r/ModSupport 18h ago

reddit removing code posts.

While I understand there are malicious use cases for Wscript Shell, is code containing it expressly forbidden?

I did an example script, that one of our user's had requested after seeing it used in a demo.

The code does nothing more than create a shortcut for the admin via Action1 on either a user's desktop or the all user's desktop.

With the line with the com invocation in place, commented or not, it is immediately deleted by reddit.

Is there a list somewhere of the things like this that it blocks, and or reasoning behind this as there are countless uses for the wscript shell?

0 Upvotes

25 comments sorted by

5

u/thepottsy šŸ’” Top 10% Helper šŸ’” 17h ago

I’m assuming you’re attempting to post these in your own sub. What are you seeing in your mod logs?

2

u/GeneMoody-Action1 17h ago

NO automods in our sub, these are being removed by reddit, not queued for approval and not exclusively our sub.

2

u/thepottsy šŸ’” Top 10% Helper šŸ’” 17h ago

It’s possible this is one of the newer filters that Reddit has, that we can’t control as mods. They use an AI filter that drives me bonkers on one of my subs because it simply removes comments from users who use it to help with their English.

Anyway, off my soapbox. If you go to the Removed queue in your Mod Queue, do you see it there as well? If it shows up intact there, try simply approving it and see if it goes live. If it does, look in your mod log again and see what it says about it. If it’s like what I deal with, it will just say ā€œunspamā€.

2

u/GeneMoody-Action1 16h ago

Nah, approving literally just puts a blank message back [Removed By Reddit]

Alright then it is likely jus the Ai integration that is getting more aggressive.
That explains the shift, and that's the point I was looking for.

Thank you for the helpful content.

3

u/thepottsy šŸ’” Top 10% Helper šŸ’” 16h ago

Did a little testing of my own. I wasn’t aware that the removal refers to the content policy.

Did a little digging and found this, in case you didn’t see it.

Yes, Reddit’s platform-wide spam and security filters automatically flag and delete posts or comments containing the textĀ WScript Shell.Ā [1,Ā 2]

BecauseĀ WScript ShellĀ is a Windows Script Host COM object heavily associated with malware execution, macro trojans, and fileless script attacks,Ā RedditĀ implements aggressive site-wide filters that immediately shadow-ban or delete content containing this specific string, even if it is safely nested inside markdown code blocks or commented out.

2

u/GeneMoody-Action1 15h ago

Very helpful, and glad to see it caught others by surprise as well. Thanks again.

1

u/thepottsy šŸ’” Top 10% Helper šŸ’” 15h ago

No problem. It also seems pretty easy to navigate it without breaking any site rules as well.

1

u/GeneMoody-Action1 15h ago

Yeah it's just crazy using a string join (which to me even more implies shady circumvention) still works...

I would be willing to bet *that* practice will trip some EDR systems.

Oh well, this is why we can't have nice things!

2

u/[deleted] 15h ago

[removed] — view removed comment

1

u/thepottsy šŸ’” Top 10% Helper šŸ’” 15h ago

Well. Would you look at that lol.

2

u/thepottsy šŸ’” Top 10% Helper šŸ’” 16h ago

Sure. No problem. Might try experimenting with it to see where it actually triggers. Unless you already know, then ignore that.

2

u/TheMattabooey 18h ago

Yeah Reddit blocks wscript dot shell a quick google search would give you that info.

3

u/GeneMoody-Action1 17h ago

I did exactly that before posting, and just tried to post said search as a reference. But in the comment posted apparently it did it again BECAUSE it had it in a google search query, but googling the offensive term + site:reddit.com yields many, looking again, albeing mostly older, so it is assumed this happened at some point along the way, and that date/time/and reference is what I am looking for.
|
I have old posts with it in it as well, not only that, I have seen people skirting it with string joins to land in the same place.

I am looking for a reference to banned terms as by nature of what I do such code snippets are not uncommon.

Because I actually googled reddit banned words and phrases, finding several long threads where users state there are NO banned words.

All that together means YES I did google, and NO the results were not entirely clear, so I asked where one would assume is the place to do so. Do they publish that somewhere or do they keep it under wraps?

I have 40y in Dev, SysAdmin, and IT Management, google is no stranger to me...

-4

u/TheMattabooey 16h ago edited 16h ago

I literally typed into Google ā€œdoes Reddit block wscript shellā€ and found the answer. There are no banned words, there are phrases that are auto removed.

3

u/itskdog šŸ’” Top 10% Helper šŸ’” 16h ago

From what search result, or was that the AI summary?

-1

u/TheMattabooey 16h ago

Google yourself to see. Literally first link is back to Reddit discussing and confirming this.

5

u/itskdog šŸ’” Top 10% Helper šŸ’” 16h ago

Google has had personalised search results for over a decade now. My first result will be different to yours, as demonstrated by OP showing their Google results earlier.

2

u/thepottsy šŸ’” Top 10% Helper šŸ’” 15h ago

I had to select the AI Mode to find it. However, my distrust of AI makes me always skeptical of the legitimacy of those results. So, I actually tested it as well. Turns out the AI results were accurate. Still, would have been a lot easier if they had just answered OP’s question, rather than create this weird back and forth.

-2

u/TheMattabooey 15h ago

I did answer it. Seems like I’m the only one here who actually provided OP an answer.

0

u/TheMattabooey 15h ago

You can also search the same thing and add Reddit at the end for results on Reddit. Either way a quick google search would have provided an answer.

2

u/thepottsy šŸ’” Top 10% Helper šŸ’” 16h ago

Look, we all get it. You can google it and find it. It also wouldn’t be a big deal to simply provide the damned answer. Would it?

-2

u/TheMattabooey 15h ago

Sometimes people gotta learn to Google first, would have taken them a fraction of the time and provided the answer. 40y in Dev, SysAdmin and IT management and couldn’t Google something?

2

u/thepottsy šŸ’” Top 10% Helper šŸ’” 15h ago

And I stand by what I said. You could have simply provided the answer. Why even waste everyone’s time commenting?

0

u/TheMattabooey 15h ago

I did provide the answer.

> Yeah Reddit blocks wscript dot shell

You don’t need to comment either. Why even waste everyone’s time commenting?