Search code examples
vbscripthta

Encoded VBS not working when called from HTA


We have an HTA used for automatic log in to the servers using VBS. To maintain security, we wanted to encode the VBS, which had the credentials for logging in to the server. We came across a VBS script that encoded the VBS file when dragged on to it, the output is a VBE file.

Now, when this VBE is called from HTA, it shows and error, which seems like it is not able to read the VBE properly.

Below is how we are linking the VBE to out HTA :

<script language="VBScript" src="hola.vbe" > </script>

Also, below is the code for encoding :

Option Explicit 

dim oEncoder, oFilesToEncode, file, sDest 
dim sFileOut, oFile, oEncFile, oFSO, i 
dim oStream, sSourceFile 

set oFilesToEncode = WScript.Arguments 
set oEncoder = CreateObject("Scripting.Encoder") 
For i = 0 to oFilesToEncode.Count - 1 
    set oFSO = CreateObject("Scripting.FileSystemObject") 
    file = oFilesToEncode(i) 
    set oFile = oFSO.GetFile(file) 
    Set oStream = oFile.OpenAsTextStream(1) 
    sSourceFile=oStream.ReadAll 
    oStream.Close 
    sDest = oEncoder.EncodeScriptFile(".vbs",sSourceFile,0,"") 
    sFileOut = Left(file, Len(file) - 3) & "vbe" 
    Set oEncFile = oFSO.CreateTextFile(sFileOut) 
    oEncFile.Write sDest 
    oEncFile.Close 
Next 

According to my understanding the encoded VBS should work as normal one, not sure why we are fading issue in this case.


Solution

  • In order to use an encoded VBScript, you need to specify the language engine to use with language="VBScript.Encode" rather than just language="VBScript".

    Also, be quite wary if you want to use it "To maintain security". The purpose of the script encoder is to deter casual inspection, but it doesn't "encrypt" the code in any conventional sense, and it's not that hard to get the plain script back.