![19
Contains VeriSign Confidential and Proprietary Information
FileFuzz – Monitor for Exceptions
+ Execute
▪ Automated and repeated
+ Monitor
▪ Library - libdasm
▪ Capture
– Memory location
– Registry values
– Exception type
+ Kill
▪ Set timeout
Identify target
Identify inputs
Generate fuzzed data
Execute fuzzed data
Monitor for exceptions
Determine exploitability
[*] "crash.exe" "C:Program FilesWordPerfect Office
12ProgramsUA120.exe" 2000 /qt c:fuzzast8.ast
[*] Access Violation
[*] Exception caught at 00403f06 mov eax,[eax+edi*4]
[*] EAX:0014b1b8 EBX:00000005 ECX:00435c00 EDX:0012fbac
[*] ESI:00435c00 EDI:cccccccc ESP:0012fab8 EBP:0012fae8](https://image.slidesharecdn.com/msutton-fuzzing-221208083831-adb2cd8f/85/msutton-fuzzing-ppt-19-320.jpg)
![26
Contains VeriSign Confidential and Proprietary Information
WebFuzz – Generate Fuzzed Data
+ Intelligent fuzzing
▪ Start with legitimate web request
▪ Build template to mutate requests
+ Request format
+ Fuzz Template
Identify target
Identify inputs
Generate fuzzed data
Execute fuzzed data
Monitor for exceptions
Determine exploitability
[Method] [Request-URI] HTTP/[Major Version].[Minor Version]
[HTTP Headers]
[Post Data]
[Methods] /[Traversal]/page.html?x=[SQL]&y=[XSS] HTTP/1.1
Accept: */*
Accept-Language: en-us
Pragma: no-cache
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;
SV1; InfoPath.1)
Host: [Overflow]
Proxy-Connection: Keep-Alive](https://image.slidesharecdn.com/msutton-fuzzing-221208083831-adb2cd8f/85/msutton-fuzzing-ppt-26-320.jpg)
msutton-fuzzing.ppt
- 1. Contains VeriSign Confidential and Proprietary Information Fuzzing Brute Force Vulnerability Discovery Michael Sutton Director, iDefense Labs msutton@idefense.com
- 2. 2 Contains VeriSign Confidential and Proprietary Information Agenda + Background ▪ What is fuzzing and who should do it? + Phases ▪ What are the various stages when fuzzing a target? + Fuzzer classes ▪ What can be fuzzed? + Automation ▪ Making the theoretical practical + Tools/Demos ▪ FileFuzz ▪ WebFuzz ▪ COMRaider + Advanced topics + The future or fuzzing
- 3. 3 Contains VeriSign Confidential and Proprietary Information Vulnerability Discovery Methodologies – White Box + “Also known as glass box, structural, clear box and open box testing. A software testing technique whereby explicit knowledge of the internal workings of the item being tested are used to select the test data.” ▪ Webopedia + Source code review ▪ Static analysis ▪ Pros – Coverage ▪ Cons – Dependencies – Are we testing reality? • Compiler issues • Implementation scenarios
- 4. 4 Contains VeriSign Confidential and Proprietary Information Vulnerability Discovery Methodologies – Black Box + “Also known as functional testing. A software testing technique whereby the internal workings of the item being tested are not known by the tester.” ▪ Webopedia + Reverse engineering ▪ Static analysis ▪ Pros – Complex vulnerabilities uncovered ▪ Cons – Time consuming – Deep knowledge required + Fuzzing ▪ Dynamic analysis ▪ Pros – Relatively simple – Realistic ▪ Cons – Coverage – Complex vulnerabilities missed
- 5. 5 Contains VeriSign Confidential and Proprietary Information What is Fuzzing? + “Fuzz testing or fuzzing is a software testing technique. The basic idea is to attach the inputs of a program to a source of random data ("fuzz"). If the program fails (for example, by crashing, or by failing built-in code assertions), then there are defects to correct. The great advantage of fuzz testing is that the test design is extremely simple, and free of preconceptions about system behavior.” ▪ Wikipedia + “Unexpected input causes unexpected results.” ▪ Michael Sutton
- 6. 6 Contains VeriSign Confidential and Proprietary Information Who should fuzz? + Security researchers ▪ Reactive + QA Teams ▪ Proactive + Developers ▪ Proactive Design Development Quality Assurance Production Researchers QA Teams Developers
- 7. 7 Contains VeriSign Confidential and Proprietary Information What can fuzzing do for you? + MS06-01 - Graphics Rendering Engine Vulnerability ▪ aka “Windows WMF Vulnerability” ▪ Appears to have been discovered through fuzzing ▪ Evidence – Google search on strings in initial exploit identified probable source file • JNK = c, Jun N, terminal, kitase • kitase kinase – At the time, Google didn’t recognize WMF file types and therefore treated them as text allowing a search for strings within the binary – Diffing original file and exploit revealed evidence that fuzzing was used to discover the vulnerability AIF = apoptosis-inducing factor ANF = atrial natriuretic factor apaf = apoptotic protease-activating factor ARC = apoptosis repressor with caspase recruitment domain BH = bcl-2 homology CASH = caspase homologue CD = cluster of differentiation DED = death effector domain DR = death receptor ERK = extracellular signal-regulated kinase FADD = Fas-associated death domain protein FasL = Fas ligand FLAME-1 = FADD-like antiapoptotic molecule FLICE = FADD-homologous ICE/Ced-3-like protease FLIP = FLICE-inhibitory proteins I kappa B = inhibitor of NF kappa B I-FLICE = inhibitor of FLICE IAP = inhibitor of apoptosis protein ICE = interleukin-1 beta-converting enzyme IGF = insulin-like growth factor JNK = c-Jun N-terminal kinase MAPK = mitogen-activated protein kinase MEK = MAPK/ERK kinase MEKK = MEK kinase NF kappa B = nuclear factor kappa B NGF = nerve growth factor PI-3 kinase = phosphatidylinositol-3 kinase PKB, PKC = protein kinase B and C RAIDD = RIP-associated ICH-1/Ced-3- homologous death domain protein RIP = receptor-interaction protein SAPK = stress-activated protein kinase SEK = SAPK/ERK kinase TdT = terminal deoxynucleotidyltransferase TNF = tumor necrosis factor TNFR = TNF receptor TRADD = TNFR-associated death domain protein TRAF = TNFR-associated factor TRAIL = TNF-related apoptosis-inducing ligand TUNEL = TdT-mediated dUTP nick end- labeling zVAD.fmk = benzyloxycarbonyl-valine-alanine- aspartate fluoromethylketone
- 8. 8 Contains VeriSign Confidential and Proprietary Information Phases Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
- 9. 9 Contains VeriSign Confidential and Proprietary Information Fuzzer Classes + Command line arguments + Environment variables ▪ Sharefuzz (www.immunitysec.com) + Web applications ▪ WebFuzz (Demo) + File formats ▪ FileFuzz (Demo – labs.idefense.com) + Network protocols ▪ SPIKE (www.immunitysec.com) + Memory + COM Objects ▪ COMRaider (Demo – labs.idefense.com) + Inter-Process Communication (IPC)
- 10. 10 Contains VeriSign Confidential and Proprietary Information Automation + Test cases ▪ Approach – Pre-generated test cases ▪ Tools – PROTOS Test Suites ▪ Pro – Consistency ▪ Con – Static – Time consuming
- 11. 11 Contains VeriSign Confidential and Proprietary Information Automation + Brute force fuzzing ▪ Approach – Raw byte manipulation ▪ Tool(s) – FileFuzz ▪ Pro – Simple ▪ Con – Inefficient – Fails to account for dependent values (e.g. checksums)
- 12. 12 Contains VeriSign Confidential and Proprietary Information Automation + ‘Intelligent’ fuzzing ▪ Approach – Templates developed based on protocol definitions ▪ Tools – SPIKE – SPIKEfile ▪ Pro – Efficient ▪ Con – Time consuming
- 13. 13 Contains VeriSign Confidential and Proprietary Information FileFuzz
- 14. 14 Contains VeriSign Confidential and Proprietary Information FileFuzz – Identify Target + Application vs. file type ▪ One file type multiple targets + Vendor history ▪ Past vulnerabilities + High risk targets ▪ Default file handlers – Windows Explorer – Windows Registry ▪ Commonly traded file types – Media files – Office documents – Configuration files Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
- 15. 15 Contains VeriSign Confidential and Proprietary Information FileFuzz – Identify Inputs + Proprietary vs. open formats ▪ Vendor documents ▪ Wotsit.org ▪ Google + Binary files ▪ e.g. images, video, audio, office documents, etc. ▪ Headers vs. data + Text files ▪ e.g. *.ini, *.inf, *.xml ▪ Name/value pairs Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
- 16. 16 Contains VeriSign Confidential and Proprietary Information FileFuzz – Generate Fuzzed Data + Binary files ▪ Breadth (All or Range) – Identify potential weaknesses FF FF FF FF 00 00 DB FE 0B 00 C5 00 00 01 E8 03 ; ÿÿÿÿ..Ûþ..Å...è. D7 FF FF FF FF 00 DB FE 0B 00 C5 00 00 01 E8 03 ; ×ÿÿÿÿ.Ûþ..Å...è. D7 CD FF FF FF FF DB FE 0B 00 C5 00 00 01 E8 03 ; ×ÍÿÿÿÿÛþ..Å...è. ▪ Depth – Determine level of control/influence D7 CD FD 9A 00 00 DB FE 0B 00 C5 00 00 01 E8 03 ; ×Íýš..Ûþ..Å...è. D7 CD FE 9A 00 00 DB FE 0B 00 C5 00 00 01 E8 03 ; ×Íþš..Ûþ..Å...è. D7 CD FF 9A 00 00 DB FE 0B 00 C5 00 00 01 E8 03 ; ×Íÿš..Ûþ..Å...è. + Text Files ▪ name = value file_size = 10 file_size = AAAAA file_size = AAAAAAAAAA Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
- 17. 17 Contains VeriSign Confidential and Proprietary Information FileFuzz – Execute Fuzzed Data + Command line arguments ▪ Windows explorer – Tools…Folder Options…File Types Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
- 18. 18 Contains VeriSign Confidential and Proprietary Information FileFuzz – Monitor for Exceptions + Visual ▪ Error messages ▪ Blue screen + Event logs ▪ System logs ▪ Application logs + Debuggers + Return codes + Debugging API Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
- 19. 19 Contains VeriSign Confidential and Proprietary Information FileFuzz – Monitor for Exceptions + Execute ▪ Automated and repeated + Monitor ▪ Library - libdasm ▪ Capture – Memory location – Registry values – Exception type + Kill ▪ Set timeout Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability [*] "crash.exe" "C:Program FilesWordPerfect Office 12ProgramsUA120.exe" 2000 /qt c:fuzzast8.ast [*] Access Violation [*] Exception caught at 00403f06 mov eax,[eax+edi*4] [*] EAX:0014b1b8 EBX:00000005 ECX:00435c00 EDX:0012fbac [*] ESI:00435c00 EDI:cccccccc ESP:0012fab8 EBP:0012fae8
- 20. 20 Contains VeriSign Confidential and Proprietary Information FileFuzz – Determine Exploitability + Skills ▪ Disassembly ▪ Debugging + Vulnerability types ▪ Stack overflows ▪ Heap overflows ▪ Integer handling – Overflows – Signedness ▪ DoS – Out of bounds reads – Infinite loops – NULL pointer dereferences ▪ Logic errors – Windows WMF vulnerability (MS06-001) ▪ Format strings ▪ Race conditions Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
- 21. 21 Contains VeriSign Confidential and Proprietary Information FileFuzz – Demo (Breadth)
- 22. 22 Contains VeriSign Confidential and Proprietary Information FileFuzz – Demo (Depth)
- 23. 23 Contains VeriSign Confidential and Proprietary Information WebFuzz
- 24. 24 Contains VeriSign Confidential and Proprietary Information WebFuzz – Identify Target + Server vs. Application ▪ Targeting applications can uncover server vulnerabilities + Vendor history ▪ Past vulnerabilities + High risk targets ▪ Popular applications – Download site counters – Google queries (johnny.ihackstuff.com) ▪ External applications – Wikis – Web mail – Discussion boards – Blogs Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
- 25. 25 Contains VeriSign Confidential and Proprietary Information WebFuzz – Identify Inputs + Potential input vectors ▪ Method ▪ Request-URI ▪ Protocol ▪ Headers ▪ Cookies ▪ Post data + Reconnaissance ▪ Web forms ▪ Authentication ▪ Hidden fields ▪ Client side scripting + Manual Tools ▪ Proxies ▪ LiveHTTPHeaders + Automated Tools ▪ Spiders Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
- 26. 26 Contains VeriSign Confidential and Proprietary Information WebFuzz – Generate Fuzzed Data + Intelligent fuzzing ▪ Start with legitimate web request ▪ Build template to mutate requests + Request format + Fuzz Template Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability [Method] [Request-URI] HTTP/[Major Version].[Minor Version] [HTTP Headers] [Post Data] [Methods] /[Traversal]/page.html?x=[SQL]&y=[XSS] HTTP/1.1 Accept: */* Accept-Language: en-us Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1) Host: [Overflow] Proxy-Connection: Keep-Alive
- 27. 27 Contains VeriSign Confidential and Proprietary Information WebFuzz – Execute Fuzzed Data + Fuzz classes ▪ Directory traversal ▪ Format strings ▪ Overflow ▪ SQL Injection ▪ XSS Injection Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
- 28. 28 Contains VeriSign Confidential and Proprietary Information WebFuzz – Monitor for Exceptions + Execute ▪ Automated and repeated + Monitor ▪ HTML response – Error messages ▪ Raw response – User input ▪ Status codes + Kill ▪ Set timeout Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
- 29. 29 Contains VeriSign Confidential and Proprietary Information WebFuzz – Determine Exploitability + Skills ▪ HTTP ▪ HTML ▪ Client side scripting ▪ SQL + Vulnerability types ▪ Denial of service ▪ Cross site scripting (XSS) ▪ SQL injection ▪ Directory traversal/Weak access control ▪ Weak authentication ▪ Weak session management (cookies) ▪ Buffer overflow ▪ Improperly supported HTTP methods ▪ Remote Command Execution ▪ Remote Code Injection ▪ Vulnerable Libraries ▪ HTTP Request Splitting ▪ Format Strings Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
- 30. 30 Contains VeriSign Confidential and Proprietary Information WebFuzz - Demo
- 31. 31 Contains VeriSign Confidential and Proprietary Information COMRaider
- 32. 32 Contains VeriSign Confidential and Proprietary Information COMRaider – Identify Target + Client side attacks + Vendor history ▪ Past vulnerabilities + High risk targets ▪ Popular applications + Identify ActiveX controls ▪ Choose Active DLL or OCX file directly ▪ Scan a directory for registered COM servers ▪ Manually enter a GUID ▪ Choose from controls that should be loadable in IE Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
- 33. 33 Contains VeriSign Confidential and Proprietary Information COMRaider – Identify Inputs + Indentify fuzzable ActiveX controls ▪ Load and parse type library files (*.tlb) to enumerate interfaces or ▪ Create a live instance of the object to query and load interface information + Scriptable ActiveX controls ▪ Accessible by web servers via Internet Explorer – Controls marked as Safe for Scripting or implementing IObjectSafety – Controls support IDispatch or IDispatchEx interfaces Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
- 34. 34 Contains VeriSign Confidential and Proprietary Information COMRaider – Generate Fuzzed Data + Examine each function and identify variable types to determine fuzzing scenarios ▪ Supported – Ints – Longs – Doubles – Strings – Variants ▪ Not supported – Singles – Bytes – Bools + Dynamically created Windows Script Files (*.wsf) Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
- 35. 35 Contains VeriSign Confidential and Proprietary Information COMRaider – Execute Fuzzed Data + Windows Script Host (wscript.exe) used to execute *.wsf files Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
- 36. 36 Contains VeriSign Confidential and Proprietary Information COMRaider – Monitor for Exceptions + Execute ▪ Automated and repeated + Monitor ▪ Debugger - crashmon.dll – Record handled/unhandled exceptions ▪ Window logger – Record/clear error dialogs – Record modal windows + Kill ▪ 8 second timeout Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
- 37. 37 Contains VeriSign Confidential and Proprietary Information COMRaider – Determine Exploitability + Skills ▪ Disassembly ▪ Debugging + Distributed auditing ▪ Audit results uploaded to and downloaded from central MySQL server + Exceptions logged ▪ Exception code ▪ SEH chain ▪ Call stack ▪ Register values ▪ Recent/future opcodes ▪ Argument dump ▪ Stack dump Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
- 38. 38 Contains VeriSign Confidential and Proprietary Information COMRaider - Demo
- 39. 39 Contains VeriSign Confidential and Proprietary Information Advanced Topics + Fuzzing Frameworks + Automated structure identification + Fuzzer tracking (code coverage) + Intelligent exception detection and processing
- 40. 40 Contains VeriSign Confidential and Proprietary Information The Future of Fuzzing + Tools ▪ Frameworks ▪ Integrated test environments ▪ Commercial tools + People ▪ Wider audience ▪ Proactive fuzzing – the shift from offense to defense
- 41. 41 Contains VeriSign Confidential and Proprietary Information Questions