demiguise

demiguise copied to clipboard

The link to the original blog post is broken. It seems to have moved to: https://research.nccgroup.com/2017/08/08/smuggling-hta-files-in-internet-explorer-edge/

rxwx

Hi `nccgroup/demiguise`! This is a one-off automatically generated pull request from LGTM.com :robot:. You might have heard that we’ve integrated LGTM’s underlying CodeQL analysis engine natively into GitHub. The result...

lgtm-com[bot]

Not working as expected, generate hta using following command > python demiguise.py -k hello -c "cmd.exe /c calc.exe" -p ShellBrowserWindow -o test.hta But it returns following error 

p-g-krish

🏆 congrats Rich!

itsreallynick

hello nccgroup

1

i was wondering where i can find "encryption-key" i have created an HTA file with metasploit i'll get into the file and send u a text tell me where's the...

aymenem

How to use it? A ```-c calc.exe``` won't work. Same for ```-c c:\\tmp\\calc.xll```, where the xll is created according to https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52. Thanks!

jeroen-80

Does not work on Windows 7 because neither `atob` or `Blob` is defined

1

Hi there, Have you tried to execute the generated HTA on Windows 7? atob and Blob are only defined in IE10+, which caused mshta on Windows 7 to fail

CaledoniaProject

Hello, when the HTA file runs, an error appears and the script is not executed. I tried with my own HTA file, and the issue still remains the same. The...

shellchocolat

Add a "Custom" payload to allow user-provided HTA file through "--command" parameter This might answer issue #5

qlemaire

Additions allows spaces in commands, and parsing these correctly for given payload types.

s3c