ExpGen: A 2-Step Vulnerability Exploitability Evaluation Solution for Binary Programs under ASLR Environment
Source abstract
Abstract
Current automatic exploit generation solutions generally adopt an 1-step exploit generation philosophy and neglect the potential difference between analysis-time environment and runtime environment. Therefore, they usually fail in evaluating exploitability for vulnerable programs running in an ASLR environment. We propose ExpGen, a 2-step vulnerability-exploitability evaluation solution for binary programs running in an ASLR environment, with three novel techniques introduced, separately partial-exploit sensitive-POC generation, exploitation context sensitive analysis-time exploit generation, and runtime exploit relocation. ExpGen firstly generates an analysis-time exploit that can carry out all the desired exploitation steps through applying the first two techniques in an iterative manner, then dynamically gaps the address-space layout differences between the analysis-time environment and runtime environment by adopting the runtime exploit-relocation technique, making the analysis-time exploit dynamically adaptable to the runtime exploitation session. Using a benchmark containing six test programs, 10 CTF&RHG programs and four real-world applications with known vulnerabilities, we demonstrate that ExpGen can effectively generate partial exploit input that carries out some address-leakage event and provide a complete automated exploitability evaluation workflow on vulnerable programs running in the ASLR environment.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Security and Verification in Computing · Software Testing and Debugging Techniques · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
College of Electronic Engineering, National University of Defense Technology, Hefei 230037, China
Funding
National Key Research and Development Project of China
References (44)
Show source-provided references
1. Sutton, M., Greene, A., and Amini, P. (2007). Fuzzing: Brute Force Vulnerability Discovery, Addison-Wesley Professional.
2. The art, science, and engineering of fuzzing: A survey
3. Symbolic Execution and Program Testing10.1145/360248.360252 ↗
4. Cadar, C., Dunbar, D., and Engler, D.R. (2008, January 8–10). KLEE: Unassisted and Automatic Generation of High-coverage Tests for Complex Systems Programs. Proceedings of the 8th USENIX Conf. on Operating Systems Design and Implementation, USENIX Association, OSDI’08, San Diego, CA, USA.
5. (2022, April 21). American Fuzzy Lop. Available online: https://lcamtuf.coredump.cx/afl/.
6. Aschermann, C., Schumilo, S., Blazytko, T., Gawlik, R., and Holz, T. (2019, January 24–27). REDQUEEN: Fuzzing with Input-to-State Correspondence. Proceedings of the Symposium on Network and Distributed System Security (NDSS), San Diego, CA, USA.10.14722/ndss.2019.23371 ↗
7. Stephens, N., Grosen, J., Salls, C., Dutcher, A., Wang, R., Corbetta, J., Shoshitaishvili, Y., Kruegel, C., and Vigna, G. (2016, January 21–24). Driller: Augmenting Fuzzing Through Selective Symbolic Execution. Proceedings of the Proceedings 2016 Network and Distributed System Security Symposium, San Diego, CA, USA.10.14722/ndss.2016.23368 ↗
8. Yun, I., Lee, S., Xu, M., Jang, Y., and Kim, T. (2018, January 15–17). QSYM: A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing. Proceedings of the 27th USENIX Security Symposium (USENIX Security 18), Baltimore, MD, USA.
9. (2022, April 23). !Exploitable Crash Analyzer Version 1.6. Available online: https://www.microsoft.com/security/blog/2013/06/13/exploitable-crash-analyzer-version-1-6/.
10. He, L., Cai, Y., Hu, H., Su, P., Liang, Z., Yang, Y., Huang, H., Yan, J., Jia, X., and Feng, D. (November, January 30). Automatically assessing crashes from heap overflows. Proceedings of the 2017 32nd IEEE/ACM International Conference on Automated Software Engineering (ASE), Urbana, IL, USA.10.1109/ASE.2017.8115640 ↗
11. (2022, April 22). Cyber Grand Challenge (CGC) (Archived). Available online: https://www.darpa.mil/program/cyber-grand-challenge.
12. Huang, S.K., Huang, M.H., Huang, P.Y., Lai, C.W., Lu, H.L., and Leong, W.M. (2012, January 20–22). CRAX: Software Crash Analysis for Automatic Exploit Generation by Modeling Attacks as Symbolic Continuations. Proceedings of the 2012 IEEE Sixth International Conference on Software Security and Reliability, Aithersburg, MD, USA.10.1109/SERE.2012.20 ↗
13. (2022, April 23). Shellphish. Rex. Available online: https://github.com/angr/rex.
14. Cha, S.K., Avgerinos, T., Rebert, A., and Brumley, D. (2012, January 20–23). Unleashing Mayhem on Binary Code. Proceedings of the 2012 IEEE Symposium on Security and Privacy, San Francisco, CA, USA.10.1109/SP.2012.31 ↗
15. Satisfiability Modulo Theories
16. (2020, April 22). Address Space Layout Randomization. Available online: https://en.wikipedia.org/wiki/Address_space_layout_randomization.
17. Fioraldi, A., Maier, D., Eißfeldt, H., and Heuse, M. (2020, January 10–11). AFL++: Combining Incremental Steps of Fuzzing Research. Proceedings of the 14th USENIX Workshop on Offensive Technologies (WOOT 20), USENIX Association, Boston, MA, USA.
18. The S2E Platform: Design, Implementation, and Applications10.1145/2110356.2110358 ↗
19. (2020, April 22). Position-Independent Code. Available online: https://en.wikipedia.org/wiki/Position-independent_code.
20. (2020, April 22). Notes on Non-Executable Stack. Available online: https://web.ecs.syr.edu/~wedu/seed/Labs_12.04/Files/NX.pdf.
21. Huang, N., Huang, S.G., and Deng, Z.K. (2018, January 19–21). Automatic Detection of Stack Overflow Attack in Canary. Proceedings of the 8th International Conference on Instrumentation and Measurement, Computer, Communication and Control (IMCCC), Harbin, China.10.1109/IMCCC.2018.00293 ↗
22. Serebryany, K., Bruening, D., Potapenko, A., and Vyukov, D. (2012, January 13–15). AddressSanitizer: A Fast Address Sanity Checker. Proceedings of the 2012 USENIX Annual Technical Conference (USENIX ATC 12), Berkeley, CA, USA.
23. (2020, April 22). Return-to-Libc Attack. Available online: https://en.wikipedia.org/wiki/Return-to-libc_attack.
24. (2020, April 22). ret2text. Available online: https://www.ctfnote.com/pwn/linux-exploitation/rop/ret2text.
25. Gadient, A.J. (2019). Automated Exploitation of Fully Randomized Executables. [Ph.D. Thesis, Massachusetts Institute of Technology].
26. (2022, June 11). Global Offset Table (Processor-Specific). Available online: https://docs.oracle.com/cd/E19120-01/open.solaris/819-0690/6n33n7fe3/index.html.
27. (2022, April 22). Pwntools Github Repository. Available online: https://github.com/Gallopsled/pwntools.
28. De Moura, L., and Bjørner, N. (April, January 29). Z3: An efficient SMT solver. Proceedings of the International conference on Tools and Algorithms for the Construction and Analysis of Systems, Budapest, Hungary.
29. (2020, April 22). CQGameRHG2021ljb. Available online: https://github.com/chunqiugame/CQGame_RHG_2021ljb.
30. (2020, April 22). CQGameRHG. Available online: https://github.com/chunqiugame/CQGame_RHG.
31. A Pattern-Based Software Testing Framework for Exploitability Evaluation of Metadata Corruption Vulnerabilities
32. HAEPG: An Automatic Multi-hop Exploitation Generation Framework10.1007/978-3-030-52683-2_5 ↗
33. (2020, April 21). Honggfuzz. Available online: https://github.com/google/honggfuzz.
34. Bellard, F. (2005, January 10–15). QEMU, a Fast and Portable Dynamic Translator. Proceedings of the FREENIX Track: 2005 USENIX Annual Technical Conference, Anaheim, CA, USA.
35. (2020, April 22). Pin—A Dynamic Binary Instrumentation Tool. Available online: https://www.intel.com/content/www/us/en/developer/articles/tool/pin-a-dynamic-binary-instrumentation-tool.html.
36. Aschermann, C., Schumilo, S., Abbasi, A., and Holz, T. (2020, January 18–21). IJON: Exploring Deep State Spaces via Fuzzing. Proceedings of the 2020 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.10.1109/SP40000.2020.00117 ↗
37. Chen, P., and Chen, H. (2018, January 20–24). Angora: Efficient Fuzzing by Principled Search. Proceedings of the 2018 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.10.1109/SP.2018.00046 ↗
38. Gan, S., Zhang, C., Chen, P., Zhao, B., Qin, X., Wu, D., and Chen, Z. (2020, January 12–14). GREYONE: Data Flow Sensitive Fuzzing. Proceedings of the 29th USENIX Security Symposium (USENIX Security 20), USENIX Association, Boston, MA, USA.
39. Wang, H., Xie, X., Li, Y., Wen, C., Li, Y., Liu, Y., Qin, S., Chen, H., and Sui, Y. (2020, January 5–11). Typestate-guided fuzzer for discovering use-after-free vulnerabilities. Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering, Seoul, Korea.10.1145/3377811.3380386 ↗
40. Brumley, D., Poosankam, P., Song, D., and Zheng, J. (2008, January 18–22). Automatic patch-based exploit generation is possible: Techniques and implications. Proceedings of the 2008 IEEE Symposium on Security and Privacy (SP 2008), Oakland, CA, USA.10.1109/SP.2008.17 ↗
41. Avgerinos, T., Cha, S.K., Hao, B.L.T., and Brumley, D. (2011, January 6–9). AEG: Automatic Exploit Generation. Proceedings of the Network and Distributed System Security Symposium, San Diego, CA, USA.
42. Heelan, S., Melham, T., and Kroening, D. (2018, January 14–16). Automatic Heap Layout Manipulation for Exploitation. Proceedings of the 27th USENIX Security Symposium (USENIX Security 18), USENIX Association, Baltimore, MD, USA.
43. Wang, Y., Zhang, C., Xiang, X., Zhao, Z., Li, W., Gong, X., Liu, B., Chen, K., and Zou, W. (2018, January 15–19). Revery: From Proof-of-Concept to Exploitable. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, Toronto, ON, Canada.10.1145/3243734.3243847 ↗
44. Wang, Y., Zhang, C., Zhao, Z., Zhang, B., Gong, X., and Zou, W. (2021, January 11–13). MAZE: Towards Automated Heap Feng Shui. Proceedings of the 30th USENIX Security Symposium (USENIX Security 21), USENIX Association, virtual.