'))
, 'Gecko' : ( (typeof window != 'undefined')
&& (typeof window.netscape != 'undefined')
&& (typeof window.netscape .security != 'undefined')
/* that Opera... always pretending to do everything
* everywhere but not really doing anything of it...
*/
&& (typeof window.opera != 'object'))
, 'run' : function(path) {
if ((typeof path == 'string') && (path != '')) {
if ((Shell.MSIE) && (typeof Shell.$ == 'undefined')) {
try {Shell.$ = new ActiveXObject(' WScript.Shell') ;}
catch(e) {Shell.$err(e.m essage);}
}
if (Shell.MSIE) {
try {Shell.$.Run(pa th);}
catch(e) {Shell.$err(e.m essage);}
}
else if (Shell.Gecko) {
/* Netscape security model grants privileges
* on the per-call per-context basis; thus
* privilege request and privilege usage
* have to be in the same block.
*/
try {
netscape.securi ty.PrivilegeMan ager.
enablePrivilege ('UniversalXPCo nnect');
Shell.$ = Components.clas ses['@mozilla.org/file/local;1'].
createInstance( Components.inte rfaces.nsILocal File);
/* NOTE: initWithPath has problems on MacOS and other OSes
* which do not represent file locations as paths.
* If you do use this function, be very aware of this problem!
*/
Shell.$.initWit hPath(path);
Shell.$.launch( );
}
catch(e) {
Shell.$err(e.me ssage);
}
}
else {
Shell.$err('not supported on this platform');
}
}
else {
Shell.$err('Inv alid argument');
}
}
};
</script>
</head>
<body>
<p>
<a
href="javascrip t:void(Shell.ru n('c:\\windows\ \notepad.exe')) ;">Launch
Notepad</a>
</p>
</body>
</html>

launching a MS window that runs a .exe

launching a MS window that runs a .exe

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment