Successfully reported this slideshow.
Your SlideShare is downloading. ×

msutton-fuzzing.ppt

Ad
Ad
Ad
Ad
Ad
Ad
Ad
Ad
Ad
Ad
Ad
Loading in …3
×

Check these out next

1 of 41 Ad

More Related Content

Advertisement

msutton-fuzzing.ppt

  1. 1. Contains VeriSign Confidential and Proprietary Information Fuzzing Brute Force Vulnerability Discovery Michael Sutton Director, iDefense Labs msutton@idefense.com
  2. 2. 2 Contains VeriSign Confidential and Proprietary Information Agenda + Background ▪ What is fuzzing and who should do it? + Phases ▪ What are the various stages when fuzzing a target? + Fuzzer classes ▪ What can be fuzzed? + Automation ▪ Making the theoretical practical + Tools/Demos ▪ FileFuzz ▪ WebFuzz ▪ COMRaider + Advanced topics + The future or fuzzing
  3. 3. 3 Contains VeriSign Confidential and Proprietary Information Vulnerability Discovery Methodologies – White Box + “Also known as glass box, structural, clear box and open box testing. A software testing technique whereby explicit knowledge of the internal workings of the item being tested are used to select the test data.” ▪ Webopedia + Source code review ▪ Static analysis ▪ Pros – Coverage ▪ Cons – Dependencies – Are we testing reality? • Compiler issues • Implementation scenarios
  4. 4. 4 Contains VeriSign Confidential and Proprietary Information Vulnerability Discovery Methodologies – Black Box + “Also known as functional testing. A software testing technique whereby the internal workings of the item being tested are not known by the tester.” ▪ Webopedia + Reverse engineering ▪ Static analysis ▪ Pros – Complex vulnerabilities uncovered ▪ Cons – Time consuming – Deep knowledge required + Fuzzing ▪ Dynamic analysis ▪ Pros – Relatively simple – Realistic ▪ Cons – Coverage – Complex vulnerabilities missed
  5. 5. 5 Contains VeriSign Confidential and Proprietary Information What is Fuzzing? + “Fuzz testing or fuzzing is a software testing technique. The basic idea is to attach the inputs of a program to a source of random data ("fuzz"). If the program fails (for example, by crashing, or by failing built-in code assertions), then there are defects to correct. The great advantage of fuzz testing is that the test design is extremely simple, and free of preconceptions about system behavior.” ▪ Wikipedia + “Unexpected input causes unexpected results.” ▪ Michael Sutton
  6. 6. 6 Contains VeriSign Confidential and Proprietary Information Who should fuzz? + Security researchers ▪ Reactive + QA Teams ▪ Proactive + Developers ▪ Proactive Design Development Quality Assurance Production Researchers QA Teams Developers
  7. 7. 7 Contains VeriSign Confidential and Proprietary Information What can fuzzing do for you? + MS06-01 - Graphics Rendering Engine Vulnerability ▪ aka “Windows WMF Vulnerability” ▪ Appears to have been discovered through fuzzing ▪ Evidence – Google search on strings in initial exploit identified probable source file • JNK = c, Jun N, terminal, kitase • kitase  kinase – At the time, Google didn’t recognize WMF file types and therefore treated them as text allowing a search for strings within the binary – Diffing original file and exploit revealed evidence that fuzzing was used to discover the vulnerability AIF = apoptosis-inducing factor ANF = atrial natriuretic factor apaf = apoptotic protease-activating factor ARC = apoptosis repressor with caspase recruitment domain BH = bcl-2 homology CASH = caspase homologue CD = cluster of differentiation DED = death effector domain DR = death receptor ERK = extracellular signal-regulated kinase FADD = Fas-associated death domain protein FasL = Fas ligand FLAME-1 = FADD-like antiapoptotic molecule FLICE = FADD-homologous ICE/Ced-3-like protease FLIP = FLICE-inhibitory proteins I kappa B = inhibitor of NF kappa B I-FLICE = inhibitor of FLICE IAP = inhibitor of apoptosis protein ICE = interleukin-1 beta-converting enzyme IGF = insulin-like growth factor JNK = c-Jun N-terminal kinase MAPK = mitogen-activated protein kinase MEK = MAPK/ERK kinase MEKK = MEK kinase NF kappa B = nuclear factor kappa B NGF = nerve growth factor PI-3 kinase = phosphatidylinositol-3 kinase PKB, PKC = protein kinase B and C RAIDD = RIP-associated ICH-1/Ced-3- homologous death domain protein RIP = receptor-interaction protein SAPK = stress-activated protein kinase SEK = SAPK/ERK kinase TdT = terminal deoxynucleotidyltransferase TNF = tumor necrosis factor TNFR = TNF receptor TRADD = TNFR-associated death domain protein TRAF = TNFR-associated factor TRAIL = TNF-related apoptosis-inducing ligand TUNEL = TdT-mediated dUTP nick end- labeling zVAD.fmk = benzyloxycarbonyl-valine-alanine- aspartate fluoromethylketone
  8. 8. 8 Contains VeriSign Confidential and Proprietary Information Phases Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
  9. 9. 9 Contains VeriSign Confidential and Proprietary Information Fuzzer Classes + Command line arguments + Environment variables ▪ Sharefuzz (www.immunitysec.com) + Web applications ▪ WebFuzz (Demo) + File formats ▪ FileFuzz (Demo – labs.idefense.com) + Network protocols ▪ SPIKE (www.immunitysec.com) + Memory + COM Objects ▪ COMRaider (Demo – labs.idefense.com) + Inter-Process Communication (IPC)
  10. 10. 10 Contains VeriSign Confidential and Proprietary Information Automation + Test cases ▪ Approach – Pre-generated test cases ▪ Tools – PROTOS Test Suites ▪ Pro – Consistency ▪ Con – Static – Time consuming
  11. 11. 11 Contains VeriSign Confidential and Proprietary Information Automation + Brute force fuzzing ▪ Approach – Raw byte manipulation ▪ Tool(s) – FileFuzz ▪ Pro – Simple ▪ Con – Inefficient – Fails to account for dependent values (e.g. checksums)
  12. 12. 12 Contains VeriSign Confidential and Proprietary Information Automation + ‘Intelligent’ fuzzing ▪ Approach – Templates developed based on protocol definitions ▪ Tools – SPIKE – SPIKEfile ▪ Pro – Efficient ▪ Con – Time consuming
  13. 13. 13 Contains VeriSign Confidential and Proprietary Information FileFuzz
  14. 14. 14 Contains VeriSign Confidential and Proprietary Information FileFuzz – Identify Target + Application vs. file type ▪ One file type  multiple targets + Vendor history ▪ Past vulnerabilities + High risk targets ▪ Default file handlers – Windows Explorer – Windows Registry ▪ Commonly traded file types – Media files – Office documents – Configuration files Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
  15. 15. 15 Contains VeriSign Confidential and Proprietary Information FileFuzz – Identify Inputs + Proprietary vs. open formats ▪ Vendor documents ▪ Wotsit.org ▪ Google + Binary files ▪ e.g. images, video, audio, office documents, etc. ▪ Headers vs. data + Text files ▪ e.g. *.ini, *.inf, *.xml ▪ Name/value pairs Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
  16. 16. 16 Contains VeriSign Confidential and Proprietary Information FileFuzz – Generate Fuzzed Data + Binary files ▪ Breadth (All or Range) – Identify potential weaknesses FF FF FF FF 00 00 DB FE 0B 00 C5 00 00 01 E8 03 ; ÿÿÿÿ..Ûþ..Å...è. D7 FF FF FF FF 00 DB FE 0B 00 C5 00 00 01 E8 03 ; ×ÿÿÿÿ.Ûþ..Å...è. D7 CD FF FF FF FF DB FE 0B 00 C5 00 00 01 E8 03 ; ×ÍÿÿÿÿÛþ..Å...è. ▪ Depth – Determine level of control/influence D7 CD FD 9A 00 00 DB FE 0B 00 C5 00 00 01 E8 03 ; ×Íýš..Ûþ..Å...è. D7 CD FE 9A 00 00 DB FE 0B 00 C5 00 00 01 E8 03 ; ×Íþš..Ûþ..Å...è. D7 CD FF 9A 00 00 DB FE 0B 00 C5 00 00 01 E8 03 ; ×Íÿš..Ûþ..Å...è. + Text Files ▪ name = value file_size = 10 file_size = AAAAA file_size = AAAAAAAAAA Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
  17. 17. 17 Contains VeriSign Confidential and Proprietary Information FileFuzz – Execute Fuzzed Data + Command line arguments ▪ Windows explorer – Tools…Folder Options…File Types Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
  18. 18. 18 Contains VeriSign Confidential and Proprietary Information FileFuzz – Monitor for Exceptions + Visual ▪ Error messages ▪ Blue screen + Event logs ▪ System logs ▪ Application logs + Debuggers + Return codes + Debugging API Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
  19. 19. 19 Contains VeriSign Confidential and Proprietary Information FileFuzz – Monitor for Exceptions + Execute ▪ Automated and repeated + Monitor ▪ Library - libdasm ▪ Capture – Memory location – Registry values – Exception type + Kill ▪ Set timeout Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability [*] "crash.exe" "C:Program FilesWordPerfect Office 12ProgramsUA120.exe" 2000 /qt c:fuzzast8.ast [*] Access Violation [*] Exception caught at 00403f06 mov eax,[eax+edi*4] [*] EAX:0014b1b8 EBX:00000005 ECX:00435c00 EDX:0012fbac [*] ESI:00435c00 EDI:cccccccc ESP:0012fab8 EBP:0012fae8
  20. 20. 20 Contains VeriSign Confidential and Proprietary Information FileFuzz – Determine Exploitability + Skills ▪ Disassembly ▪ Debugging + Vulnerability types ▪ Stack overflows ▪ Heap overflows ▪ Integer handling – Overflows – Signedness ▪ DoS – Out of bounds reads – Infinite loops – NULL pointer dereferences ▪ Logic errors – Windows WMF vulnerability (MS06-001) ▪ Format strings ▪ Race conditions Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
  21. 21. 21 Contains VeriSign Confidential and Proprietary Information FileFuzz – Demo (Breadth)
  22. 22. 22 Contains VeriSign Confidential and Proprietary Information FileFuzz – Demo (Depth)
  23. 23. 23 Contains VeriSign Confidential and Proprietary Information WebFuzz
  24. 24. 24 Contains VeriSign Confidential and Proprietary Information WebFuzz – Identify Target + Server vs. Application ▪ Targeting applications can uncover server vulnerabilities + Vendor history ▪ Past vulnerabilities + High risk targets ▪ Popular applications – Download site counters – Google queries (johnny.ihackstuff.com) ▪ External applications – Wikis – Web mail – Discussion boards – Blogs Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
  25. 25. 25 Contains VeriSign Confidential and Proprietary Information WebFuzz – Identify Inputs + Potential input vectors ▪ Method ▪ Request-URI ▪ Protocol ▪ Headers ▪ Cookies ▪ Post data + Reconnaissance ▪ Web forms ▪ Authentication ▪ Hidden fields ▪ Client side scripting + Manual Tools ▪ Proxies ▪ LiveHTTPHeaders + Automated Tools ▪ Spiders Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
  26. 26. 26 Contains VeriSign Confidential and Proprietary Information WebFuzz – Generate Fuzzed Data + Intelligent fuzzing ▪ Start with legitimate web request ▪ Build template to mutate requests + Request format + Fuzz Template Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability [Method] [Request-URI] HTTP/[Major Version].[Minor Version] [HTTP Headers] [Post Data] [Methods] /[Traversal]/page.html?x=[SQL]&y=[XSS] HTTP/1.1 Accept: */* Accept-Language: en-us Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1) Host: [Overflow] Proxy-Connection: Keep-Alive
  27. 27. 27 Contains VeriSign Confidential and Proprietary Information WebFuzz – Execute Fuzzed Data + Fuzz classes ▪ Directory traversal ▪ Format strings ▪ Overflow ▪ SQL Injection ▪ XSS Injection Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
  28. 28. 28 Contains VeriSign Confidential and Proprietary Information WebFuzz – Monitor for Exceptions + Execute ▪ Automated and repeated + Monitor ▪ HTML response – Error messages ▪ Raw response – User input ▪ Status codes + Kill ▪ Set timeout Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
  29. 29. 29 Contains VeriSign Confidential and Proprietary Information WebFuzz – Determine Exploitability + Skills ▪ HTTP ▪ HTML ▪ Client side scripting ▪ SQL + Vulnerability types ▪ Denial of service ▪ Cross site scripting (XSS) ▪ SQL injection ▪ Directory traversal/Weak access control ▪ Weak authentication ▪ Weak session management (cookies) ▪ Buffer overflow ▪ Improperly supported HTTP methods ▪ Remote Command Execution ▪ Remote Code Injection ▪ Vulnerable Libraries ▪ HTTP Request Splitting ▪ Format Strings Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
  30. 30. 30 Contains VeriSign Confidential and Proprietary Information WebFuzz - Demo
  31. 31. 31 Contains VeriSign Confidential and Proprietary Information COMRaider
  32. 32. 32 Contains VeriSign Confidential and Proprietary Information COMRaider – Identify Target + Client side attacks + Vendor history ▪ Past vulnerabilities + High risk targets ▪ Popular applications + Identify ActiveX controls ▪ Choose Active DLL or OCX file directly ▪ Scan a directory for registered COM servers ▪ Manually enter a GUID ▪ Choose from controls that should be loadable in IE Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
  33. 33. 33 Contains VeriSign Confidential and Proprietary Information COMRaider – Identify Inputs + Indentify fuzzable ActiveX controls ▪ Load and parse type library files (*.tlb) to enumerate interfaces or ▪ Create a live instance of the object to query and load interface information + Scriptable ActiveX controls ▪ Accessible by web servers via Internet Explorer – Controls marked as Safe for Scripting or implementing IObjectSafety – Controls support IDispatch or IDispatchEx interfaces Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
  34. 34. 34 Contains VeriSign Confidential and Proprietary Information COMRaider – Generate Fuzzed Data + Examine each function and identify variable types to determine fuzzing scenarios ▪ Supported – Ints – Longs – Doubles – Strings – Variants ▪ Not supported – Singles – Bytes – Bools + Dynamically created Windows Script Files (*.wsf) Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
  35. 35. 35 Contains VeriSign Confidential and Proprietary Information COMRaider – Execute Fuzzed Data + Windows Script Host (wscript.exe) used to execute *.wsf files Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
  36. 36. 36 Contains VeriSign Confidential and Proprietary Information COMRaider – Monitor for Exceptions + Execute ▪ Automated and repeated + Monitor ▪ Debugger - crashmon.dll – Record handled/unhandled exceptions ▪ Window logger – Record/clear error dialogs – Record modal windows + Kill ▪ 8 second timeout Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
  37. 37. 37 Contains VeriSign Confidential and Proprietary Information COMRaider – Determine Exploitability + Skills ▪ Disassembly ▪ Debugging + Distributed auditing ▪ Audit results uploaded to and downloaded from central MySQL server + Exceptions logged ▪ Exception code ▪ SEH chain ▪ Call stack ▪ Register values ▪ Recent/future opcodes ▪ Argument dump ▪ Stack dump Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
  38. 38. 38 Contains VeriSign Confidential and Proprietary Information COMRaider - Demo
  39. 39. 39 Contains VeriSign Confidential and Proprietary Information Advanced Topics + Fuzzing Frameworks + Automated structure identification + Fuzzer tracking (code coverage) + Intelligent exception detection and processing
  40. 40. 40 Contains VeriSign Confidential and Proprietary Information The Future of Fuzzing + Tools ▪ Frameworks ▪ Integrated test environments ▪ Commercial tools + People ▪ Wider audience ▪ Proactive fuzzing – the shift from offense to defense
  41. 41. 41 Contains VeriSign Confidential and Proprietary Information Questions

×