> For the complete documentation index, see [llms.txt](https://davidtancredi.gitbook.io/pentesting-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/exploitation-deprecated-node/client-side-attacks/html-application-attack.md).

# HTML application attack

Outdated attack vector but still possible in older unpatched systems

When a file ends with the .hta extension HTML will automatically interpret it as                                 an application and execute it.

For this reason .hta applications are run in an isolated context within the mshta.exe environment.

This attack is specific to Explorer.

**#Crafting the evil .hta file --> poc.hta**

![](https://3410633120-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV4VjgPvE4pGDuFNzpWxG%2Fuploads%2FKaMkCaF4SPCfxCdNYTbK%2F19.png?alt=media\&token=9004ec4f-93f7-46b0-8aee-515c9b254394)

**#Serve it from /var/www/html with Apache** 

![](https://3410633120-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV4VjgPvE4pGDuFNzpWxG%2Fuploads%2F0EEAJAN4C7VNniWQU9kE%2F20.png?alt=media\&token=89a422ea-e448-4998-8d73-dcc5a1baa9c2)

**#Click on run**

![](https://3410633120-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV4VjgPvE4pGDuFNzpWxG%2Fuploads%2FNjFjhaeUb4eKXdtHT6Ow%2F21.png?alt=media\&token=a0153502-5a3e-4075-a637-44feb79cc76b)

**#The malicious script will launch CMD on target**

![](https://3410633120-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV4VjgPvE4pGDuFNzpWxG%2Fuploads%2Fuc42faS87oSh0SvkpAbM%2F22.png?alt=media\&token=bd6fe921-b43f-4869-a0bb-81174575be78)

**#Get rid of the automatic blank window that pops up when the exploit is triggered**

![](https://3410633120-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV4VjgPvE4pGDuFNzpWxG%2Fuploads%2FoseFXvixFt9vof5fJ2j7%2F23.png?alt=media\&token=f2a97a93-0851-450a-9778-4ad5186e36c4)

**#Edit the poc.hta code to circumvent this issue**

![](https://3410633120-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV4VjgPvE4pGDuFNzpWxG%2Fuploads%2FuqmWFmaVImJuYcelka25%2F24.png?alt=media\&token=5042638c-0814-4a1e-93bf-e4f18949c260)

**#This will close the window once the script is triggered**

![](https://3410633120-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV4VjgPvE4pGDuFNzpWxG%2Fuploads%2FAf4uD0D6cYAUFAOizBS1%2F25.png?alt=media\&token=497850ea-5fe2-4e66-b461-68c13fac0370)