Awesome_fuzzing_for _pentester_red-pill_2017

start
Awesome Fuzzing
for
Pen-tester
By Manich Koomsusi, OSCP, OSCE
Security Consultant

next2
#!/bin/Whoami
Name = Manich Koomsusi
Nick-Name = MarTy
Jobs = Security Consultant,
SnoopBees Co., Ltd.
FB = manich.koomsusi

Agenda
0x01 What is Fuzzing ?
next3
0x02 Fuzzing Techniques
0x03 Intelligent Mutation
0x05 Setup the Weapon
0x04 Sulley fuzzing framework
0x06 Demo Fuzzing HTTP and FTP
0x08 Q / A ?
0x07 Demo Fuzzing File Format

0x01
next
Fuzzing is simply a software testing
mechanism that sends malformed to
protocol implementation such as a web
application, file format PDF, MS Word
etc.
4
What is Fuzzing ?
Fuzzing is a useful research techniques
in identifying vulnerabilities
Fuzzing is an essential part of the
Software Development Lifecycle (SDL)

0x02
next
Static Test Case
• Information collection, Analyst
identifies individual tests
• Test case stored as a file that can
be sent to target, often binary file
• Lost of up-front development time
• Scope of the test limited by
creativity
5
Fuzzing Techniques
Randomized
• Starts with a valid frame
• Selected portions replaced with
randomized data
• Simple to develop and utilize
• No protocol knowledge needed
• Infinite run-time process
• Difficult to pin-point cause of crash

0x02
next
Mutation
• No protocol analysis
• Mutates one byte/short/long at a time
• History of success, But limited at
testing parsing flaws in string,
delimiters
• Quick to get started using fuzzing
tools
• Finite runtime stopping after it
exhausts all mutations
6
Fuzzing Techniques CONT.

0x02.1
next7
Sample Fuzzing Tools
Taof (The Art of Fuzzing)

0x02.2
next8

0x02.3
next9

0x03
next
• Describes a protocol and tests
permutations
• Protocol “grammar”
• Identifies fields
• Lots of up-front time analyzing
(Protocol is defined and uses
knowledge to build a protocol
“grammar”
• Best method for comprehensive code-
reaching tests
10
Intelligent Mutation

0x03.1
next
What to test ?
• Using intelligent mutation.
• Analyst selects permutations,
(selecting the fields and data
permutations for individual test
case)
• Randomly inserting new data will have
limited value in testing, discovering
only “Surface” vulnerabilities.
• For more comprehensive analysis,
(such as specific header fields)
11

0x03.2
next
What to test ?
• Signed and Unsigned Integers
• Signed integers => Positive(+) and
Negative(-)
• Unsigned integers => Positive(+) only
• MSB(Most Significant Bit) +/- when
signed
12
Value Signed Unsigned
1 1 1
-1 -1 4294967295
What happens ?
memcpy(destptr,srcptr,-1);

0x03.3
next
What to test ?
• Integer Underflow
13
Index Other declarations
-4 -3 -2 -1
<——————————————————————————— Array ———————————————————————>
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
Other memory

0x03.4
next
What to test ?
• Strings
14

0x03.5
next
What to test ?
• Field Delimiters
15

0x03.6
next
What to test ?
• Directory Transversal
16
What happens ?
“../../../../../../../../../../etc/passwd” ?

0x04
next17
Sulley Fuzzing Framework
Leveraging
• Framework for describing a protocol
(grammar)
• Delivers protocol mutations based on
grammar
- Monitors process, Log traffic
- Control VM’s to reset target
- Assists in analysis of crashes
• Written in python
• Full functionality in Windows only

0x04.1
next18
Setting Up
• Integrates with VMware restart and
snapshot
• Control over RPC protocol
• Multiple simultaneous target

0x04.2
next19
Sulley Functions with Fuzz HTTP
server GET request
RFC2616 - HTTP 1.1
GET /index.html HTTP/1.1
Host 192.168.1.31

0x04.3
next20
HTTP GET Request Initialization
• s_initialize()
• Fuzzer name
• Uses a global variable to
keep track

0x04.4
next21
HTTP GET Request Immutable
Values
• s_static()
• Data does not change

0x04.5
next22
HTTP GET Request Delimiters
s_delim()
• Specify a default value

0x04.6
next23
HTTP GET Request Strings
s_string()
• Mutations include
- Repetition (x2, x1000, …)
- String Omission
- Directory recursion(../../../)
- Format strings using (%n)
- Command injection(|calc)
- SQL injection (1;SELECT *)
- CR+LF x 1000
- NULL termination
- Binary strings (xdexad)

0x04.7
next24
HTTP GET Request Numbers
• Binary or ASCII
• 1/2/4/8 byte: s_byte(), s_short(),
s_long(), s_double()
- format = string => for ASCII output
- format = binary => for Binary
- endian = “<” => for little-endian
- endian = “>” => for big-endian
- test case +/- 10 border case near 0
- Maximum values (MAX/2, MAX/3, MAX/
32, etc.)

0x04.8
next25
HTTP GET Request Counting
Mutations && Estimating Runtime
• s_num_mutation()
• Identifies the number of mutations

0x04.9
next26
HTTP GET Request Displaying
Mutations
• s_render() => Return current
• s_mutate() => Generate next mutation
• s_hex_dump() => ASCII

0x04.A
next27
HTTP GET Request Output

0x04.B
next28
HTTP GET Request Output
DEMO

0x04.C
next29
Sessions
• Identify fuzzer name with
s_initialize()
• Can join multiple fuzzers
• One or more targets with control
options
• Over TCP, UDP or SSL
• Uses graph theory to fuzz each
component

0x04.D
next30
Sessions
• Add fuzzer to session using
connect()
• Fuzzer name returned by s_get()
- Name from s_initialize()
• Multiple nodes
- mysess.connect(s_get(“FOO”),
s_get(“BAR”), s_get(“BAZ”))

0x04.E
next31
Sessions
• Specify Target with
sessions.target()
• Packet capture agent : netmon
• Process analysis agent : procmon

0x04.F
next32
Sessions
• Add target to Fuzz! add_target()
• Fuzzing will perform in parallel
limited by CPU
• fuzz() starts!

0x04.11
next33
Sessions Agents
• netmon: capture libpcap file
• procmon: monitor process for faults
• vmcontrol: start, stop, and reset
guest; take, delete and restore
snapshots

0x04.12
next34
Step for Running Sulley
• Start procmon.py
• Start netmon.py
• Start Software
• Start Fuzzing script
• Monitor status with web UI
• And !!!!!!

0x04.13
next35
Post-Mortem Analysis
• Sulley includes two tools to help in
assessing session results
• pcap_cleaner.py crash bin pcaps/
• crashbin_exploere.py for navigate,
examine and graph crash data

0x04.14
next36
Post-Mortem Analysis

0x04.15
next37
Analysis With WireShark

0x05
next
1. Install Immunity-Debugger Included Python2.7 and set
up Python environment
38
Setup the Weapon

0x05.1
next
2. Install Git for clone Sulley or from link download
- https://github.com/OpenRCE/sulley.git
- https://github.com/OpenRCE/sulley
3. Before setup Sulley need install the
setuptools(Easily download, build, install, upgrade,
and uninstall Python packages) from https://
pypi.python.org/pypi/setuptools
=> python setup.py install
4. Now to sulley and install
39
Setup the Weapon

0x05.2
next
5. Netmon Agent
- Requires WinPcap/Libpcap, Impacket and pcapy
- WinPcap => I Install WireShark
- Impacket => https://github.com/CoreSecurity/impacket
- Pcapy => https://github.com/CoreSecurity/pcapy
- Install https://github.com/develersrl/gccwinbinaries/
releases/download/v1.1/gcc-mingw-4.3.3-setup.exe and
install.
- And now run network_monitor.py for test but Error
- Re-install pcapy but Error pcap.h Not Found
40
Setup the Weapon

0x05.3
next
- Solution
1.Download WinPcap developer on https://
www.winpcap.org/devel.htm
2.pip install pcapy --global-option=build_ext
—global-option="-LC:Path to
WpdPack_4_1_2Lib" —global-option=“-IC:Path
to WpdPack_4_1_2WpdPackInclude”
41
Setup the Weapon
Ref: https://stackoverflow.com/questions/22996098/trouble-installing-pcapy-on-windows-7-cannot-open-include-file-pcap-h

0x05.4
next
6. Procmon Agent
Require:
- pefile (Python library for inspecting PE file
format)
- https://code.google.com/p/pefile/downloads/list
- pydasm (Python library for disassembly binary
code)
- https://code.google.com/p/pefile/downloads/list
- paimei (reverse engineering framework written in
Python) optional
- https://github.com/OpenRCE/paimei/archive/
master.zip
- pydbg (pure-Python win32 debugger interface)
- https://github.com/Fitblip/pydbg
- Run on Windows only
- And now run process_monitor.py
42
Setup the Weapon
Ref: https://github.com/OpenRCE/sulley/wiki/Windows-Installation
: http://www.securityaddicted.com/tag/pydbg/

0x05.5
next
7. For File Format Fuzzing
Require:
- WinDbg
- MSEC Debugger Extension: !exploitability
X86 https://msdl.microsoft.com/download/symbols/
debuggers/dbg_x86_6.11.1.404.msi
X64 https://msdl.microsoft.com/download/symbols/
debuggers/dbg_amd64_6.11.1.404.msi
43
Setup the Weapon

0x06
next44
DEMO
Fuzzing
HTTP

0x06.1
next45
DEMO
Fuzzing
FTP

0x07
next46
Fuzzing File Formats
• File Format => Very Complex
Protocol
• On proprietary file formats
(opportunities and
challenges) such as MS
Word, Open Office Writer,
OS X Pages.app
• Leveraging Sulley file
format fuzzing?
• Automated and custom
mutation delivery

0x07.1
next47
Monitoring the process
• Debugger to watch exit
status
• Watch return status with
crash.exe
• Custom code with Python +
Pydbg
• Code must automate process
termination, exception
handling, logging

0x07.2
next48
crash.exe

0x07.3
next49
WinDbg Exploitability Index
• WinDbg - Microsoft Security
Engineering Team (MSEC)
debugger, User-mode and kernel-
mode debugging
• Use Extensions: !exploitability
measurement
• Reliable for “EXPLOITABLE”
Needs more analysis for “NOT
EXPLOITABLE” or “UNKNOWN”

0x07.4
next50
!exploitable

0x07.5
next51
Microsoft Console Debugger
• Console-based interface to WinDbg
included with Debugging Tools for
Windows
• Report on “!exploitable”
• Help for automating analysis and
logging

0x07.6
next52
Automating CDB
• WinDbg GUI tool, provides a
console-base version known
as “cdb”
for /L %i in (0,1,1075) do @"c:Program FilesDebugging Tools for
Windows (x86)cdb.exe" -aMSEC.dll -c ".logopen case-%i.pls.log; g; !
exploitable -m; .logclose" "c:Program FilesYahoo!PlayerYPlayer.exe"
pls-fuzzplscase-%i.pls
for /L %i in (0,0,0) do @wmic process where (name="cdb.exe") delete && ping -n 6 127.0.0.1 > null

0x07.7
next53
File Fuzzing with Sulley
• Sulley does not automate
application launch,
delivery. We perform
manually by custom script,
shell command

0x07.7.1
next54
Fuzzing File Formats Cont.

0x08
next55
DEMO File
Format
Fuzzing

0x08.1
next56
Tip / Trick
- Run as Administrator or Root
- Time delay for file fuzzing can adjust it as
necessary
- For file fuzzing keep your mouse here while
testing
- For file fuzzing copy MSEC.dll to “C:Program
FilesDebugging Tools for Windows (x86)winext”
- Running msec.dll error because The 1.6 version
of !exploitable was compiled in Visual Studio 12
using CRT 11 runtime.
https://www.microsoft.com/en-us/download/confirmation.aspx?
id=30679
Ref: http://webcache.googleusercontent.com/search?q=cache:WLXxWXjg6KcJ:msecdbg3.rssing.com/chan-8052127/all_p2.html+&cd=5&hl=th&ct=clnk&gl=th

next57
References:
• SANS 660 Advanced Penetration Testing, Exploit
Writing, and Ethical Hacking
• GIAC GXPN: Exploit Researcher and Advanced
Penetration Tester
• https://github.com/OpenRCE/sulley
• http://www.fuzzing.org/wp-content/
SulleyManual.pdf
• https://stackoverflow.com/questions/22996098/
trouble-installing-pcapy-on-windows-7-cannot-
open-include-file-pcap-h
• https://github.com/OpenRCE/sulley/wiki/Windows-
Installation
• http://www.securityaddicted.com/tag/pydbg/

close
Thank
You
Presenter: Manich Koomsusi

Awesome_fuzzing_for _pentester_red-pill_2017

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Similar a Awesome_fuzzing_for _pentester_red-pill_2017

Similar a Awesome_fuzzing_for _pentester_red-pill_2017 (20)

Último

Último (20)

Awesome_fuzzing_for _pentester_red-pill_2017