This should obviously only ever be done on computers you own or have express permission to attack. Programs exist to do this online but I will be doing it manually. hta files as droppers in order to import and execute malicious files onto a system. This is by no means a new tactic but it is something I had didn’t usually look at too much so decided to have an explore. When looking at this article I was reading about a spearfishing campaign conducted by APT41 using compressed HTML files (.chm). I like to read articles of current tactics used by Advanced Persistent Threat (APT) Groups. This one won’t be a htb write up though more a summary of a recent bit of study I undertook. hlp's (never-publicly-documented?) format.Now I have internet again I can catch up with the postings I have missed over the last few weeks. Here are products which run under Linux (among other platforms) and understand.

With NT (?) and earlier, Microsoft's help format was. PT: It's called the MS HTML Help 1.4 SDK and you can download it from and view the documentation there. You have to dig around in MSDN to find the package to download though. You can take a web site and turn it into a chm file quite easily. lexfiend : This and several other *nix-based CHM viewers uses the 'CHM lib' library, not to be confused with Matt Russotto's chmlib that can be found in his 'CHM tools' package. I tried it on a simple problem, and it worked and seemed to be easy to use. It has a simple and comprehensible interface that allow you to make CHM-files (with contents). It is free and can be downloaded from here.

Abee Chm Maker is a program for making chm-files.

A description of the file format can be found here.

Please add your own comments, tools and links. TJK: I'm no expert but the following items may be helpful to others. An alternative for Tcl developers is to use a Wikit in local mode as a help system. This page contains information on how to create Compiled Help Module (.chm) files for applications that run under Windows.

Make chm file