不可执行的漏洞利用是如何工作的？
您好，问题是不可执行的漏洞利用是如何工作的，当我说不可执行时，我指的是那些没有文件扩展名 .exe 的人，例如单词漏洞利用 .doc 或其他。如果没有编译，他们如何做出一些可执行的操作？
Hello the question is how works non executable exploit's, when i say non executable i mean those who don't have the file extension .exe, like word exploits .doc or other. How did they make some executable action if they are not compiled?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这因漏洞利用而异。
虽然 .doc 不是可执行格式，但它确实包含解释的 vba 代码，这通常是隐藏恶意内容的地方。当您打开文档时，将会触发 onOpen 事件或某些此类事件，该事件将执行恶意负载。因此，为什么现在大多数办公室安装都默认禁用宏，滥用的范围太大了。
还有很多东西可以在您的系统上运行，而不是 .exe，例如 .com , .vbs, .hta
然后，有些格式没有正常的可执行内容，但可以通过其他方式受到攻击，通常利用写得不好的例程来加载文件，这些文件可以允许诸如 缓冲区溢出
That varies from exploit to exploit.
While .doc isn't an executable format it does contain interpreted vba code which is generally where the malicious content was hidden. When you opened the document there would be an onOpen event or some such fired which would execute the malicious payload. Hence why most office installations have macro's disabled by default these days, far too much scope for abuse.
There are also plenty of things that will run on your system without being a .exe for example .com, .vbs, .hta
Then there are formats which have no normal executable content but can be attacked in other ways, usually taking advantage of poorly written routines to load the files which can allow things like buffer overflows
另一种方法是利用处理这些文件的代码中的错误。通常这将是“缓冲区溢出”。也许代码期望的标头为 100 字节，但恶意文件有 120 字节。这会导致程序覆盖其内存中的一些其他数据，如果您可以用额外的字节粉碎“堆栈”，则可以将处理器重定向到嵌入在文件中的“有效负载”代码。
谷歌“缓冲区溢出漏洞利用”了解更多信息。
The other way is to exploit bugs in the code that handles those files. Often this will be a 'buffer overflow'. Perhaps the code is expecting a header of 100 bytes, but the malicious file has 120 bytes. That causes the program to overwrite some other data in its memory, and if you can smash the 'stack' with your extra bytes it's possible to redirect the processor to a 'payload' code embedded in your file.
google "buffer overflow exploit" for more.