| IExpress | |
|---|---|
 | |
 Screenshot of IExpress inWindows 11 | |
| Developer | Microsoft |
| Operating system | Windows NT |
| Type | Self-contained installation packages maker |
IExpress, a component ofWindows 2000 and later versions of the operating system, is used to createself-extracting packages from a set of files. Such packages can be used to install software.
IExpress (IEXPRESS.EXE) can be used for distributing self-contained installation packages (INF-based setup executables) to multiple local or remote Windows computers. It creates a self-extracting executable (.EXE) or a compressed Cabinet (.CAB) file using either the provided front end interface (IExpress Wizard), or a custom Self Extraction Directive (SED) file.[1]SED files can be modified with any plain text/ASCII editor, likeNotepad. All self-extracting files created by IExpress useCAB compression algorithms, are compressed using the Cabinet Maker (MAKECAB.EXE) tool,[2] and are extracted using the WExtract (WEXTRACT.EXE) tool.
IEXPRESS.EXE is located in theSYSTEM32 folder of both 32 and 64-bit installations of Windows. The front end interface (IExpress Wizard) can be started by manually navigating to the respective directory and opening the executable (IExpress.exe), or by typing IExpress into the Run window of the Start Menu. It can also be used from a Windowscommand processor shell orbatch file to create custom installation packages, eventually unattended (i.e., automated operation):
IEXPRESS /N drive_letter:\directory_name\file_name.SED
IExpress Wizard interface guides the user through the process of creating a self-extracting package. It asks what the package should do: extract files and then run a program, or just extract files. It then allows the user to specify a title for the package, add a confirmation prompt, add a license agreement that the end-user must accept in order to allow extraction, select files to be archived, set display options for the progress window, and finally, specify a message to display upon completion.
If the option to create an archive and run a program is selected, then there will be an additional step, prompting the user to select the program that will be run upon extraction.
The self-extracting packages created with IExpress have (inherent)vulnerabilities which allowarbitrary code execution because of the way they handle their installation command and their command line processing.[3][4] Additionally, because of the way WindowsUser Account Control handles installers, these vulnerabilities allow forprivilege escalation.[5][6]
Specifically, the two inherent vulnerabilities in IExpress are:
/c: switch tells the package to run an arbitrary command in the extracted directory,[6] andmsiexec.exe command being user-replaceable by an attack payload.[5]The latter point has been fixed by Microsoft in MS14-049, but the former is only addressed by a policy to deprecate IExpress.[6] In addition, aDLL hijacking exploit is also possible with IExpress.[7]
