Integrity Levels and Internet Explorer Automation

I recently came across a problem with a VBScript which simply navigates to two intranet URLs (opening one in each tab), but coming up with the following error:



 The VBScript source code (comments omitted) simply contains the following:

navOpenInBackgroundTab = &h1000

set oIE = CreateObject("InternetExplorer.Application")

oIE.Navigate "http://host1:8080/app"

oIE.Navigate "https://exchangeserver/owa", navOpenInBackgroundTab

oIE.Visible = true


 Line 23 refers to the last line of the code, but why are we getting an error when this script previously worked fine under Windows XP?

This MSDN blog (http://blogs.msdn.com/b/ieinternals/archive/2011/08/03/internet-explorer-automation-protected-mode-lcie-default-integrity-level-medium.aspx) has the answer, but  if you're struggling to understand some of the concepts let's review:

The key points to understand are:
 - The Internet Explorer Frame Manager always runs at Medium integrity level, but the tabs displaying the content will run with varying integrity levels based on the zones the site belongs to. e.g. Internet, Trusted Sites, Intranet, etc.
- When new "empty" tabs are created, the default integrity level for the tab is set to "Low".  Using SysInternals Process Explorer, we can see this below:




 - The URLs in the script are considered to be "Intranet" sites, due to the fact that there are no dots "." in the URL.
- When the script executes we see a hidden browser tab running at Low integrity level, and two additional tabs running at Medium integrity level.


- Line 23 errors because the browser instance that is created from the script loses control of the object, and then tries to make the browser instance visible but no longer has permission to do so because the invoking browser instance is running at low integrity level which does not have access to any process that is running at medium or high integrity levels (which is what the Intranet URL tabs are running at).

Therefore, we need to find a way of creating an Internet Explorer instance to start at Medium integrity level, and this is done by using the {D5E8041D-920F-45e9-B8FB-B1DEB82C6E5E} class.  This runs "%ProgramFiles(x86)%\Internet Explorer\iexplore.exe" -startmediumtab.

To implement this in the script, we substitute
 set oIE = CreateObject("InternetExplorer.Application")
with

Set oIE = GetObject("new:{D5E8041D-920F-45e9-B8FB-B1DEB82C6E5E}")

You will now find that you no longer have a hidden low integrity browser instance and the script now runs without error.


Further Reading:
Windows Integrity Mechanism - http://msdn.microsoft.com/en-us/library/bb625957.aspx

Comments

  1. LeeCrack.com6 July 2021 at 01:27

    I guess I am the only one who came here to share my very own experience. Guess what!? I am using my laptop for almost the past 2 years, but I had no idea of solving some basic issues.

    iExplorer crack

    ReplyDelete

Post a Comment

Popular posts from this blog

AppUserModelID & Disappearing Shortcuts in Windows 8

Image
If you have a package which contains multiple shortcuts to the same executable (but different arguments), then you'll most likely find that most of the shortcuts (except one) will be hidden from the Windows 8 Start Screen, and won't even appear under "All Apps".  This package is authored correctly and fully ICE validated.  This package creates 10 shortcuts, yet only one of the shortcuts which has a target of "Loader32.exe" is showing.  Take a look at the screenshot of the relevant program group as showin in the Windows 8 Start Screen Below. All the rest of the shortcuts that have the same target of "Loader32.exe" are hidden.  This is evident, if I right click any of the three shortcuts above and click on "Open File Location" to reveal the path of where the shortcut physically exists.  See the Windows Explorer (aka File Explorer as it's now called in Windows 8)  screenshot below: The issue is to do with needin
Read more

Sideloading Universal Windows Apps on Windows 10 (Deep Dive)

Image
https://docs.microsoft.com/en-us/windows/application-management/sideload-apps-in-windows-10  Obtain publisher certificate and install to Trusted Root Authorities  Enable sideloading via GPO  Deploy application via SCCM or powershell Note:If the appx requires VCLibs 120.00 package (Visual C++ 2013 for 8.1 universal apps), then you will encounter problems installing the package on Windows 10. VCLibs.120 was the latest available version as of today, and the Visual C++ download site specifically lists it for Windows 8.1 https://support.microsoft.com/en-nz/help/2977003/the-latest-supported-visual-c-downloads If you open the VCLib appx package in 7zip, you'll see an AppXManifest.xml file, which specifies the OS Max version tested.   In Diligent's case, it looks like: <?xml version="1.0" encoding="utf-8"?> <Package xmlns=" http://schemas.microsoft.com/appx/2010/manifest">   <Identity Name="Micro
Read more

An alternative method of installing device drivers

Image
Basically, as an alternative to install a device driver using the DifxApp merge module (with Windows Installer), you can stage the device driver into the driver store in Windows 7 & 8 using a native utility called " pnputil .exe".  This is IDEAL for situations where you're using non MSI packaging methods and application virtualisation technologies. i.e. Apps that require a device driver, which should make virtualisation possible if you script the pre-launch logic to install the device driver physically .  Even though the files contained within the virtualised package are virtual, once they are staged into the virtual store, the drivers become physically part of it. For instance, in App-V 5, you could use a StartVirtualEnvironment event action.  For Symantec SWV packages, this would be achieved via the OnPostActivate action. What is the Driver Store ? http://technet.microsoft.com/ en-us/library/cc731478.aspx The driver store is exactly what the name sugges
Read more