mshta usage

• mshta is short for MicroSoft Html Application. It could run html file or html string as a parameter.
• what is interesting is you can use it in a batch command or batch file and you can use some functions like in the browser such as show a dialog and so on.
• with mshta you can run javascript code and vbscipt code in windows command line or batch file.

Example 1, show a message box in many different ways.

mshta javascript:window.execScript("msgBox('hello world!'):window.close","vbs") 
mshta vbscript:window.execScript("alert('hello world!');close()","javascript") 
mshta vbscript:window.execScript("msgBox('hello world!'):window.close","vbs")
mshta javascript:alert("hello world!");close()
mshta vbscript:msgbox("hello world!",64,"Title")(window.close)
mshta vbscript:CreateObject("Wscript.Shell").popup("hello world!",7,"Title",64)(window.close) 

Example 2, execute more than one commands in one line.(In fact this already shows in Example 1, you must find it, it is the close command.)

mshta vbscript:execute("msgbox ""BOX one"":msgbox ""BOX two"":window.close") 
mshta vbscript:(msgbox("BOX one"))(msgbox("BOX two")(window.close))
mshta javascript:alert("BOX one",);alert("BOX two");close()
mshta javascript:execScript("msgBox('BOX one'):msgBox('BOX two'):window.close","vbs")

Example 3, use ActiveXObject in script to use more sophisticated functions of the OS.

mshta vbscript:createobject("sapi.spvoice").speak("Hello, I am tom, let's do something fun.")(window.close) 
mshta "javascript:close((V=(v=new ActiveXObject('SAPI.SpVoice')).GetVoices()).count&&v.Speak('Hello! I am '+V(0).GetAttribute('Gender')))"

Example 4, javascript is much more easy to use, because you do not have to add so many double qoutes like in vbscript.

mshta "javascript:var objFSO=new ActiveXObject('Scripting.FileSystemObject'); var objFile = objFSO.CreateTextFile('test.txt',true); objFile.Write('Hello World.');objFile.Close();close();"
mshta "javascript:var sh=new ActiveXObject( 'WScript.Shell' ); sh.Popup( 'hello world!', 10, 'Title!', 64 );close()"

Example 5, several ways to calculate the free memory of your computer.

mshta "javascript:close(new ActiveXObject('Scripting.FileSystemObject').GetStandardStream(1).Write(GetObject('winmgmts:').ExecQuery('Select * from Win32_PerfFormattedData_PerfOS_Memory').ItemIndex(0).AvailableBytes));"|more
for  /f "usebackq" %a in (`mshta ^"javascript^:close^(new ActiveXObject^(^'Scripting.FileSystemObject^'^).GetStandardStream^(1^).Write^(GetObject^(^'winmgmts:^'^).ExecQuery^(^'Select * from Win32_PerfFormattedData_PerfOS_Memory^'^).ItemIndex^(0^).AvailableBytes^)^);^"^|more`) do set free_mem=%a
mshta "javascript:close(new ActiveXObject('Scripting.FileSystemObject').GetStandardStream(1).Write(GetObject('winmgmts:').ExecQuery('Select * from Win32_PerfFormattedData_PerfOS_Memory').ItemIndex(0).AvailableMBytes));"|for /f %%a in ('more') do set free_mem=%%a

Example 6, another way to calculate free memory.

@echo off
setlocal
:: Define simple macros to support JavaScript within batch
set "beginJS=mshta "javascript:close(new ActiveXObject('Scripting.FileSystemObject').GetStandardStream(1).Write("
set "endJS=));""
:: Direct instantiation requires that output is piped
%beginJS% GetObject('winmgmts:').ExecQuery('Select * from Win32_PerfFormattedData_PerfOS_Memory').ItemIndex(0).AvailableBytes %endJS% | findstr "^"
:: FOR /F does not need pipe
for /f %%N in (
  '%beginJS% GetObject('winmgmts:').ExecQuery('Select * from Win32_PerfFormattedData_PerfOS_Memory').ItemIndex(0).AvailableBytes %endJS%'
) do set free_mem=%%N
echo free_mem=%free_mem%

Example 7, show color pallets dialog.

mshta "about:<script>function b(){new ActiveXObject('Scripting.FileSystemObject').GetStandardStream(1).Write(d.ChooseColorDlg().toString(16));close();}</script><body onload='b()'><object id='d' classid='clsid:3050f819-98b5-11cf-bb82-00aa00bdce0b'></object></body>"|more 

Example 8, show screen resolution.

mshta "javascript:res=screen.width+'x'+screen.height;alert(res);close();" 1 | more

Example 9, use clipboard data.

for /f "usebackq tokens=1,* delims=[]" %i in (`mshta "javascript:close(new ActiveXObject('Scripting.FileSystemObject').GetStandardStream(1).Write(clipboardData.getData('Text')));"^|find /v /n ""`) do @set "c[%i]=%j" 

Example 10, use javascript setTimeout to delay some time interval to execute a command.

mshta javascript:setTimeout('close()',10000)

Example 11, show File Open Select Dialog, you can redirect your output to the command window or to a file or to a variable.

mshta "about:<input type=file id=FILE><script>FILE.click();new ActiveXObject('Scripting.FileSystemObject').GetStandardStream(1).WriteLine(FILE.value);close();resizeTo(0,0);</script>"|more

mshta "about:<input type=file id=FILE><script>FILE.click();new ActiveXObject('Scripting.FileSystemObject').GetStandardStream(1).WriteLine(FILE.value);close();</script>">test.txt

mshta "about:<input type=file id=FILE><script>FILE.click();new ActiveXObject('Scripting.FileSystemObject').GetStandardStream(1).WriteLine(FILE.value);close();</script>">temp && set /p a=<temp

for /f "delims=" %%i in ('mshta "about:<input type=file id=FILE><script>FILE.click();new ActiveXObject('Scripting.FileSystemObject').GetStandardStream(1).WriteLine(FILE.value);close();</script>"') do set a=%%i

Example 12, show Open For Folder Dialog to select a directory, and you can assign it to a variable.

for /f "delims=" %%i in ('mshta "javascript:var folder=new ActiveXObject("Shell.Application").BrowseForFolder(0,'选择要处理的文件夹', 0, '').self.path;new ActiveXObject('Scripting.FileSystemObject').GetStandardStream(1).WriteLine(folder);close();"') do set input=%%i

Example 13, execute batch command with parameters which has spaces.

::a.bat
@echo off
set text=Hello World
mshta vbscript:createobject("WScript.Shell").Run("b.bat "+"""%text%""",0)(window.close)
::b.bat
@echo off
mshta "javascript:var sh=new ActiveXObject( 'WScript.Shell' ); sh.Popup( '%~1', 10, 'Title!', 64 ); close()"

Example 14, ultimate function, run a html file.

<!-- :: Batch section
@echo off
setlocal
echo Select an option:
for /F "delims=" %%a in ('mshta.exe "%~F0"') do set "HTAreply=%%a"
echo End of HTA window, reply: "%HTAreply%"
goto :EOF
-->

<HTML>
<HEAD>
<HTA:APPLICATION SCROLL="no" SYSMENU="no" >

<TITLE>HTA Radio Buttons</TITLE>
<SCRIPT language="JavaScript">
window.resizeTo(440,170);

var reply = "No button selected";
function closeHTA(){
   var fso = new ActiveXObject("Scripting.FileSystemObject");
   fso.GetStandardStream(1).WriteLine(reply);
   window.close();
}

</SCRIPT>
</HEAD>
<BODY>
<p>Which prize do you prefer?</p>
<label><input type="radio" name="prize" onclick="reply=this.value" value="House">House</label>
<label><input type="radio" name="prize" onclick="reply=this.value" value="Money">$1 million</label>
<label><input type="radio" name="prize" onclick="reply=this.value" value="None">No prize thanks, I'm already happy <b>:)</b></label>
<br><br>
<button onclick="closeHTA();">Submit</button>
</BODY>
</HTML>

---

reference1
reference2
reference3