劍走偏鋒：基于靜態(tài)檢測的IE漏洞檢測工具IEFuzz
本文主要分享一款靜態(tài)的IE瀏覽器模糊測試工具，該工具被稱為IEFuzz。我們知道，像其他大部分軟件一樣，瀏覽器也往往通過兩種方式進(jìn)行模糊測試，一種為靜態(tài)，另外一種則為動態(tài)。
在此前，我們在其他文章中也了解過其他的Fuzzer，如X-Fuzzer，PKAV HTTP Fuzzer，也了解過相關(guān)的Fuzzing方法,如從零開始學(xué)Fuzzing系列：瀏覽器挖掘框架Morph誕生記等。本文主要講述靜態(tài)瀏覽器Fuzzer的情況。
在當(dāng)下，動態(tài)瀏覽器Fuzzer占據(jù)著主流，因?yàn)樗鼈兊倪\(yùn)行效率高(純粹是用JavaScript寫的)。然而，當(dāng)我們在進(jìn)行動態(tài)Fuzzing 的時候，往往面臨著一個共同的問題，就是“異常事件重現(xiàn)”。所以一般我們在構(gòu)建JS 瀏覽器 Fuzzer時都需要非常仔細(xì)，否則在運(yùn)行過程中可能會由于瀏覽器Fuzzer是動態(tài)的，將導(dǎo)致異常事件不可重現(xiàn)。
所以，在Fuzzing之前，我們往往需要考慮以下幾個方面的問題：
1、測試實(shí)例(樣本)如何生成? 2、對異常事件如何監(jiān)控? 3、對于引起異常事件的測試實(shí)例如何保存? 4、異常事件如何重現(xiàn)?
對于上述使用動態(tài) Fuzzer面臨的問題，另外一種解決思路是，采用靜態(tài)Fuzzer進(jìn)行檢測。雖然靜態(tài)Fuzzer效率較低，但是一般都可以重現(xiàn)異常事件的。
IEFuzz簡介
該靜態(tài)IE fuzzer 是用python編寫的，包括使用到以下模塊:
pywin32com ——用于加載或者重載*.html測試實(shí)例;
pydbg——用于監(jiān)控IE瀏覽器的異常事件;
paimei——用于生成異常事件的dump文件，下載鏈接為：paimei。
IEFuzz使用配置
為了能夠順利進(jìn)行Fuzzing,我們需要在IE設(shè)置中做如下更改。
1、首先，因?yàn)镕uzzer 需要在本地加載測試實(shí)例(如加載路徑為file://c:/fuzzer/testcases/temp.html)所以應(yīng)該先將IE的ActiveX告警提示關(guān)閉，通過如下步驟：
(1)工具->Internet 選項->安全->自定義級別;
(2)隨后將ActiveX告警提示關(guān)閉。
2、接著，為了能夠使用 Python win32com來監(jiān)控IE，我們還需要關(guān)閉IE的保護(hù)模塊。但是請注意其中的風(fēng)險。
(1)工具->Internet 選項->安全->受信任的站點(diǎn)：自定義級別為低;
(2)工具->Internet 選項->安全->Internet:自定義級別為中，同時關(guān)閉保護(hù)模式;
(3)工具->Internet 選項->安全->受限站點(diǎn)：關(guān)閉保護(hù)模式。
編寫測試實(shí)例
首先我們可以基于該fuzzer編寫自己的靜態(tài)測試用例生成器。之后可以將其放在/TestCases文件夾中。在GitHub源碼中， 也提供了一個樣本以供參考：’TestCases/SampleTestCase.py。因源碼篇幅較長，鏈接如下，
在編寫測試實(shí)例時也請注意，實(shí)例中需要包含一個TestCase類以及getFinalTestCase()方法。 getFinalTestCase()方法需要能夠返回完整的 Html頁面。
在動態(tài)fuzzer的應(yīng)用過程中，需要從對象中提取不同的Html元素屬性，然后在運(yùn)行狀態(tài)下進(jìn)行模糊檢測。而對于一個靜態(tài)Fuzzer，我們能夠在我們的python測試實(shí)例中預(yù)定義html元素以及屬性，并將之作為字典dict。
dict舉例如下：
- attr = {'CANVAS':['height','width','getContext', ... , ... , ... ]}
對于這種屬性生成列表，也提供了一個JavaScript 應(yīng)用供參考。
- <html>
- <head>
- <script>
- /*
- ----------------------------------------------------------------------------
- "THE BEER-WARE LICENSE" (Revision 42):
- <debasishm89_at_gmail.com> wrote this file. As long as you retain this notice you
- can do whatever you want with this stuff. If we meet some day, and you think
- this stuff is worth it, you can buy me a beer in return. Debasish Mandal
- ----------------------------------------------------------------------------
- This JS code should be used for generating a python dict. of element attributes of different HTML elements.
- In case of dynamic fuzzer, its usually generated on the fly, since its a static fuzzer you need to pre define html elements and their attributes to your test case.
- Other wise you can use a list of well known attributes. It's completely your choice, how you write your test case.
- */
- function getEleAttributes(ele){
- buff = "['"
- for( var p in ele ){
- buff += p + "','";
- }
- buff = buff.slice(0, -2) + "]";
- return buff
- }
- function generate() {
- /*
- Add your element list in this here and open this html in IE.
- */
- var elements = ["ARTICLE","ASISE","B","BDI","BDO", "BLOCKQUOTE","BR","BUTTON","CANVAS","CAPTION","CITE","COL","CODE","COMMAND","DATALIST","DD","DEL","DETAILS","DFN","DL","DT", "EM","STYLE","FIELDSET","FIGCAPTION","SCRIPT", "EMBED","FIGURE","FOOTER","HEADER","HGROUP","HR","I","INPUT","INS","KEYGEN","KBD","LEGEND","MARK","MENU","METER","NAV","NOSCRIPT","OPTGROUP","OUTPUT","P","PARAM","PRE","PROGRESS","Q","RP","RT","RUBY","S","SAMP","SECTION","SELECT","SMALL","SOURCE","SPAN","SUP","TH","THEAD","TIME","OBJECT","IFRAME","TEXTAREA","TRACK","U","VAR","WBR","FORM","A","BODY","HTML","DIV","TABLE","AREA","TD","TR","LINK","BASE","FONT","HEAD","IMG","MAP","META","OL","LI","TBODY","TITLE","H1","BLINK","AREA","COL","SPAN","FRAMESET","FRAME","UL","OPTION","NOFRAMES","TFOOT","XMP","ISINDEX","CENTER","HR","LABEL","OPTGROUP","AUDIO","VIDEO","TEMPLATE","SVG"]
- main_buff = "ele_dict = {"
- for (ele in elements){
- var id_0 = document.createElement( elements[ele] );
- all_props = getEleAttributes(id_0)
- main_buff += "'"+elements[ele]
- main_buff += "':"
- main_buff += all_props
- main_buff += ","
- }
- main_buff = main_buff.slice(0,-1)
- main_buff += "}"
- document.getElementById('result').innerHTML = main_buff;
- }
- </script>
- </head>
- <body onload='generate();'>
- <b>Output : (Copy paste following python dictionary to your testcase generator script and fuzz using them )</b></br><textarea id="result" rows="100" cols="200"></textarea>
- </body>
- </html>
參考鏈接為：Generate_Elements_Dict.html
IEFuzz運(yùn)行步驟
那么IEFuzz 是如何運(yùn)行的?請參考往下步驟:
1、啟動IE; 2、將iexplore.exe進(jìn)程掛載到 Debugger(pydbg) 中，然后對其父進(jìn)程以及子進(jìn)程所有類型的事件進(jìn)行監(jiān)控; 3、生成一個靜態(tài)實(shí)例(Html + JavaScript); 4、通過win32COM加載該靜態(tài)實(shí)例到本地(如file://c:/fuzzer/testcases/temp.html) 5、如果沒有產(chǎn)生異常事件，那么就需要重新生成一個Html測試實(shí)例，然后再使用win32COM (python模塊)進(jìn)行重載。(在這里先不關(guān)閉IE或者重新打開IE?？梢哉f，我們只是重新刷新了頁面，但是頁面的代碼或者內(nèi)容是不同的，這也給測試節(jié)省了時間); 6、在出現(xiàn)異常事件時，先復(fù)制或者保存測試實(shí)例到一個單獨(dú)的文件夾，然后再關(guān)閉IE進(jìn)程; 7、返回步驟1。
