Vbs script not working in fixlet

cstoneba · June 4, 2018, 2:20pm

I have a vbs script that runs in a fixlet that replaces a IP string in a file (that is downloaded and extracted via prefetch) to a different IP. When I run the command from start > run or CMD, it works fine, but when the fixlet runs the command, the vbs doesn’t update the file, yet it returns an exit code of “0”.

Test Fixlet:

action uses wow64 redirection false
prefetch 4500f4755a32d02f2e008905e73576a9ca5137e6 sha1:4500f4755a32d02f2e008905e73576a9ca5137e6 size:21219789 http://localhost:52311/Uploads/4500f4755a32d02f2e008905e73576a9ca5137e6/blah.tmp sha256:d96d20bcb105993241f9b38f308dbe803577d051687749559c7a5c8cfd10482d
extract 4500f4755a32d02f2e008905e73576a9ca5137e6



//update config files
delete __createfile
delete replace.vbs
createfile until _EOF
'Usage (WScript):
'ReplaceText FileName OldText NewText [/I]
' /I (optional) - Text matching is not case sensitive

Set oArgs = WScript.Arguments

intCaseSensitive = 0
For i = 3 to oArgs.Count-1
If UCase(oArgs(i)) = "/I" Then intCaseSensitive = 1
Next

Set oFSO = CreateObject("Scripting.FileSystemObject")

If Not oFSO.FileExists(oArgs(0)) Then
WScript.Echo "Specified file does not exist."
Else
Set oFile = oFSO.OpenTextFile(oArgs(0), 1)
strText = oFile.ReadAll
oFile.Close

strText = Replace(strText, oArgs(1), oArgs(2), 1, -1, intCaseSensitive)

Set oFile = oFSO.OpenTextFile(oArgs(0), 2)
oFile.WriteLine strText
oFile.Close
End If
_EOF

copy __createfile replace.vbs
parameter "StartTime"="{now}"
pause while { (now-time(parameter "StartTime") < 5*second)}
waithidden cmd.exe /c cscript.exe //noLogo "{pathname of client folder of current site & "\replace.vbs"}" "{pathname of client folder of current site & "\__Download\agent_config.json"}" 5.6.7.8 1.2.3.4

When it runs, this is the log file results:

   Wow64 redirection disabled. action uses wow64 redirection false (action:2344468)
   Command succeeded (Prefetch download manager collected file) prefetch 4500f4755a32d02f2e008905e73576a9ca5137e6 sha1:4500f4755a32d02f2e008905e73576a9ca5137e6 size:21219789 http://localhost:52311/Uploads/4500f4755a32d02f2e008905e73576a9ca5137e6/blah.tmp sha256:d96d20bcb105993241f9b38f308dbe803577d051687749559c7a5c8cfd10482d (action:2344468)
At 09:05:34 -0500 - actionsite (http://:52311/cgi-bin/bfgather.exe/actionsite)
   Command succeeded extract 4500f4755a32d02f2e008905e73576a9ca5137e6 (action:2344468)
At 09:05:35 -0500 - actionsite (http://:52311/cgi-bin/bfgather.exe/actionsite)
   Command succeeded delete __createfile (action:2344468)
   Command succeeded delete No 'C:\Program Files (x86)\BigFix Enterprise\BES Client\__BESData\actionsite\replace.vbs' exists to delete, no failure reported (action:2344468)
   Command succeeded createfile until  (action:2344468)
   Command succeeded copy __createfile replace.vbs (action:2344468)
   Command succeeded parameter "StartTime"="Mon, 04 Jun 2018 09:05:35 -0500" (action:2344468)
   Paused pause while True (action:2344468)
At 09:05:40 -0500 - actionsite (http://:52311/cgi-bin/bfgather.exe/actionsite)
   Not paused pause while False (action:2344468)
   Command started - waithidden cmd.exe /c cscript.exe //noLogo "C:\Program Files (x86)\BigFix Enterprise\BES Client\__BESData\actionsite\replace.vbs" "C:\Program Files (x86)\BigFix Enterprise\BES Client\__BESData\actionsite\__Download\agent_config.json" 5.6.7.8 1.2.3.4 (action:2344468)
   Command succeeded (Exit Code=0) waithidden cmd.exe /c cscript.exe //noLogo "C:\Program Files (x86)\BigFix Enterprise\BES Client\__BESData\actionsite\replace.vbs" "C:\Program Files (x86)\BigFix Enterprise\BES Client\__BESData\actionsite\__Download\agent_config.json" 5.6.7.8 1.2.3.4 (action:2344468)

I’ve tried adding “wow64 redirection false” and can’t think of anything else. Any suggestions?

jgo · June 4, 2018, 3:52pm

@cstoneba - I recreated what you were doing without a prefetch and it seems to be working for me… I did make a few changes on my end. Below is my wait line as opposed to waithidden, another difference is that I commented out the action uses syswow64 redirection false. And… I also am not using the _download folder for my json file.

**wait** cmd.exe /c cscript.exe //noLogo **//t:60** "{pathname of client folder of current site & "\replace.vbs"}" "{(pathname of parent folder of client as string) & "\REPLACEPATH\test.json"}" 5.6.7.8 1.2.3.4

A few things that I would look at:

Does the error code get passed back?
Perhaps it does, however you may want to trap an error specifically… You can add on error handling by using On Error Resume Next
And then you can trap for a specif error by looking for an error code:

If Err.Number <> 0 Then
  WScript.Echo "SOME ERROR SPECIFIC TEXT: " & Err.Description
  WScript.Quit Err.Number
End If

Does the command run in PsEXEC as SYSTEM? (documenting this for people that may read this decades from now.)
To test this download PSTOOLs.
Then extract and place the PsExec exes in a folder.
Open the command line as an Admin.
psexec -s -i cmd.exe
this will open another command shell, then execute the vbs the exact same way the bigfix agent would be by running the following command:
C:\ClassTools>cmd.exe /c cscript.exe //noLogo //t:60 script.vbs "c:\Program Files (x86)\BigFix Enterprise\BES Client\REPLACEPATH\test.json" 5.6.7.8 10.0.0.10
One other thing you may want to do… Place the JSON outside of program files or program files (x86). Sometimes I have seen GPO’s or some other environmental factor locking down the ability to edit things by system in very specific occasions.

I can take a closer, but hopefully that helps.
-jgo

JasonWalker · June 4, 2018, 4:29pm

Agree with all @jgo stated,but I’d also add that this line of vbscript means the script ignores the error if it cannot find the file. You’re putting a message to stdout (which you won’t be able to see) but then continue on.

In this same if/then block, you should add something like
wscript.quit 1
So the script will terminate with a non-zero exit code (which you’ll see in the bes client log)

cstoneba · June 4, 2018, 6:34pm

thanks @JasonWalker and @jgo for the suggestions.

Having the vbs exit with 1 was the help I needed because turns out having “cmd.exe /c” for some reason caused a path issue. I could run the full command from command line with "cmd /"c and it would give a path error but after I removed “cmd.exe /c” from the command and ran it, it worked fine, and the same is true within the fixlet.

thanks