WebRunner is an Internet Server Application. It runs on the HTTP Server machine and allows remote execution of the text based utilities, such as netstat, ping, etc.
The client connects to the HTTP server via Web browser. Commands are entered through the HTML form on the remote machine. The entered command is transfered to the server and gets executed on the server machine.
WebRunner is capable of running in two different modes: user mode and administrator mode. In the administrator mode virtually any text based command, entered on the client machine will be executed on the server. This can create a potential security hole. In user mode only authorized commands can be executed. Authorized commands appear on the client's machine Web Browser in the list box. Since any HTML form can be spoofed (i.e. client string "field1=data1&field2=data2 can be manually created and then passed to the server via POST or GET) the following verification takes place. When WebRunner is running in user mode, the received command is looked for in the list of authorized commands. Only if the command is on this list does it get executed. The list of authorized commands and the mode is stored in the registry. All of the above described functionality is incorporated in runner.dll. This is the Internet Server Extension dll that gets loaded by the server and exposes the following functions: HttpExtensionProc() GetExtensionVersion(). WebRunner is configured by the a control panel applet: WebRun.cpl. This application is responsible for writing the list of commands to the registry and creats the initial HTML file. The initial HTML file is different for user mode and administrator mode. In user mode the Web Page has a list box with the allowed commands. In administrator mode the HTML page has an edit box to enter any command.
Following registry entries control WebRunner.
Put all files in the same directory and run setup.bat. It will build both the control panel applet and the extension dll. It will then copy webrun.cpl to the system directory. Setup will then start the control panel applet to configure WebRunner. You can build runner.dll and WebRun.cpl separately with the provided makefiles.
Comments: Leon Braginski or