Microsoft says VBScript will be ripped from Windows in a future release

I know it is the actual title of the article, but is "ripped" really an accurate word to use to describe what is happening here?

> "VBScript is being deprecated," Microsoft said. "In future releases of Windows, VBScript will be available as a feature on demand before its removal from the operating system."

This sounds like the opposite of "ripped" to me. Maybe "slowly withdrawn" might be more accurate.

"Ripped" implies (to me) a sudden and traumatic removal, without care for collateral damage that might be caused.

VBScript was such an underrated way to write exploits for IE users. You could have programs run that could make web requests with cookies and process page data. When I did this pen test back in the day I found forum software that had HTML enabled in the signature field. I wanted to show that you could turn something as simple as XSS into really high-level access. So I ended up writing a program that did this:

Payload: change a users signature to the program and hide the code on the edit page

Vectors:

- VScript - submit a request with the users cookies on IE (also defeats client-side CSRF tokens)

- Phispher - use javascript to show a phisphing page for the login screen as the signature code runs (works cross-browser but requires interaction.)

- PHP - collect forum logins and send requests to update signatures with the program

Results: I ended up spreading to most signatures in the forum, undetected. Ended up gaining access to all the forum admin users. From there is was easy to get a shell on the forum because there were theme uploads via the admin page. Called a reverse shell via perl -> nc with the www-data user and then privilege escalation with a local exploit to get root.

... but VBScript was still pivotal to spreading the code because IE was very wide-spread back then (and very, very vulnerable.) Good times / 10.

I'm a bit nostalgic about this. Not because of VBScript or even JScript. But because of ActiveState which provided Perl, TCP, and Python interpreters that worked with Windows Script Host. I could create and call COM interfaces plus the CPAN library to pick from. I built Tkinter GUIs for my scripts.

It was part of the OLE dream that users would have lots of small scripts automating their component-oriented workflows. What we got instead was cargo-cult coding and innumerable vulnerabilities because, to borrow a phrase from the IoT folks, the 'S' in COM/OLE stands for security.

I can buy the "wmic will be ripped out" but this is hard to believe. So many corporate crap depends on vbs. Not only that, random programs, installers/uninstallers and more lazily use it. This was the thing you used in windows before powershell was a thing (this and jscript). You can maybe use mshta but it too can't do much without vbs/js code.

I'll give you an example: most hp printer setup crap uses mshta which if I remember right uses vbs code (could be jscript too). I assume since the windows script host supports both, this would affect jscript as well.

VBScript was how I got into programming well over a decade ago, was reading a book on vista where there was a short chapter on automating some file operations etc. I still remember the excitement of typing the commands into notepad and seeing a modal popup saying Hello World!. I made a monstrous text adventure game by just copy pasting and modifying hundreds of if statements where you could "branch" off an have entire new adventures and if you didn't like it you could come back to the original, little to no idea how it all worked but it kept working until it didn't.

20 years ago, I got into programming by writing little VBScript extensions for my StarCraft clan’s bot on battle.net. It was primitive, but such a fun and social way to get into programming!

This news made me trawl through the Wayback Machine to find my first blog I wrote in classic ASP using VBscript with an Access database. This was back in 2003! "We've caught on to the latest craze on the internet - the Blog (web log) - where we'll be able to post regular updates of what's going on in our lives." I had photo albums, a calendar view, and the obligatory guest book (with no authentication of course). All developed with VBscript and Windows Notepad. :-)

Later in my sysadmin life, I wrote massive logon scripts, printer deployment tools, computer auditing scripts, and much more with VBscript. It was a surprisingly capable scripting language. Later we learned how to add a nice GUI to the scripts using HTA which added an HTML front end using Internet Explorer.

What about JScript? Is that on the chopping block too?

Having written utility scripts embedded into my installer using VBScript, I am not amused. It used to be that MS was known for going to great lengths to achieve backward compatibility, but now even they are infected with CADT programmers.

My only hope is that some BigCOs scream loud enough about MS breaking all their old stuff.

Based on the title alone, I'm skeptical about the author's understanding of the subject.

VBScript helped me out of so many jams when I would have been otherwise hindered by government/military IT policies. Thanks for the memories.

VBScript must be different from Excel Visual Basic right? Because there’s a lot of people who still use that.