Exploit Windows using PowerShell attack

msf > use exploit/windows/misc/hta_server
This module hosts an HTML Application (HTA) that when opened will run a payload via Powershell. When a user navigates to the HTA file they will be prompted by IE twice before the payload is executed.

DEMO