HTA stager about silenttrinity HOT 8 OPEN

What do you mean, like a payload that calls back to mshta.exe or a stagger that uses mshta.exe to get the agent on to the system?

from silenttrinity.

Stager to get the agent.

from silenttrinity.

So in one of the scripts you can use ActiveXObject to call cmd and call code. It is not the most clean solution but maybe you could grab and execute a msbuild stagger using a hta.

from silenttrinity.

Can you specify which script you're talking about?

from silenttrinity.

Using ActiveXObject , do you mean by creating wscript.shell object ?
Won't that require the site to be in Trusted sites?

from silenttrinity.

You are talking about an hta correct. Htas are html applications. They live on local disk and are run inside of an stripped down IE window. The code that gets run is using ActiveXObject. The scripting languages can be either visualbasic or javascript. The issues is that ActiveXObject is limited to COM objects. Using wscript.shell is the only way I can think of being able to create a stagger. Even though it would basically fall back onto another staging method. Unless there is a COM object that can be used to compile c# ?

from silenttrinity.

I think this could be done: when the malicious executable runs, it could get the shell and run "mshta 'url of the hta'" .

from silenttrinity.

this is already on my to do list :)

from silenttrinity.