Execution of Jscript on Windows
In order to use a file type in a phishing attack, it must be easily executable.
For this reason some file types are better suited for phishing attacks than others.
To demonstrate this, let’s inspect PowerShell and Jscript files
on our victim machine and see how they're handled by Windows.
In Windows, a file’s format is identified
by the file extension and not its actual content.
File extensions are also often associated with default applications.
To view these associations, we can navigate to Settings
Apps
Default apps,
scroll to the bottom,
and click on Choose default apps by file type.
Scrolling down the list,
we notice that the default application for PowerShell ps1 files is Notepad.
This means that if we double-click on a PowerShell script,
it will not be executed but instead will be opened for editing in Notepad.
Because of this, even if we were able to convince
the victim to double-click a PowerShell file, it would not be executed.
On the other hand, the default application for .js files
is the Windows-Based Script Host.
This means that if we double-click a .js file, the content will be executed.
As mentioned previously, executing Jscript outside the context of a web browser
bypasses all security settings.
This allows us to interact with the older ActiveX technology
and the Windows Script Host engine itself.
Let’s discuss what we can do with this combination.
With this code, we can leverage ActiveX by invoking the ActiveXObject constructor
by supplying the name of the object.
We can then use WScript.Shell to interact with the Windows Script Host Shell
to execute external Windows applications.
For example, we can instantiate a Shell object named “shell”
from the WScript.Shell class through the ActiveXObject constructor,
to run cmd.exe through the Run command
After saving the code to a file with the .js extension,
and double-clicking it,
the script is executed and launches a command prompt.
The Windows Script Host itself exits as soon as the Jscript file is complete
so we don’t see it in Process Explorer.
In the next section, we’ll build upon this
to create a Jscript dropper that will execute a Meterpreter reverse shell.