Launch Elevated Command From HTA | Quisitive
Launch Elevated Command From HTA
November 8, 2012
In this blog you will learn how to use the ShellExecute method to launch an individual command in an elevated state.

With a VBScript you can use the WScript object to check the state of a script and force it to load as elevated. Since the WScript object cannot be used in an HTA script, you cannot perform this same function. However, I have found a work around for this. You can use the ShellExecute method to launch an individual command in an elevated state.

When you use ShellExecute you can enter “runas” for the Operation parameter, it will force the command to execute in an elevated state. This is the equivalent to right-clicking on a file and choosing “Run as administrator.”

In the example below you can see how this can be used to execute an elevated command prompt window.

ShellExecute “cmd.exe”, “”, “”, “runas”, 1

Here is another example where it will launch an elevated command prompt and perform a DNS flush

ShellExecute “cmd.exe”, “/c ipconfig /flushdns”, “”, “runas”, 1

Of course this is not restricted to command prompts. You can use it to launch any application. The syntax for ShellExecute execute is:

ShellExecute “File”, “Arguments”, “Directory”, “Operation”, Show

Just remember to enter “runas” for the Operation parameter.

Below is an example of what a complete HTA script would look like with the previous two examples added.

<html><head><title>Elevated Command</title> <HTA:APPLICATION  APPLICATIONNAME=”Elevated Command”  ID=”ElevatedCommand”  SCROLL=”no”  SINGLEINSTANCE=”yes”/> </head> <SCRIPT Language=“VBScript”> Set objShell = CreateObject(“Shell.Application”)Sub Window_Onload                window.resizeTo 360,360End Sub Sub RunCMD    objShell.ShellExecute  “cmd.exe”, “”, “”, “runas”, 1End SubSub RunFlush    objShell.ShellExecute  “cmd.exe”, “/c ipconfig /flushdns”, “”, “runas”, 1End Sub</SCRIPT> <body bgcolor=“buttonface”><center><p><font face=“verdana” color=“red”>Elevated Command</font></p>If you do not have local administrator permissions, you will be prompted to supply them. This must be run as a local administrator. <p><input id=runbutton  class=“button” type=“button” value=“Launch Elevated CMD” name=“db_button”  onClick=“RunCMD”><p><input id=runbutton  class=“button” type=“button” value=“Flush DNS” name=“db_button”  onClick=“RunFlush”><p></center></body></html>

For more information on the ShellExecute method refer to MSDN –