Jscript and C#
To improve our Jscript tradecraft, and run our payload completely from memory,
we’ll again invoke Win32 APIs just as we did in the Microsoft Office module.
Previously, we used PowerShell for this.
However, security solution providers, including Microsoft,
have tried to take steps against malicious use of it.
In this module, we will instead leverage C#
which has, until recently, not been in the spotlight.
Since there’s no known way to invoke the Win32 APIs directly from Jscript,
we’ll instead embed a compiled C# assembly
in the Jscript file and execute it.
This will give us the same capabilities as
PowerShell since we will have comparable access to the .NET framework.
Before we build this,
let’s cover some basics of the C# development environment,
Visual Studio,
which is already installed on the Windows 10 development machine.