Why are windows files with the extension ".url" and ".wsh" considered dangerous (e.g. blocked by many mail filters)? The way I see it:

.URL: you can link to a malicious website which serves an exploit, but it is even easier to type said url in a mail message? You can link to a local file, but you can't pass any arguments to a local file. .WSH: you can link to a local script. A WSH file on itself can't do anything harmfull. You can't pass any argument to an existing script on the windows system.

  • @mootmoot can you please provide me with an example of a WSH file doing something harmfull on a default windows system, without needing to download an additional script? .wsh != .wsf – user3231622 Apr 10 '17 at 17:40
  • 2
    @wootmoot sure you can make the wsh point to e.g. evil.js, but the harmfull action is in evil.js, not the wsh file. I don't see how you can do anything harmfull by opening an attached .wsh file, without there being another file attached (e.g. evil.vbs)? – user3231622 Apr 10 '17 at 17:45

.url may lead the use to click and redirect to website that host malicious exploit code, e.g. execute exploit code on installed unpatched software.

Blocking of WSH is similar to blocking autorun.inf Sample .WSH file from this question.

[ScriptFile]
Path=C:\WINNT\Samples\WSH\showprop.vbs
[Options]
Timeout=0
DisplayLogo=1
BatchMode=0

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.