实践——从fuzzing到0day漏洞挖掘

实践——从fuzzing到0day漏洞挖掘

环境及工具

windows 7 2 企业版 Peach Fuzzer WinDbg SocketSniff Easy File Sharing Web Server 6.8

实践

安装完就可以打开页面，开启SocketSniff进行监听，跟着以guest模式登录

跟着我们就可以捕捉到请求（其实这个用wireshark也是可以的啦）

GET /vfolder.ghp HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Referer: http://192.168.52.14/
Accept-Language: zh-C
User-Agent: Mozilla/5.0 (Windows T 6.1; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: 192.168.52.14
If-Modified-Since: Thu, 01 Mar 2018 08:00:1 GMT; length=15959
DT: 1
Connection: Keep-Alive
Cookie: SESSIOID=1796; UserID=; PassWD=

我们跟着作者fuzz最后一行——Cookie吧

接下来我们根据上面的请求编写Peach Pit，就是一个描述性的xml文件

<?xml version="1.0" encoding="utf-8"?>
<Peach xmlns="; xmlns:xsi=";
    xsi:schemaLocation=" ../peach.xsd">

    <DataModel name="DataVfolder">
            <String value="GET /vfolder.ghp" mutable="false" token="true"/>                 
            <String value=" HTTP/1.1" mutable="false" token="true"/>
            <String value="\r\n" mutable="false" token="true"/>

            <String value="User-Agent: " mutable="false" token="true"/>
            <String value="Mozilla/4.0" mutable="false" token="true"/>  
            <String value="\r\n" mutable="false" token="true"/>

            <String value="Host: 192.168.52.14" mutable="false" token="true"/>
            <String value="\r\n" mutable="false" token="true"/>

            <String value="Accept: " mutable="false" token="true"/>
            <String value="text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" mutable="false" token="true"/>  
            <String value="\r\n" mutable="false" token="true"/> 
            
            <String value="Accept-Language: " mutable="false" token="true"/>
            <String value="en-us" mutable="false" token="true"/>    
            <String value="\r\n" mutable="false" token="true"/>

            <String value="Accept-Encoding: " mutable="false" token="true"/>
            <String value="gzip, deflate" mutable="false" token="true"/>    
            <String value="\r\n" mutable="false" token="true"/>

            <String value="Referer: " mutable="false" token="true"/>
            <String value="http://192.168.52.14/" mutable="false" token="true"/> 
            <String value="\r\n" mutable="false" token="true"/>     

            <String value="Cookie: " mutable="false" token="true"/>
            <String value="SESSIOID=1796; " mutable="false" token="true"/>
            
            <!-- fuzz UserID -->
            <String value="UserID=" mutable="false" token="true"/>
            <String value="" />
            <String value="; " mutable="false" token="true"/>
            
            <!-- fuzz PassWD -->
            <String value="PassWD=" mutable="false" token="true"/>
            <String value="" />
            <String value="; " mutable="false" token="true"/>               
            <String value="\r\n" mutable="false" token="true"/>
            
            <String value="Conection: " mutable="false" token="true"/>
            <String value="Keep-Alive" mutable="false" token="true"/>   
            <String value="\r\n" mutable="false" token="true"/>
            <String value="\r\n" mutable="false" token="true"/>
    </DataModel>    
    
    <DataModel name="DataRespe">
        <!-- server reply, we don't care -->
        <String value="" />
    </DataModel>

    <StateModel name="StateVfolder" initialState="Initial">
        <State name="Initial">
            <Action type="output">
                <DataModel ref="DataVfolder"/>
            </Action>
            <Action type="input">
                <DataModel ref="DataRespe"/>
            </Action>
        </State>
    </StateModel>   

    <Agent name="LocalAgent">
        <Monitor class="WindowsDebugger">
            <Param name="CommandLine" value="C:\EFS Software\Easy File Sharing Web Server\"/>
            <Param name="WinDbgPath" value="C:\WinDDK\7600.1685.1\Debuggers" />  
        </Monitor>
        
        <!-- close the popup window asking us to buy the software before running tests --> 
        <Monitor class="PopupWatcher">
            <Param name="Windowames" value="Registration - unregistered"/>
        </Monitor>
    </Agent>

    <Test name="TestVfolder">
        <Agent ref="LocalAgent"/>
        <StateModel ref="StateVfolder"/>
        <Publisher class="TcpClient">
            <Param name="Host" value="192.168.52.14"/>
            <Param name="Port" value="80"/>
        </Publisher>
        
        <Logger class="File">
            <!-- save crash information in the Logs directory -->
            <Param name="Path" value="efswLogs"/>
        </Logger>
        
        <!-- use a finite number of test cases that test UserID first, followed by PassWD -->
        <Strategy class="Sequential" />

    </Test> 
</Peach>

之后输入命令就可以开始fuzz了（TestVfolder是跟Test的name一致）

 -DHOST=192.168.52.14 -DPORT=80 ./remotefuzz/efs_fuzz.xml TestVfolder

这软件垃圾，过不了几秒就蹦几个了

打开原始payload看看，一看就知道是缓冲区溢出了

reference

/