{"id":613,"date":"2023-11-08T23:59:48","date_gmt":"2023-11-08T14:59:48","guid":{"rendered":"https:\/\/web.cloudfree.jp\/journal\/?p=613"},"modified":"2023-11-10T16:11:21","modified_gmt":"2023-11-10T07:11:21","slug":"%e4%bd%9c%e6%a5%ad%e5%8a%b9%e7%8e%87%e5%80%8d%e5%a2%97%e3%83%a9%e3%83%b3%e3%83%81%e3%83%a3%e3%83%bc%e3%82%92%e4%bd%9c%e3%82%8b3-3","status":"publish","type":"post","link":"https:\/\/web.cloudfree.jp\/journal\/%e4%bd%9c%e6%a5%ad%e5%8a%b9%e7%8e%87%e5%80%8d%e5%a2%97%e3%83%a9%e3%83%b3%e3%83%81%e3%83%a3%e3%83%bc%e3%82%92%e4%bd%9c%e3%82%8b3-3\/","title":{"rendered":"\u4f5c\u696d\u52b9\u7387\u500d\u5897\u30e9\u30f3\u30c1\u30e3\u30fc\u3092\u4f5c\u308b(3\/3)"},"content":{"rendered":"

\u4f5c\u696d\u52b9\u7387\u500d\u5897\u30e9\u30f3\u30c1\u30e3\u30fc\u3092\u4f5c\u308b(3\/3)<\/h3>\r\n\n

2023-11-08 \u8a18\u8f09
\u6982\u8981 : javascript, PHP, URI\u30b9\u30ad\u30fc\u30e0,VBA \u3092\u9023\u643a\u3055\u305b\u305f\u30e9\u30f3\u30c1\u30e3\u30fchtml\u306e\u4f5c\u6210
\u524d\u5f8c\u306e\u8a18\u4e8b\uff1a(1\/3)<\/a>, (2\/3)<\/a>
Keyword : XMLHttpRequest, ms-excel, microsoft-edge:, vscode:,<\/p>\n\n\n\n

FileZilla\u3092\u63a5\u7d9a\u307e\u3067\u3057\u3066\u8d77\u52d5\u3059\u308bhref\u306e\u8a18\u8ff0\u306f\u4ee5\u4e0b\u3002

<a href=”javascript:helper(‘\\”C:\/Program Files\/FileZilla FTP Client\/filezilla.exe\\” -c=0\/web_cloudfree_jp’);”>

exe\u306e\u30d1\u30b9\u306b\u30b9\u30da\u30fc\u30b9\u304c\u5165\u3063\u3066\u3044\u3066\u3001\u304b\u3064\u8d77\u52d5\u30aa\u30d7\u30b7\u30e7\u30f3\u3082\u3042\u308b\u30d1\u30bf\u30fc\u30f3\u3002
\u3053\u308c\u304c\u3044\u307e\u306e\u3068\u3053\u308d\u4e00\u756a\u8907\u96d1\u306a\u30d1\u30bf\u30fc\u30f3\u3067\u3001\u3053\u308c\u3092URL\u30a8\u30f3\u30b3\u30fc\u30c9\u304b\u3051\u305a\u3068\u3082\u52d5\u3044\u3066\u304f\u308c\u305f\u306e\u3067\u3053\u308c\u3067\u3044\u304f\u3053\u3068\u306b\u3057\u3066\u3044\u307e\u3059\u3002\u5927\u5143\u3092 ‘ (\u30b7\u30f3\u30b0\u30eb\u30af\u30a9\u30fc\u30c8)\u3067\u304f\u304f\u308b\u304b ” (\u30c0\u30d6\u30eb\u30af\u30a9\u30fc\u30c8)\u3067\u304f\u304f\u308b\u304b\u3001\u610f\u5473\u3042\u308b\u306e\u304b\u7121\u3044\u306e\u304b\u308f\u304b\u3089\u306a\u3044\u8a66\u884c\u932f\u8aa4\u3092\u3044\u3063\u3071\u3044\u3057\u307e\u3057\u305f\u3002

javascript:helper \u306f\u4ee5\u4e0b\u3067\u3059\u3002<\/p>\n\n\n\n

function helper(cmd) {\n  const Http = new XMLHttpRequest();\n  Http.open("GET", "https:\/\/localhost\/helper.php?cmd=" + cmd, false);\n  Http.send();\n  if (Http.status == 200) location.href = 'ms-excel:ofe|u|https:\/\/localhost\/helper.xlsm'; \n} <\/code><\/pre><\/div>\n\n\n\n
Http.open \u306e\uff13\u3064\u76ee\u306e\u5f15\u6570\u306f\u3001\u540c\u671for\u975e\u540c\u671f\u3067\u3001\u7701\u7565\u3059\u308b\u3068true\u306e\u975e\u540c\u671f\u306b\u306a\u308a\u307e\u3059\u3002
cmd.txt\u3092\u78ba\u5b9f\u306b\u66f8\u3044\u3066\u3082\u3089\u3063\u305f\u3042\u3068\u3067\u306a\u3044\u3068helper.xlsm\u3092\u547c\u3079\u306a\u3044\u304b\u3089\u3053\u3053\u306f\u540c\u671f\u3067\u3059\u3002

\u300c\u30e6\u30fc\u30b6\u30fc\u4f53\u9a13\u306b\u5bfe\u3057\u3066\u597d\u307e\u3057\u304f\u306a\u3044\u5f71\u97ff\u304c\u3042\u308b\u305f\u3081\u3001\u30e1\u30a4\u30f3\u30b9\u30ec\u30c3\u30c9\u3067\u306e\u540c\u671f XMLHttpRequest \u306f\u63a8\u5968\u3055\u308c\u307e\u305b\u3093\u3002\u8a73\u3057\u304f\u306f https:\/\/xhr.spec.whatwg.org\/#sync-warning \u3092\u53c2\u7167\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u300d\u3068\u8a00\u308f\u308c\u307e\u3059\u304c\u3001\u5fc5\u8981\u306a\u7b87\u6240\u3067\u306f\u5fc5\u8981\u306a\u306e\u3067\u3059\u3002

https:\/\/localhost\/helper.php \u3092http:\/\/\u3068\u3059\u308b\u3068
\u300c19:24:11.826 \u30af\u30ed\u30b9\u30aa\u30ea\u30b8\u30f3\u8981\u6c42\u3092\u30d6\u30ed\u30c3\u30af\u3057\u307e\u3057\u305f: \u540c\u4e00\u751f\u6210\u5143\u30dd\u30ea\u30b7\u30fc\u306b\u3088\u308a\u3001http:\/\/localhost\/helper.php?cmd=hello_cmd_by_javascript \u306b\u3042\u308b\u30ea\u30e2\u30fc\u30c8\u30ea\u30bd\u30fc\u30b9\u306e\u8aad\u307f\u8fbc\u307f\u306f\u62d2\u5426\u3055\u308c\u307e\u3059 (\u7406\u7531: CORS \u30d8\u30c3\u30c0\u30fc \u2018Access-Control-Allow-Origin\u2019 \u304c\u8db3\u308a\u306a\u3044)\u3002\u30b9\u30c6\u30fc\u30bf\u30b9\u30b3\u30fc\u30c9: 200\u300d
\u3068\u53f1\u3089\u308c\u307e\u3059\u3002
\u7121\u99c4\u306a\u6697\u53f7\u8a08\u7b97\u3057\u306a\u304f\u3066\u3044\u3044\u3088\u3001\u3068http\u306b\u3057\u3066CPU\u3092\u6c17\u9063\u3063\u305f\u3064\u3082\u308a\u3067\u3057\u305f\u304c\u3001\u305d\u3046\u3044\u3046\u6c17\u6301\u3061\u306e\u901a\u3058\u308b\u3068\u3053\u308d\u3067\u306f\u306a\u3044\u3088\u3046\u3067\u3059\u3002

helper.php\u306f\u4ee5\u4e0b\u3067\u3059\u3002<\/p>\n\n\n\n
<?php\n  const PATH_APACHE = 'c:\/pgm\/apache24\/';\n\n\t\/\/\u521d\u671f\u8a2d\u5b9a\n\tmb_language('Japanese');\n\tmb_internal_encoding('UTF-8');\n\tdate_default_timezone_set("Asia\/Tokyo");\n\tsetlocale(LC_ALL, 'ja_JP.UTF-8');\n\n  $fp = fopen(PATH_APACHE.'htdocs\/cmd.txt', 'w');\n  fwrite($fp, $_REQUEST['cmd'] ?? '');\n  fwrite($fp, "\\n");\n  fclose($fp);\n\n  http_response_code(200);<\/code><\/pre><\/div>\n\n\n\n
helper.xlms \u306ecmd.txt\u8aad\u307f\u53d6\u308a\u7b87\u6240\u306f\u4ee5\u4e0b\u3067\u3059\u3002
\u4eca\u306e\u3068\u3053\u308d\u30d1\u30e9\u30e1\u30fc\u30bf\u306fcmd\u306e1\u884c\u3060\u3051\u3067\u3059\u304c\u5c06\u6765\u3092\u8003\u3048\u3066\u65e5\u672c\u8a9e\u5bfe\u5fdc\u30fb\u5fa9\u6570\u5bfe\u5fdc\u3055\u305b\u3066\u307e\u3059\u3002
\uff08Selenium Webdriver\u3092\u901a\u3058\u3066\u4e00\u5c64\u591a\u6a5f\u80fd\u306a\u4e00\u62ec\u51e6\u7406\u306a\u3069\u3082\u69cb\u60f3\u4e2d ^-^ \uff09

javascript\u306e
location.href = ‘ms-excel:ofe|u|https:\/\/localhost\/helper.xlsm’;
\u3092\u53d7\u3051\u3066\u8d70\u308bExcel\u30de\u30af\u30ed<\/p>\n\n\n\n
'htdocs\\cmd.txt \u304b\u3089\u30d1\u30e9\u30e1\u30fc\u30bf\u60c5\u5831\u3092\u53d6\u5f97\nPrivate Sub LoadCmd(c As Collection)\n    Dim adoFile As New ADODB.Stream '\u53c2\u7167:Microsoft ActiveX Data Objects 6.1 Library\n    Dim sText As String\n    Dim i As Long\n    \n    adoFile.Charset = "utf-8"\n    adoFile.Open\n    adoFile.LoadFromFile PATH_APACHE & "htdocs\\cmd.txt"\n\n    Do Until adoFile.EOS\n        i = i + 1\n        c.Add adoFile.ReadText(-2), "cmd-" & CStr(i)\n    Loop\nEnd Sub\n<\/code><\/pre><\/div>\n\n\n\n
\tDim oWSH As New IWshRuntimeLibrary.WshShell '\u53c2\u7167:Windows Script Host Object Model\n\tDim win_style As VbAppWinStyle\n\tDim mode As Boolean\n\n\t'\u30c7\u30d5\u30a9\u30eb\u30c8\u5024\n\twin_style = vbNormalFocus\n\tmode = False '\u540c\u671f(True)\/\u975e\u540c\u671f(False)\n\n\toWSH.Run(cSys("cmd-1"), win_style, mode) \n  'vbNormalFocus, False \u975e\u540c\u671f\u304c\u65e2\u5b9a\u5024\n<\/code><\/pre><\/div>\n\n\n\n
\u30d5\u30a9\u30eb\u30c0\u30d1\u30b9\u3092\u6e21\u305b\u3070\u30a8\u30af\u30b9\u30d7\u30ed\u30fc\u30e9\u3067\u958b\u3044\u3066\u304f\u308c\u307e\u3059\u3002
‘C:\/pgm\/Apache24\/htdocs\/’

URI\u30b9\u30ad\u30fc\u30e0\u306f\u4ed6\u306b\u3082\u3042\u308a
href=”microsoft-edge:https:\/\/web.cloudfree.jp\/journal\/”
\u3068\u3059\u308c\u3070\u3053\u308c\u306fhelper\u30b7\u30b9\u30c6\u30e0\u3092\u4ecb\u3055\u305a\u306bEdge\u3067\u958b\u3044\u3066\u304f\u308c\u307e\u3059\u3002

vscode:X:\\xxx\\superlauncher.php<\/p>\n\n\n\n
\u3068\u3059\u308b\u3068VSCode\u3067\u958b\u3044\u3066\u304f\u308c\u307e\u3057\u305f\u3002
\u3044\u308d\u3044\u308d\u8a66\u3057\u3066\u3044\u3066\u3001\u30d0\u30c3\u30af\u30b9\u30e9\u30c3\u30b7\u30e5\u3068\u30b9\u30e9\u30c3\u30b7\u30e5\u3001
\u3069\u3053\u3067\u3069\u3063\u3061\u3092\u4f7f\u3048\u3070\u3088\u3044\u306e\u304b\u8a33\u308f\u304b\u3093\u306a\u304f\u306a\u3063\u3066\u304d\u307e\u3057\u305f\u3002<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u30e9\u30f3\u30c1\u30e3\u30fc\u3067\u56f3\u308c\u308b\u6642\u77ed\u4ee5\u4e0a\u306e\u6642\u9593\u3092\u307e\u305f\u30e9\u30f3\u30c1\u30e3\u30fc\u5236\u4f5c\u306b\u8cbb\u3084\u3057\u3066\u3044\u3066\u306f\u672c\u672b\u8ee2\u5012\u3067\u3059\u3002
\u30e1\u30f3\u30c6\u3068\u9805\u76ee\u306e\u5897\u6e1b\u3092\u30b9\u30de\u30fc\u30c8\u306b\u884c\u3046\u305f\u3081\u306b\u30e9\u30f3\u30c1\u30e3\u30fchtml\u3092\u6a5f\u4f1a\u7684\u306b\u751f\u6210\u3059\u308b\u30c4\u30fc\u30eb\u304c\u8981\u308a\u305d\u3046\u3067\u3059\u3002
\u3068\u3082\u304b\u304f\u3053\u3093\u306a\u611f\u3058\u3067\u30e9\u30f3\u30c1\u30e3\u30fc\u306f\u3084\u3063\u3066\u3044\u3051\u305d\u3046\u3067\u3059\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
 javascript, PHP, URI\u30b9\u30ad\u30fc\u30e0,VBA \u3092\u9023\u643a\u3055\u305b\u305f\u30e9\u30f3\u30c1\u30e3\u30fchtml\u306e\u4f5c\u6210<\/p>\n","protected":false},"author":1,"featured_media":600,"comment_status":"open","ping_status":"closed","sticky":false,"template":"wp-custom-template-x24-index","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[14,24],"_links":{"self":[{"href":"https:\/\/web.cloudfree.jp\/journal\/wp-json\/wp\/v2\/posts\/613"}],"collection":[{"href":"https:\/\/web.cloudfree.jp\/journal\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/web.cloudfree.jp\/journal\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/web.cloudfree.jp\/journal\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/web.cloudfree.jp\/journal\/wp-json\/wp\/v2\/comments?post=613"}],"version-history":[{"count":0,"href":"https:\/\/web.cloudfree.jp\/journal\/wp-json\/wp\/v2\/posts\/613\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/web.cloudfree.jp\/journal\/wp-json\/wp\/v2\/media\/600"}],"wp:attachment":[{"href":"https:\/\/web.cloudfree.jp\/journal\/wp-json\/wp\/v2\/media?parent=613"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/web.cloudfree.jp\/journal\/wp-json\/wp\/v2\/categories?post=613"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/web.cloudfree.jp\/journal\/wp-json\/wp\/v2\/tags?post=613"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}