Jscript Shellcode Runner
Now that we have the C# shellcode runner working,
we must modify the ExampleAssembly project in DotNetToJscript
to execute the shellcode runner
instead of the previous simple proof of concept code.
We’ll also generate a Jscript file
with the compiled assembly so we can launch the shellcode runner
directly from Jscript.
We start by adding the needed namespaces at the beginning of the project.
As mentioned earlier, any declarations using DllImport
must be placed in the relevant class, but outside the method it is used in.
In this case, we need to put them in the TestClass class.
Next, we’ll add the same shellcode and method calls
inside the TestClass method
as in our standalone project.
Before we compile the ExampleAssembly project,
we need to specify the x64 platform.
After compilation,
we need to copy the compiled DLL into the same folder as DotNetToJscript.exe
on the Windows 10 development machine.
Now that we have our updated DLL in place,
we start our listener again.
Now we’ll invoke DotNetToJScript.exe
with the same arguments as earlier,
telling it to use version 4 of the .NET framework
and output a Jscript file.
With our multi/handler set up, we can double-click the Jscript file.
After a brief pause,
we should receive the staged reverse Meterpreter shell.
Very nice.
We have successfully leveraged Jscript
to deliver an arbitrary C# assembly,
which in our case is a shellcode runner.