Yes, this is totally possible and pretty easy to accomplish - so long as you have an active exploit in the PDF viewer. Check out one of the many Adobe Acrobat Exploits in the Metasploit framework. Next you can use a download+exec shellcode to download and execute your payload, err I mean ".exe".
您可以嵌入 EXE 或任何其他格式的文件。但是，自动运行 EXE 的能力取决于查看器应用程序及其安全设置。此 PDF 功能已被许多恶意软件利用。因此，不能保证它适用于所有最终用户系统。请注意，如果您将此功能作为某些商业应用程序的一部分，那么安全软件很快就会将其标记为恶意软件，这可能会对您公司的声誉产生不利影响。
You can embed files with EXE or any other format. However, the ability to have the EXE run automatically depends on the viewer application and its security settings. This PDF feature has been exploited by many malware. So, there is no guarantee that it will work on all end-user systems. Be warned that if you make this feature a part of some commercial application, then security software will soon flag it as a malware, which can adversly affect your company's reputation.
Yes. Besides using an exploit, you can just paste the file in using Acrobat Professional. Acrobat allows you to add arbitrary attachments these days.
If you make your PDF files with pdflatex, you can embed any file using the embedfile package. I use this frequently to add all kinds of files to PDF files. They show up as attachments.
发布评论
评论（4）
是的，这是完全可能的，而且很容易完成 - 只要您在 PDF 查看器中进行了积极的利用。查看众多 Adobe Acrobat 漏洞 中的一个Metasploit 框架。接下来，您可以使用 download+exec shellcode 来下载并执行您的有效负载，呃，我的意思是“.exe”。
Yes, this is totally possible and pretty easy to accomplish - so long as you have an active exploit in the PDF viewer. Check out one of the many Adobe Acrobat Exploits in the Metasploit framework. Next you can use a download+exec shellcode to download and execute your payload, err I mean ".exe".
您可以嵌入 EXE 或任何其他格式的文件。但是，自动运行 EXE 的能力取决于查看器应用程序及其安全设置。此 PDF 功能已被许多恶意软件利用。因此，不能保证它适用于所有最终用户系统。请注意，如果您将此功能作为某些商业应用程序的一部分，那么安全软件很快就会将其标记为恶意软件，这可能会对您公司的声誉产生不利影响。
You can embed files with EXE or any other format. However, the ability to have the EXE run automatically depends on the viewer application and its security settings. This PDF feature has been exploited by many malware. So, there is no guarantee that it will work on all end-user systems. Be warned that if you make this feature a part of some commercial application, then security software will soon flag it as a malware, which can adversly affect your company's reputation.
是的。除了使用漏洞之外，您还可以使用 Acrobat Professional 粘贴文件。如今，Acrobat 允许您添加任意附件。
如果您使用
pdflatex制作 PDF 文件，则可以使用embedfile包嵌入任何文件。我经常使用它来将各种文件添加到 PDF 文件中。它们显示为附件。您还可以使用 Acrobat GUI 来完成此操作。
Yes. Besides using an exploit, you can just paste the file in using Acrobat Professional. Acrobat allows you to add arbitrary attachments these days.
If you make your PDF files with
pdflatex, you can embed any file using theembedfilepackage. I use this frequently to add all kinds of files to PDF files. They show up as attachments.You can also use the Acrobat GUI to do it.
简而言之，不。这些文件格式不提供在其中嵌入 Win32 PE 可执行文件的规定。
对于 Office 文件，您可以使用 VBA 编写在打开文档时运行的脚本。
In short, no. These file formats have no provision for embedding a Win32 PE executable inside of them.
For the Office files, you could use VBA to write a script that runs when the document is opened.