AEMB: An Automated Exploit Mitigation Bypassing Solution
Source abstract
Abstract
Modern operating systems set exploit mitigations to thwart the exploit, which has also become a barrier to automated exploit generation (AEG). Many current AEG solutions do not fully account for exploit mitigations, and as a result, they are unable to accurately assess the exploitability of vulnerabilities in such settings.This paper proposes AEMB, an automated solution for bypassing exploit mitigations and generating useable exploits (EXPs). Initially, AEMB identifies exploit mitigations in the system based on characteristics of the program execution environment. Then, AEMB implements exploit mitigations bypassing the payload generation by modeling expert experience and constructs the corresponding constraints. Next, during the program’s execution, AEMB uses symbol execution to collect symbol information and create exploit constraints. Finally, AEMB utilizes a solver to solve the constraints, including payload constraints and exploit constraints, to generate the EXP. In this paper, we evaluated a prototype of AEMB on six test programs and seven real-world applications. Furthermore, we conducted 54 sets of experiments on six different combinations of exploit mitigations. Experiment results indicate that AEMB can automatically overcome exploit mitigations and produce successful exploits for 11 out of 13 applications.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Security and Verification in Computing · Advanced Malware Detection Techniques · Software Testing and Debugging Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
College of Electronic Engineering, National University of Defense Technology, Hefei 230037, China
Funding
National Key Research and Development Project of China
References (37)
Show source-provided references
1. Lyu, Q., Zhang, D., Da, R., and Zhang, H. (2021). ReFuzz: A Remedy for Saturation in Coverage-Guided Fuzzing. Electronics, 10.10.3390/electronics10161921 ↗
2. Kim, Y., and Yoon, J. (2021). MaxAFL: Maximizing Code Coverage with a Gradient-Based Optimization Technique. Electronics, 10.10.3390/electronics10010011 ↗
3. Manès, V.J.M., Han, H., Han, C., Cha, S.K., Egele, M., Schwartz, E.J., and Woo, M. (2019). The art, science, and engineering of fuzzing: A survey. IEEE Trans. Softw. Eng.
4. Automatic exploit generation10.1145/2560217.2560219 ↗
5. Brumley, D., Poosankam, P., Song, D., and Zheng, J. (2008, January 18–22). Automatic patch-based exploit generation is possible: Techniques and implications. Proceedings of the 2008 IEEE Symposium on Security and Privacy (sp 2008), Oakland, CA, USA.10.1109/SP.2008.17 ↗
6. Huang, S.K., Huang, M.H., Huang, P.Y., Lai, C.W., Lu, H.L., and Leong, W.M. (2012, January 20–22). Crax: Software crash analysis for automatic exploit generation by modeling attacks as symbolic continuations. Proceedings of the 2012 IEEE Sixth International Conference on Software Security and Reliability, Gaithersburg, MD, USA.10.1109/SERE.2012.20 ↗
7. Cha, S.K., Avgerinos, T., Rebert, A., and Brumley, D. (2012, January 20–23). Unleashing mayhem on binary code. Proceedings of the 2012 IEEE Symposium on Security and Privacy, San Francisco, CA, USA.10.1109/SP.2012.31 ↗
8. Shellphish (2021, October 13). Rex. Available online: https://github.com/angr/rex.
9. Software crash analysis for automatic exploit generation on binary programs10.1109/TR.2014.2299198 ↗
10. Wang, Y., Zhang, C., Xiang, X., Zhao, Z., Li, W., Gong, X., Liu, B., Chen, K., and Zou, W. (2018, January 15–19). Revery: From proof-of-concept to exploitable. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, Toronto, ON, Canada.10.1145/3243734.3243847 ↗
11. Zhao, Z., Wang, Y., and Gong, X. (2020). HAEPG: An Automatic Multi-hop Exploitation Generation Framework. International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, Springer.10.1007/978-3-030-52683-2_5 ↗
12. S2E: A platform for In-Vivo multi-path analysis of software systems10.1145/1961296.1950396 ↗
13. Andersen, S., and Abella, V. (2021, October 13). Memory Protection Technologies. Available online: http://technet.microsoft.com/en-us/library/bb457155.aspx.
14. Aafer, Y. (2021, October 13). Notes on Non-Executable Stack. Available online: https://web.ecs.syr.edu/~wedu/seed/Labs_12.04/Files/NX.pdf.
15. Sotirov, A., and Dowd, M. (2021, October 13). Bypassing Browser Memory Protections in Windows Vista. Available online: https://www.blackhat.com/presentations/bh-usa-08/Sotirov_Dowd/bh08-sotirov-dowd.pdf.
16. Firmino, L. (2021, October 13). What Is the Difference between Exploit, Payload and Shellcode?. Available online: https://www.linkedin.com/pulse/what-difference-between-exploit-payload-shellcode-luiz.
17. De Moura, L., and Bjørner, N. (2008). Z3: An efficient SMT solver. International Conference on Tools and Algorithms for the Construction and Analysis of Systems, Springer.10.1007/978-3-540-78800-3_24 ↗
18. Robertson, C. (2021, October 13). /SAFESEH (Image has Safe Exception Handlers). Available online: https://docs.microsoft.com/en-us/cpp/build/reference/safeseh-image-has-safe-exception-handlers?view=msvc-160.
19. QEMU, a fast and portable dynamic translator
20. Klee: Unassisted and automatic generation of high-coverage tests for complex systems programs
21. (2021, October 13). CVE. Available online: https://cve.mitre.org/.
22. (2021, October 13). China National Vulnerability Database. Available online: https://www.cnvd.org.cn/.
23. Serna, F.J. (2021, October 13). The Info Leak Era on Software Exploitation. Black Hat USA. Available online: https://paper.bobylive.com/Meeting_Papers/BlackHat/USA-2012/BH_US_12_Serna_Leak_Era_Slides.pdf.
24. Designer, S. (2021, October 13). JPEG COM Marker Processing Vulnerability. Available online: https://www.openwall.com/articles/JPEG-COM-Marker-Vulnerability.
25. Ratanaworabhan, P., Livshits, V.B., and Zorn, B.G. (2009, January 15–19). NOZZLE: A Defense Against Heap-spraying Code Injection Attacks. Proceedings of the USENIX Security Symposium, Montreal, QC, Canada.
26. Eckert, M., Bianchi, A., Wang, R., Shoshitaishvili, Y., Kruegel, C., and Vigna, G. (2018, January 15–17). Heaphopper: Bringing bounded model checking to heap implementation security. Proceedings of the 27th USENIX Security Symposium (USENIX Security 18), Baltimore, MD, USA.
27. Yun, I., Kapil, D., and Kim, T. (2020, January 12–14). Automatic techniques to systematically discover new heap exploitation primitives. Proceedings of the 29th USENIX Security Symposium (USENIX Security 20), Virtual Event.
28. Wang, M., Su, P., Li, Q., Ying, L., Yang, Y., and Feng, D. (2013). Automatic polymorphic exploit generation for software vulnerabilities. International Conference on Security and Privacy in Communication Systems, Springer.10.1007/978-3-319-04283-1_14 ↗
29. Wang, Z., Zhang, Y., Tian, Z., Ruan, Q., Liu, T., Wang, H., Liu, Z., Lin, J., Fang, B., and Shi, W. (2019). Automated vulnerability discovery and exploitation in the Internet of Things. Sensors, 19.10.3390/s19153362 ↗
30. Wang, Y., Zhang, C., Zhao, Z., Zhang, B., Gong, X., and Zou, W. (2021). MAZE: Towards Automated Heap Feng Shui. 30th USENIX Security Symposium (USENIX Security 21), USENIX Association.
31. Shacham, H., Page, M., Pfaff, B., Goh, E.J., Modadugu, N., and Boneh, D. (2004, January 25–29). On the effectiveness of address-space randomization. Proceedings of the 11th ACM conference on Computer and Communications Security, Washington, DC, USA.10.1145/1030083.1030124 ↗
32. Control-flow integrity principles, implementations, and applications10.1145/1609956.1609960 ↗
33. Schwartz, E.J., Avgerinos, T., and Brumley, D. (2011, January 8–12). Q: Exploit Hardening Made Easy. Proceedings of the USENIX Security Symposium, San Francisco, CA, USA.
34. Hu, H., Chua, Z.L., Adrian, S., Saxena, P., and Liang, Z. (2015, January 8–12). Automatic generation of data-oriented exploits. Proceedings of the 24th USENIX Security Symposium (USENIX Security 15), Washington, DC, USA.
35. Di Federico, A., Cama, A., Shoshitaishvili, Y., Kruegel, C., and Vigna, G. (2015, January 8–12). How the ELF Ruined Christmas. Proceedings of the 24th USENIX Security Symposium (USENIX Security 15), Washington, DC, USA.
36. Fang, H., Wu, L., and Wu, Z. (2021, October 13). Automatic Return-to-dl-resolve Exploit Generation Method Based on Symbolic Execution. Available online: http://www.jsjkx.com/EN/10.11896/j.issn.1002-137X.2019.02.020.
37. Chen, K., Zhang, C., Yin, T., Chen, X., and Zhao, L. (2021, January 11–13). VScape: Assessing and Escaping Virtual Call Protections. Proceedings of the 30th USENIX Security Symposium (USENIX Security 21), Virtual Event.