Jscript Meterpreter Dropper
Next, we’ll expand our usage of Jscript
to create a dropper that downloads a Meterpreter executable
from our Kali Linux web server and executes it.
This will require several components.
First, we’ll use msfvenom to generate a 64-bit Meterpreter
reverse HTTPS executable named met.exe and save it to our Kali web root.
We’ll also set up a Metasploit multi/handler to catch the session.
With our executable generated and our handler waiting,
let’s begin building our dropper code.
We’ll start with a simple HTTP GET request from Jscript.
To do that, we can use the MSXML2.XMLHTTP object,
which is based on the Microsoft XML Core Services,
and its associated HTTP protocol parser.
This object provides client-side protocol support to communicate with HTTP servers
and is present in all modern versions of Windows.
Here we use the CreateObject method of the Windows Script Host
to instantiate the MSXML2.XMLHTTP object,
and then use Open and Send methods to perform an HTTP GET request.
The Open method takes three arguments.
The first is the HTTP method, which in our case is GET.
The second argument is the URL,
and the third argument indicates whether the request should be synchronous.
To summarize our code,
we’ll use the url variable to set the URL of the Meterpreter executable.
Then we’ll create a Windows Script MSXML2.XMLHTTP object,
and call the Open method on that object to specify a GET request along with the URL.
Finally, we’ll send the GET request to download the file.
Now that we have sent the HTTP GET request, we’ll perform two actions.
The first is to detect if the request was successful.
This can be done by checking the Status property of the object
and comparing it to the value “200”, the HTTP OK status code.
We can do this with an if statement:
After receiving a successful status, we’ll create a Stream object
and copy the HTTP response into it for further processing.
The Stream object is instantiated from ADODB.Stream
through the CreateObject method.
Next, we’ll invoke Open on the Stream object
and begin editing the properties of the stream.
First, we'll set the Type property to adTypeBinary
with its numerical representation of "1" to indicate we are using binary content.
Next, we’ll call the Write method to save the ResponseBody,
which is our Meterpreter executable, to the stream.
Finally, we’ll reset the Position property to “0”
to instruct the Stream to point to the beginning of its content.
So far, we have sent a GET request for our met.exe file,
and have validated that the request was successful.
Next, we wrote the binary content to our ADODB stream.
With the content stored in the Stream object,
we must create a file and write the binary content to it.
To do that, we use the SaveToFile method.
This method takes two arguments: the first is the filename
and second are the save options, SaveOptionsEnum.
We’ll set thefilename to met.exe,
and set the SaveOptionsEnum to adSaveCreateOverWrite,
with the numerical value of “2” to force a file overwrite.
After we perform the SaveToFile action, we need to Close the Stream object.
As a final step, we’ll reuse the Windows Script Host Shell
to execute the newly written Meterpreter executable.
After saving this code as a .js file,
all we need to do is double-click it,
to get a 64-bit shell from the victim’s machine
to our awaiting multi/handler listener.
Now that we’ve covered the basics of Jscript, we’ll again expand our tradecraft
to implement an in-memory shellcode runner.
Unfortunately, there is no way to implement this directly in Jscript
so we must rely on a second language.