Preventing MSHTA vulnerabilities opens the door to remote control for hackers

This is a new vulnerability that allows hackers to be ecstatic. Once this vulnerability is activated, a large number of computers will become bots in hackers' hands. Remote Control is inevitable ......

Microsoft's Windows operating system, after a short period of "breathing", has recently been worked tirelessly by attackers to identify several high-risk system security vulnerabilities, the Microsoft Windows MSHTA Script Execution vulnerability is an important component.

Security Bulletin Board

MSHTA is HTA. The MS here is mainly used to emphasize that this is Microsoft's vulnerability. HTA's full name is HTML Application, which is an HTML Application, in fact, if you simply use "hta" to save HTML pages for the extension, you can create an HTA file. A lot of malicious code has been used in the past, but with the increasing security awareness of users and the blacklist of security vendors, these files containing the HTA Code are not as destructive as before. However, the Windows MSHTA Script Execution vulnerability has enabled Pandora's magic box again, causing a nightmare to begin ......

Attackers can exploit this vulnerability to control the affected system, install malicious programs, manage system files, or create an administrator account with full control permissions.

Principle

Microsoft HTML Application Host (MSHTA) is part of the Microsoft Windows operating system and must be used to execute the HTA file. The remote code execution vulnerability exists in Windows Shell because the system cannot correctly identify the associated program of the file.

In fact, simply put, the Windows system encountered a problem when processing file-related programs. For example, if you want to use Winamp to open a file suffixed with "mp3", but you fail to call the Winamp program correctly and call another program to open this "mp3" file. This vulnerability occurs. After a user runs a malicious file, the system will call MSHTA to open the file. If the file contains HTA code, the system will immediately execute the code, this causes various security problems.

1 2 3 Next Page