JScript and MSHTA
The MSHTA client side attack vector is well-known
but works best against Internet Explorer.
As Internet Explorer becomes less-used, this vector will
become less relevant, but we’ll nonetheless reinvent it
to bypass AppLocker and execute arbitrary Jscript code.
First, we’ll briefly describe the MSHTA attack
and provide context for an AppLocker bypass.
Microsoft HTML Applications (MSHTA) work by executing .hta
files with the native mshta.exe application.
HTML Applications include embedded Jscript
or VBS code that is parsed and executed by mshta.exe.
Since mshta.exe is located in C:\Windows\System32
and is a signed Microsoft application,
it is commonly whitelisted.
Because of this, we can execute our Jscript code with mshta.exe
instead of wscript.exe, and subsequently,
bypass application whitelisting.
Lets create a very simple HTA file containing Jscript code
When executed by mshta.exe, the Jscript code inside both the
head and the body tags will be executed,
a command prompt will be spawned
and the the mshta.exe window will be closed.
When we save this code to a local file,
and execute it from the command line,
we observe that it does indeed bypass AppLocker.
This effectively re-invigorates our Jscript tradecraft!
We can deliver this in a few different ways.
For example, we could attach it to an email,
or HTML-smuggle the file through a browser.
Either way, the user must be tricked into running it
to execute our code.
In our case, we will create a shortcut file
and store our .hta file on our Apache webserver.
To create the shortcut file, we’ll right-click the desktop
on the Windows 10 victim machine and navigate to New -> Shortcut.
In the new window, we’ll enter the MSHTA executable path
followed by the URL of the .hta file on our Kali machine:
To create it, we’ll click “Next” and name it.
Once test.hta is transferred to our Kali machine,
we can double-click the shortcut file to execute our Jscript code
As a final step of this weaponization, we can bring back
the Jscript code generated with DotNetToJscript and embed it
in the hta file to obtain a reverse shell
by only sending the victim a shortcut file.