Windows Script Host (WSH)

Theory

Windows scripting host is a built-in Windows administration tool that runs batch files to automate and manage tasks within the operating system. It is a Windows native engine, cscript.exe (for command-line scripts) and wscript.exe (for UI scripts), which are responsible for executing various Microsoft Visual Basic Scripts (VBScript), including vbs and vbe.

Practice

Basic Usage

let's use the VBScript to run executable files. The following vbs code is to invoke the Windows calculator, proof that we can execute .exe files using the Windows native engine (WSH).

#openCalc.vbs
Set shell = WScript.CreateObject("Wscript.Shell")
shell.Run("C:\Windows\System32\calc.exe " & WScript.ScriptFullName),0,True

We can now execute the vbs script on the target machine

cscript.exe c:\Users\Veresk\Desktop\openCalc.vbs
wscript.exe c:\Users\Veresk\Desktop\openCalc.vbs

A trick is to change the .vbs extension by a randomly choosen one.

wscript.exe /e:VBScript c:\Users\Veresk\Desktop\openCalc.odt

pubprn.vbs

Resources

WeaponizationTryHackMe

pubprn.vbs Signed Script Code Execution | Red Team Noteswww.ired.team