Run other programs from your .NET code

• Download source and demo files - 34.4 Kb

Introduction

Once upon a time, a CP member paid $19.95 per month for web hosting through a professional hosting provider and registered his own domain name. He had no practical use for it, he did this just because everyone else seemed to have done so and he did not want to miss the fun. The provider used Windows XP servers to host .NET web applications.

The said CP member was learning the Process class in the .NET framework at the time. He found out that he could upload almost any application and execute it on the server machine using this class. The ASPNET account on the server machine had only limited access rights, but he could have done a lot of things on the server that he should not be allowed to do.

Anyway, he lost interest later and cancelled the account with the provider.

A .NET library to execute other programs

I have included a .NET DLL with this article that demonstrates the use of the Process class in the .NET framework. This DLL contains one class called CommandObj with a single public method Run to start another application. You can use multiple instances of CommandObj to start multiple applications from your code. The applications being started do not have to be .NET applications, however.

The help documentation on the Process class is so clear that I feel no need to explain any detail here. What I did in the CommandObj class is make it easier for users to run another program from their code. All you have to do is create an instance of CommandObj and call the Run method. Here is the signature of the Run method.

public string Run(string sFilePath, string sArgs, 
    string sInput, string sWorkingDir, int nWaitTime);

• The sFilePath parameter is the full path of the program you want to run.
• The sArgs parameter is the optional command line arguments, use null or empty string if there are no arguments.
• The sInput parameter is a string that will be written to the standard input stream of the program you want to run, use null or empty string if your program does not expect any input.
• The sWorkingDir is the working directory for the program you want to run. If you pass null or the empty string, the working directory will be inherited from the parent process.
• Finally, the nWaitTime parameter is the number of milliseconds the current CommandObj object will wait for the program it started. If you pass 0 or a negative value, the internal default value 60000 (one minute) will be used.

The return value of the Run method is whatever the program wrote to its standard output and/or standard error streams. Note that the Run method will not return until the application it started has terminated. But you can modify the CommandObj class to do things differently or call the Run method from a separate thread so that your main thread won't be blocked.

Here is what will happen when you call the Run method. First, a ProcessStartInfo object (see .NET documentation) will be created with the given file path and command line. Then the working directory will be set, the standard output and standard error streams will be redirected. Finally, the program you specified will be started by a Process object and its output and error will be read from separate threads. If the started program does not end within the given time, it will be forcefully terminated; when that happens, the return value of the Run method will contain the string "Error: Hung process terminated ...".

Various exceptions while calling the Run method should be handled by the caller. Typical examples of exceptions include wrong file path, access violation, authentication error, etc.

The use of the CommandObj class is not limited to web applications, there is nothing to prevent you from using it to run a GUI program.

RemoteAdmin, a sample ASP.NET application

If you are working with multiple servers or workstations like me, it can be annoying that you have to logon to different machines all the time. It would be nice if you can logon to one machine and use the browser to access other machines.

RemoteAdmin is an ASP.NET application built for this purpose. If you install it on a remote machine, you can do all kinds of things without logon to the remote machine. I typically use it to view logs, upload files, replace a binary module (a .NET DLL, for example), mount a network drive, or make configuration changes for a web application (replace the web.config file).

There is only one web form in this ASP.NET application. The picture on the left shows how this form is displayed and used in the browser. There is a "submit" button on the lower right corner of the web form. When this button is clicked, the cmd.exe program will be executed on the server from the directory d:\ and the content of the directory will be displayed on the same page below the web form (see the lower portion of the picture). This is equivalent to logon to the server, open a command prompt window, and executing the following commands:

d:
dir

As you can see, you can place a whole bunch of DOS commands into the "Standard Input" field on the form and execute them with a single click of a button. Please note that you need to end DOS commands with a return character.

If the remote machine runs .NET applications under the "local system" account, then RemoteAdmin will have administrator privilege (and more), you can even install, start, and stop Windows services. For security risks associated with this, please read the next section.

To install RemoteAdmin, do the following: unzip all files into a local folder; run the script file InstallRemoteAdmin.vbs. The script will ask you on which website (if there is more than one) you want to run this application. It will also ask you what IP address is allowed to access this application. You can modify the script to allow access from more than one IP address. Unless you are working in a secured environment with trustworthy co-workers, you don't want to let everyone access your machine without limitation.

After installation, you access the application from the specified IP address by typing the following URL into the address bar of your browser:

http://MyRemoteMachine/RemoteWebAdmin/RemoteAdmin.aspx?Action=Run

If you change Action=Run in the query string to Action=Load, then the form will change its appearance to allow you to upload any file to the remote machine.

Security Concerns And Disclaimer

As I said or implied earlier, it is easy for others to use the RemoteAdmin application to compromise your server. That is why you are not supposed to install it on critical servers. On the machines you do install it, you are recommended to restrict access to a few trusted IP addresses. Since IP addresses can be faked, you may want to implement further authentication/authorization mechanism. You should never modify the machine.config file on your server to let ASP.NET applications run under the "local system" account; even if other people can't access your machine, you can easily do a lot of damages yourself.

In any case, I will not be responsible for any problem resulting from using the code and ideas in this article.

Thank you for reading my article.