{"id":19,"date":"2004-09-17T22:24:00","date_gmt":"2004-09-17T22:24:00","guid":{"rendered":"http:\/\/markwilson.me.uk\/blog\/2004\/09\/shelling-out-to-command-prompt-from.htm"},"modified":"2007-05-15T14:56:01","modified_gmt":"2007-05-15T13:56:01","slug":"shelling-out-to-command-prompt-from","status":"publish","type":"post","link":"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/shelling-out-to-command-prompt-from.htm","title":{"rendered":"Shelling out to a command prompt from within an Office application"},"content":{"rendered":"

Earlier today I needed to shell out to a command prompt from a locked-down desktop PC. With only a limited set of icons and no access to the Run dialog from the Start Menu, I asked a colleague if he knew any back doors in the client build. He showed me this neat method for shelling out to pretty much anything you like from within an Office application:<\/p>\n

    \n
  1. Open Microsoft Word, Excel, Outlook or another application that supports Microsoft Visual Basic for Applications (VBA).<\/li>\n
  2. Select Macro, then Visual Basic Editor from the Tools menu (or type Alt-F11).<\/li>\n
  3. Select Module from the Insert menu and enter the following code in the Module window:
    \nSub Main()Dim x
    \nx = Shell(\"cmd.exe\")
    \nEnd Sub<\/code><\/li>\n
  4. Select Run Sub\/User Form from the Run menu (or type F5) and a new instance of cmd.exe will be launched.<\/li>\n<\/ol>\n

    The security implications of this could be severe, but as an administrator it’s a useful trick to know.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Earlier today I needed to shell out to a command prompt from a locked-down desktop PC. With only a limited set of icons and no access to the Run dialog from the Start Menu, I asked a colleague if he knew any back doors in the client build. He showed me this neat method for … Continue reading Shelling out to a command prompt from within an Office application<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[],"tags":[47,82],"class_list":["post-19","post","type-post","status-publish","format-standard","hentry","tag-office","tag-scripting"],"yoast_head":"\nShelling out to a command prompt from within an Office application - markwilson.it<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/shelling-out-to-command-prompt-from.htm\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Shelling out to a command prompt from within an Office application - markwilson.it\" \/>\n<meta property=\"og:description\" content=\"Earlier today I needed to shell out to a command prompt from a locked-down desktop PC. With only a limited set of icons and no access to the Run dialog from the Start Menu, I asked a colleague if he knew any back doors in the client build. He showed me this neat method for … Continue reading Shelling out to a command prompt from within an Office application\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/shelling-out-to-command-prompt-from.htm\" \/>\n<meta property=\"og:site_name\" content=\"markwilson.it\" \/>\n<meta property=\"article:published_time\" content=\"2004-09-17T22:24:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2007-05-15T13:56:01+00:00\" \/>\n<meta name=\"author\" content=\"Mark Wilson\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@markwilsonit\" \/>\n<meta name=\"twitter:site\" content=\"@markwilsonit\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Mark Wilson\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2004\\\/09\\\/shelling-out-to-command-prompt-from.htm#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2004\\\/09\\\/shelling-out-to-command-prompt-from.htm\"},\"author\":{\"name\":\"Mark Wilson\",\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/#\\\/schema\\\/person\\\/98f61365e7c39d6be942174b8c4de468\"},\"headline\":\"Shelling out to a command prompt from within an Office application\",\"datePublished\":\"2004-09-17T22:24:00+00:00\",\"dateModified\":\"2007-05-15T13:56:01+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2004\\\/09\\\/shelling-out-to-command-prompt-from.htm\"},\"wordCount\":164,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/#\\\/schema\\\/person\\\/98f61365e7c39d6be942174b8c4de468\"},\"keywords\":[\"Microsoft Office\",\"Scripting\"],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2004\\\/09\\\/shelling-out-to-command-prompt-from.htm#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2004\\\/09\\\/shelling-out-to-command-prompt-from.htm\",\"url\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2004\\\/09\\\/shelling-out-to-command-prompt-from.htm\",\"name\":\"Shelling out to a command prompt from within an Office application - markwilson.it\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/#website\"},\"datePublished\":\"2004-09-17T22:24:00+00:00\",\"dateModified\":\"2007-05-15T13:56:01+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2004\\\/09\\\/shelling-out-to-command-prompt-from.htm#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2004\\\/09\\\/shelling-out-to-command-prompt-from.htm\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2004\\\/09\\\/shelling-out-to-command-prompt-from.htm#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Shelling out to a command prompt from within an Office application\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/\",\"name\":\"markwilson.it\",\"description\":\"get-info -class technology | write-output > \\\/dev\\\/web\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/#\\\/schema\\\/person\\\/98f61365e7c39d6be942174b8c4de468\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/#\\\/schema\\\/person\\\/98f61365e7c39d6be942174b8c4de468\",\"name\":\"Mark Wilson\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/i0.wp.com\\\/www.markwilson.co.uk\\\/blog\\\/uploads\\\/image-4.png?fit=800%2C800&ssl=1\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/www.markwilson.co.uk\\\/blog\\\/uploads\\\/image-4.png?fit=800%2C800&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/www.markwilson.co.uk\\\/blog\\\/uploads\\\/image-4.png?fit=800%2C800&ssl=1\",\"width\":800,\"height\":800,\"caption\":\"Mark Wilson\"},\"logo\":{\"@id\":\"https:\\\/\\\/i0.wp.com\\\/www.markwilson.co.uk\\\/blog\\\/uploads\\\/image-4.png?fit=800%2C800&ssl=1\"},\"description\":\"A Chartered IT Professional, with recent experience in technology leadership, IT strategy and practice management roles, Mark Wilson is an Enterprise Architect in the Advisory and Management Group at risual. During a career spanning more than two decades, Mark has gained widespread recognition as an expert in his field including both industry and national press exposure. In addition to certifications from Microsoft, VMware, Red Hat, The Open Group and Axelos, Mark held a Microsoft Most Valuable Professional (MVP) award for three years and is now part of the MVP Reconnect programme. Mark is also well-known on social media and maintains an award-winning blog.\",\"sameAs\":[\"http:\\\/\\\/www.markwilson.co.uk\\\/\",\"https:\\\/\\\/www.instagram.com\\\/markwilsonuk\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/markawilson\\\/\",\"https:\\\/\\\/x.com\\\/markwilsonit\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCWHlZCoHRTocdvtrOJ2IL4A\"],\"url\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/author\\\/mark-wilson\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Shelling out to a command prompt from within an Office application - markwilson.it","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/shelling-out-to-command-prompt-from.htm","og_locale":"en_GB","og_type":"article","og_title":"Shelling out to a command prompt from within an Office application - markwilson.it","og_description":"Earlier today I needed to shell out to a command prompt from a locked-down desktop PC. With only a limited set of icons and no access to the Run dialog from the Start Menu, I asked a colleague if he knew any back doors in the client build. He showed me this neat method for … Continue reading Shelling out to a command prompt from within an Office application","og_url":"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/shelling-out-to-command-prompt-from.htm","og_site_name":"markwilson.it","article_published_time":"2004-09-17T22:24:00+00:00","article_modified_time":"2007-05-15T13:56:01+00:00","author":"Mark Wilson","twitter_card":"summary_large_image","twitter_creator":"@markwilsonit","twitter_site":"@markwilsonit","twitter_misc":{"Written by":"Mark Wilson","Estimated reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/shelling-out-to-command-prompt-from.htm#article","isPartOf":{"@id":"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/shelling-out-to-command-prompt-from.htm"},"author":{"name":"Mark Wilson","@id":"https:\/\/www.markwilson.co.uk\/blog\/#\/schema\/person\/98f61365e7c39d6be942174b8c4de468"},"headline":"Shelling out to a command prompt from within an Office application","datePublished":"2004-09-17T22:24:00+00:00","dateModified":"2007-05-15T13:56:01+00:00","mainEntityOfPage":{"@id":"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/shelling-out-to-command-prompt-from.htm"},"wordCount":164,"commentCount":0,"publisher":{"@id":"https:\/\/www.markwilson.co.uk\/blog\/#\/schema\/person\/98f61365e7c39d6be942174b8c4de468"},"keywords":["Microsoft Office","Scripting"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/shelling-out-to-command-prompt-from.htm#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/shelling-out-to-command-prompt-from.htm","url":"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/shelling-out-to-command-prompt-from.htm","name":"Shelling out to a command prompt from within an Office application - markwilson.it","isPartOf":{"@id":"https:\/\/www.markwilson.co.uk\/blog\/#website"},"datePublished":"2004-09-17T22:24:00+00:00","dateModified":"2007-05-15T13:56:01+00:00","breadcrumb":{"@id":"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/shelling-out-to-command-prompt-from.htm#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/shelling-out-to-command-prompt-from.htm"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/shelling-out-to-command-prompt-from.htm#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.markwilson.co.uk\/blog"},{"@type":"ListItem","position":2,"name":"Shelling out to a command prompt from within an Office application"}]},{"@type":"WebSite","@id":"https:\/\/www.markwilson.co.uk\/blog\/#website","url":"https:\/\/www.markwilson.co.uk\/blog\/","name":"markwilson.it","description":"get-info -class technology | write-output > \/dev\/web","publisher":{"@id":"https:\/\/www.markwilson.co.uk\/blog\/#\/schema\/person\/98f61365e7c39d6be942174b8c4de468"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.markwilson.co.uk\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":["Person","Organization"],"@id":"https:\/\/www.markwilson.co.uk\/blog\/#\/schema\/person\/98f61365e7c39d6be942174b8c4de468","name":"Mark Wilson","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/i0.wp.com\/www.markwilson.co.uk\/blog\/uploads\/image-4.png?fit=800%2C800&ssl=1","url":"https:\/\/i0.wp.com\/www.markwilson.co.uk\/blog\/uploads\/image-4.png?fit=800%2C800&ssl=1","contentUrl":"https:\/\/i0.wp.com\/www.markwilson.co.uk\/blog\/uploads\/image-4.png?fit=800%2C800&ssl=1","width":800,"height":800,"caption":"Mark Wilson"},"logo":{"@id":"https:\/\/i0.wp.com\/www.markwilson.co.uk\/blog\/uploads\/image-4.png?fit=800%2C800&ssl=1"},"description":"A Chartered IT Professional, with recent experience in technology leadership, IT strategy and practice management roles, Mark Wilson is an Enterprise Architect in the Advisory and Management Group at risual. During a career spanning more than two decades, Mark has gained widespread recognition as an expert in his field including both industry and national press exposure. In addition to certifications from Microsoft, VMware, Red Hat, The Open Group and Axelos, Mark held a Microsoft Most Valuable Professional (MVP) award for three years and is now part of the MVP Reconnect programme. Mark is also well-known on social media and maintains an award-winning blog.","sameAs":["http:\/\/www.markwilson.co.uk\/","https:\/\/www.instagram.com\/markwilsonuk\/","https:\/\/www.linkedin.com\/in\/markawilson\/","https:\/\/x.com\/markwilsonit","https:\/\/www.youtube.com\/channel\/UCWHlZCoHRTocdvtrOJ2IL4A"],"url":"https:\/\/www.markwilson.co.uk\/blog\/author\/mark-wilson"}]}},"jetpack_featured_media_url":"","jetpack-related-posts":[{"id":812,"url":"https:\/\/www.markwilson.co.uk\/blog\/2007\/06\/working-around-uac.htm","url_meta":{"origin":19,"position":0},"title":"Working around UAC","author":"Mark Wilson","date":"Thursday 7 June 2007","format":false,"excerpt":"There's been a lot written about Windows Vista's user account control (UAC) and personally I can't see what the criticsm is about (Mac OS X and Linux both have similar mechanisms, although the implementation is slightly different); however it was interesting to hear Steve Lamb mention at a recent event\u2026","rel":"","context":"In \"Microsoft Windows Vista\"","block_context":{"text":"Microsoft Windows Vista","link":"https:\/\/www.markwilson.co.uk\/blog\/tag\/windows-vista"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":586,"url":"https:\/\/www.markwilson.co.uk\/blog\/2006\/05\/using-unprivileged-accounts-in-windows.htm","url_meta":{"origin":19,"position":1},"title":"Using unprivileged accounts in Windows","author":"Mark Wilson","date":"Saturday 13 May 2006","format":false,"excerpt":"A few weeks back, Microsoft UK's Steve Lamb presented a session on using the principle of least privileged access to reduce exposure to security threats under Windows (basically, running as much as possible as a standard, non-administrative user). Unfortunately I missed the event but I was chatting with Steve last\u2026","rel":"","context":"In \"Microsoft Windows\"","block_context":{"text":"Microsoft Windows","link":"https:\/\/www.markwilson.co.uk\/blog\/tag\/windows"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":267,"url":"https:\/\/www.markwilson.co.uk\/blog\/2006\/02\/microsofts-next-generation-command.htm","url_meta":{"origin":19,"position":2},"title":"Microsoft’s next generation command shell","author":"Mark Wilson","date":"Friday 10 February 2006","format":false,"excerpt":"Back in June 2004, I got in a panic because I heard that VBScript was about to be phased out. Don Jones commented that VBScript will still be there in Windows, it just won't be developed any further, then later I heard about the new Microsoft scripting host (MSH) shell\u2026","rel":"","context":"In \"Microsoft Windows\"","block_context":{"text":"Microsoft Windows","link":"https:\/\/www.markwilson.co.uk\/blog\/tag\/windows"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1300,"url":"https:\/\/www.markwilson.co.uk\/blog\/2008\/12\/managing-stored-credentials-from-the-windows-command-prompt-using-cmdkey.htm","url_meta":{"origin":19,"position":3},"title":"Managing stored credentials from the Windows command prompt using cmdkey","author":"Mark Wilson","date":"Monday 22 December 2008","format":false,"excerpt":"I've been meaning to blog about a command which is a reasonably recent addition to Windows for a few weeks now - cmdkey.exe (thanks to John Craddock for highlighting this at a recent XTSeminars event). Basically Microsoft's cmdkey, introduced with Windows Server 2003 (and which should not be confused with\u2026","rel":"","context":"In \"Microsoft Windows Server 2003\"","block_context":{"text":"Microsoft Windows Server 2003","link":"https:\/\/www.markwilson.co.uk\/blog\/tag\/windows-server-2003"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":764,"url":"https:\/\/www.markwilson.co.uk\/blog\/2007\/04\/thinkbook-macpad.htm","url_meta":{"origin":19,"position":4},"title":"ThinkBook? MacPad?","author":"Mark Wilson","date":"Wednesday 4 April 2007","format":false,"excerpt":"Firstly, let me point out that I am not publicly condoning software piracy. To run Apple Mac OS X 10.4 on anything other than a properly licensed Macintosh computer would be very, very naughty. If, however, you did have a spare copy of OS X and you wanted to install\u2026","rel":"","context":"In \"Apple Mac OS X\"","block_context":{"text":"Apple Mac OS X","link":"https:\/\/www.markwilson.co.uk\/blog\/tag\/mac-os-x"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":648,"url":"https:\/\/www.markwilson.co.uk\/blog\/2005\/10\/using-netsh-to-set-multiple-dns-server.htm","url_meta":{"origin":19,"position":5},"title":"Using netsh to set multiple DNS server addresses in Windows","author":"Mark Wilson","date":"Tuesday 11 October 2005","format":false,"excerpt":"During my recent two days of torment caused by a flaky Java application, I had to change the preferred and alternate DNS server entries for one of my network cards. Ordinarily that would be simple, but with an unresponsive Explorer interface refusing to open any network connection dialogs I needed\u2026","rel":"","context":"In "Technology"","block_context":{"text":"Technology","link":"https:\/\/www.markwilson.co.uk\/blog\/topic\/technology"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/posts\/19","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=19"}],"version-history":[{"count":0,"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/posts\/19\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=19"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=19"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=19"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}