search

byt3bl33d3r / SILENTTRINITY

An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR
GNU General Public License v3.0
2.2k stars 405 forks source link

HTA stager #34

Open RealHarshThakur opened 5 years ago

RealHarshThakur commented 5 years ago

Hey, Is it possible to add mshta based exploits? Generating html applications and running it with mshta shouldn't be a problem, I guess.

RayofLightz commented 5 years ago

What do you mean, like a payload that calls back to mshta.exe or a stagger that uses mshta.exe to get the agent on to the system?

RealHarshThakur commented 5 years ago

Stager to get the agent.

RayofLightz commented 5 years ago

So in one of the scripts you can use ActiveXObject to call cmd and call code. It is not the most clean solution but maybe you could grab and execute a msbuild stagger using a hta.

RealHarshThakur commented 5 years ago

Can you specify which script you're talking about?

RealHarshThakur commented 5 years ago

Using ActiveXObject , do you mean by creating wscript.shell object ? Won't that require the site to be in Trusted sites?

RayofLightz commented 5 years ago

You are talking about an hta correct. Htas are html applications. They live on local disk and are run inside of an stripped down IE window. The code that gets run is using ActiveXObject. The scripting languages can be either visualbasic or javascript. The issues is that ActiveXObject is limited to COM objects. Using wscript.shell is the only way I can think of being able to create a stagger. Even though it would basically fall back onto another staging method. Unless there is a COM object that can be used to compile c# ?

RealHarshThakur commented 5 years ago

I think this could be done: when the malicious executable runs, it could get the shell and run "mshta 'url of the hta'" .

byt3bl33d3r commented 5 years ago

this is already on my to do list :)