Through arbitrary code execution, a cybercriminal may acquire control of a target computer through some sort of vulnerability, thereby gaining the power to execute commands on that user’s computer at will. Programs that are designed to exploit software bugs or other vulnerabilities are called arbitrary code execution exploits. These types of exploits take advantage of software that allows the execution of machine code and instead injects shellcode to allow the attacker to run arbitrary commands on another’s computer. This type of attack is also known as remote code execution and can potentially allow the attacker to take complete control of the user’s machine. Malware commonly utilizes arbitrary code execution to run itself on a computer without the user’s consent.
Arbitrary code execution is often performed by taking control of a program’s instruction pointer, which points to the next line of code that is to be processed. By changing the instruction pointer to instead point to the attacker’s injected malicious code, it allows the injected code to be executed instead. Once this is accomplished, the attacker can then attempt a privilege escalation exploit in order to damage the computer or turn it into a zombie computer, which enables it to be used to perform various malicious tasks, including spreading email spam and launching denial-of-service attacks.