I know how a buffer overflow works on a local network against an application running on a TCP port, assuming it doesn't drop the connection, but I would like some advice on an "exploit" I would like to try to develop. I would like to do a buffer overflow on word by injecting the appropriate script into the macro of a word doc and then sending it to the victim. I am wondering a few things. One, is this even possible? In answering this question, please disregard the fact that Word almost certainly has techniques of preventing this (ie disabling macros). Two, what software do I need to inject my script to the macro? And three, is is possible to write the program in Python and still have it work against a victim without Python on their computer?
Take the 2-minute tour
×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.
|
|
|
Why would you bother using a bufferoverflow when using Macros? It would be easier to just inject some VB script which does calls to, for instance, powershell (there is a really good exploitation framework here named PowerSploit). Exploits which do target bufferoverflows within Word, are a lot harder to find and exploit. If the target has EMET installed, you're immediately completely out of luck. |
|||||||||||||||||
|
