Client Side Code Execution With Windows Script Host
Microsoft Office VBA macros are an effective
and popular way to gain client-side code execution.
However, Javascript attachments are equally effective for this task,
and have recently gained in popularity
In this module, we’ll use the Jscript file format
to execute Javascript on Windows targets through the Windows Script Host.
Specifically, we’ll use these Jscript droppers
to execute powerful client-side attacks.
We’ll begin with a simple dropper that opens a command prompt and gradually
improve our attack by reflectively loading pre-compiled C# assembly
to execute our shellcode runner completely in memory.
Let’s begin with a foundational discussion about the JavaScript language.