HTA stager

[RealHarshThakur]

Hey,
Is it possible to add mshta based exploits? Generating html applications and running it with mshta shouldn't be a problem, I guess.

[RayofLightz]

What do you mean, like a payload that calls back to mshta.exe or a stagger that uses mshta.exe to get the agent on to the system?

[RealHarshThakur]

Stager to get the agent.

[RayofLightz]

So in one of the scripts you can use ActiveXObject to call cmd and call code. It is not the most clean solution but maybe you could grab and execute a msbuild stagger using a hta.

[RealHarshThakur]

Can you specify which script you're talking about?

[RealHarshThakur]

Using ActiveXObject , do you mean by creating wscript.shell object ?
Won't that require the site to be in Trusted sites?

[RayofLightz]

You are talking about an hta correct. Htas are html applications. They live on local disk and are run inside of an stripped down IE window. The code that gets run is using ActiveXObject. The scripting languages can be either visualbasic or javascript. The issues is that ActiveXObject is limited to COM objects. Using wscript.shell is the only way I can think of being able to create a stagger. Even though it would basically fall back onto another staging method. Unless there is a COM object that can be used to compile c# ?

[RealHarshThakur]

I think this could be done: when the malicious executable runs, it could get the shell and run "mshta 'url of the hta'" .

[byt3bl33d3r]

this is already on my to do list :)