UGN Security Forums UGN Security: Knowledge Base Operating Systems Windows & Windows Security SCF Scripting

well, i searched for that ToggleDesktop command on msdn and it came up with
http://msdn.microsoft.com/library/d...bjects/ishelldispatch4/toggledesktop.asp
and i as browsing some of the other functions that were there and the ShellExecute caught my eye. i havent been able to get it to work yet, but i thought id share this greate resource with yall.

ya, I also tried searching the MSDN before and see what you're talking about. I'll test some more.

One of the important things to find out is: where are these commands located? Like I see in the registry that explorer is executing the script file via some DDEEXEC method. I really should learn more about DDEEXEC cause I don't know what this info means for SCF:

HKEY_CLASSES_ROOT\SHCmdFile\shell\open\ddeexec
@=[ShellFile("%1","%1",%S)]
NoActivateHandler=

HKEY_CLASSES_ROOT\SHCmdFile\shell\open\ddeexec\Application
@=Folders

HKEY_CLASSES_ROOT\SHCmdFile\shell\open\ddeexec\Topic
@=AppProperties

The reasons this is important is if I can find where the commands are located - I can find where other commands may exist. I've tried doing a search for files containing the string "ToggleDesktop" and came up with only "explorer.exe". This means it's not even stored in the registry (damn). This makes sense against olosofts probing cause it looks like the IShellDispatch methods are executing methods for objects within the shell - which IS explorer.exe. However, are ALL commands handled by explorer? "ToggleDesktop" and "Explorer" are both found in Explorer.exe but not "Channels" which is the third command we know exists. But then, ToggleDesktop and Explorer are Command=2 and Channels are Command=3.

Something else that is important to know is what the command=2 or command=3 mean in the script files.

So now I'm trying to use various programs to analyze explorer.exe to find out what objects and methods it supports and maybe figure out how to use them from the script.

---------
Tip for SCF testers
---------
Create This Key:
HKEY_CLASSES_ROOT\SHCmdFile\shell\Edit\command\

Set the default value to:
Notepad "%1"

This is so that you can right-click a SCF file and click "Edit" to open in notepad. I had tried to go into Folder Options and edit the extensions like that - but I couldn't find it.

For people who don't have samples of the 3 SCF scripts that come with windows:
-------------------------
Channels Script
-------------------------
[Shell]
Command=3
IconFile=shdocvw.dll,-118

[IE]
Command=Channels
-------------------------
Show Desktop Script (equivilent: WINDOWS-KEY+D)
-------------------------
[Shell]
Command=2
IconFile=SHELL32.DLL,34

[Taskbar]
Command=ToggleDesktop
-------------------------
Display Explorer Script (equivilent: WINDOWS-KEY+E)
-------------------------
[Shell]
Command=2
IconFile=explorer.exe,1

[Taskbar]
Command=Explorer
-------------------------

Set IconFile to "SHELL32.DLL,3" to make the script look like a folder. I had figured this out.

Thanks, but I was already aware of all this (I was the guy with the null username).
I think command=2 is explorer.exe and command=3 is IE.
I could start experimenting trying to find what commands there are, but there has to be a better way to find out. I'm going to keep searching microsoft.com.
I found the CLSID in the registry for .scf files:
{57651662-CE3E-11D0-8D77-00C04FC99D61}

I have this program called ObjectDock, any ways, I'm trying to make a link to show desktop. if i put the link as Show Desktop.scf, it doesn't work, i have to right-click and click Open for it to show the desktop. I'm thinking i can only link it to .exe files. What i wondering is if there is a way i can link to explorer.exe and put in an argument(command line) to make it show desktop?