用Domato通過Fuzzing對PHP進(jìn)行漏洞挖掘研究
作者：h1apwn
最近，我一直在對PHP解釋器進(jìn)行Fuzzing，我探索了許多工具和技術(shù)（AFL，LibFuzzer，甚至是自定義的Fuzzing引擎），但是最近我決定嘗試Domato。
https://github.com/googleprojectzero/domato
- [name] has [number] [adjective] [noun]s.
- [name]'s [noun] is very [adjective].
- I want to purchase [number] [adjective] [noun]s.
- Names: alice, bob, eve
- Numbers: 1, 10, 100
- Adjectives: green, large, expensive
- Nouns: car, hat, laptop
- eve has 1 expensive laptops.
- alice's hat is very green.
- I want to purchase 100 expensive cars.
- I want to purchase 10 large laptops.
- bob has 100 expensive cars.
- eve has 100 green laptops.
- I want to purchase 100 large laptops.
- bob has 1 large cars.
- I want to purchase 1 large cars.
- I want to purchase 1 large hats.
- bob's laptop is very expensive.
- if (var0 == var5) { int var5 = 915941154; } else { int var3 = 1848395349; }; if (var3 == -121615885) { int var7 = 1962369640;; int var1 = 196553597;;; int var6 = -263472135;; } else { int var2 == 563276937; };
- while (var9 = var8) { while (var0 == -2029947247) { int var7 = 1879609559; } }; char var0 = '';;
- char var2 = '/';
- char var3 = 'P';
- if (var8 == var1) { int var7 = -306701547; } else { while (var3 == 868601407) { while (var0 == -1328592927) { char var10 = '^'; }; char var8 = 'L';;; int var9 = -1345514425;; char var5 = 'b';;; } }
- int var8 = 882574440;
- if (var8 == var9) { int var7 = 1369926086; } else { if (var9 != -442302103) { if (var3 != 386704757) { while (var4 != -264413007) { char var6 = 'C'; } } else { int var8 = 289431268; } } else { char var10 = '~'; } }
- char var5 = '+';
- if (var9 == 1521038703) { char var2 = '&'; } else { int var7 = -215672117; }
- while (var9 == var0) { char var9 = 'X';; int var7 = -1463788903;; }; if (var8 == var7) { int var10 = 1664850687;; char var6 = 'f';; } else { while (var5 == -187795546) { int var3 = -1287471401; } };
- andrew@thinkpad /tmp % php lang.php
- zend_version();
- func_num_args();
- func_get_arg(arg_num);
- func_get_args();
- strlen(str);
- strcmp(str1, str2);
- strncmp(str1, str2, len);
- strcasecmp(str1, str2);
- strncasecmp(str1, str2, len);
- each(arr);
- error_reporting(new_error_level);
- define(constant_name, value, case_insensitive);
- defined(constant_name);
- get_class(object);
- ... etc ...
https://www.php.net/manual/en/reflectionparameter.gettype.php
https://www.php.net/distributions/manual/php_manual_en.html.gz
- andrew@thinkpad ~/domato/php % python generator.py /dev/stdout
- Writing a sample to /dev/stdout
- <?php
- $vars = array(
- "stdClass" => new stdClass(),
- "Exception" => new Exception(),
- "ErrorException" => new ErrorException(),
- "Error" => new Error(),
- "CompileError" => new CompileError(),
- "ParseError" => new ParseError(),
- "TypeError" => new TypeError(),
- ... etc ...
- );
- try { try { $vars["SplPriorityQueue"]->insert(false, array("a" => 1, "b" => "2", "c" => 3.0)); } catch (Exception $e) { } } catch(Error $e) { }
- try { try { filter_has_var(1000, str_repeat("%s%x%n", 0x100)); } catch (Exception $e) { } } catch(Error $e) { }
- try { try { posix_access(implode(array_map(function($c) {return "\\x" . str_pad(dechex($c), 2, "0");}, range(0, 255))), -1); } catch (Exception $e) { } } catch(Error $e) { }
- try { try { rand(0, 0); } catch (Exception $e) { } } catch(Error $e) { }
- try { try { fputcsv(fopen("/dev/null", "r"), array("a" => 1, "b" => "2", "c" => 3.0), str_repeat(chr(135), 65), str_repeat(chr(193), 17) + str_repeat(chr(21), 65537), str_repeat("A", 0x100)); } catch (Exception $e) { } } catch(Error $e) { }
- try { try { $vars["ReflectionMethod"]->isAbstract(); } catch (Exception $e) { } } catch(Error $e) { }
- try { try { $vars["DOMProcessingInstruction"]->__construct(str_repeat(chr(122), 17) + str_repeat(chr(49), 65537) + str_repeat(chr(235), 257), str_repeat(chr(138), 65) + str_repeat(chr(45), 4097) + str_repeat(chr(135), 65)); } catch (Exception $e) { } } catch(Error $e) { }
- try { try { utf8_encode(str_repeat("A", 0x100)); } catch (Exception $e) { } } catch(Error $e) { }
- try { try { $vars["MultipleIterator"]->current(); } catch (Exception $e) { } } catch(Error $e) { }
- try { try { dl(str_repeat("A", 0x100)); } catch (Exception $e) { } } catch(Error $e) { }
- try { try { ignore_user_abort(true); } catch (Exception $e) { } } catch(Error $e) { }
https://github.com/google/sanitizers/wiki/AddressSanitizer
https://www.php.net/downloads
- ./configure CFLAGS="-fsanitize=address -ggdb" CXXFLAGS="-fsanitize=address -ggdb" LDFLAGS="-fsanitize=address"
- make
- make install
- $class_blacklist = array(
- // Can't actually instantiate
- "Closure",
- "Generator",
- "HashContext",
- "RecursiveIteratorIterator",
- "IteratorIterator",
- "FilterIterator",
- "RecursiveFilterIterator",
- "CallbackFilterIterator",
- "RecursiveCallbackFilterIterator",
- "ParentIterator",
- "LimitIterator",
- "CachingIterator",
- "RecursiveCachingIterator",
- "NoRewindIterator",
- "AppendIterator",
- "InfiniteIterator",
- "RegexIterator",
- "RecursiveRegexIterator",
- "EmptyIterator",
- "RecursiveTreeIterator",
- "ArrayObject",
- "ArrayIterator",
- "RecursiveArrayIterator",
- "SplFileInfo",
- "DirectoryIterator",
- "FilesystemIterator",
- "RecursiveDirectoryIterator",
- "GlobIterator",
- );
- $function_blacklist = array(
- "exit", // false positives
- "readline", // pauses
- "readline_callback_handler_install", // pauses
- "syslog", // spams syslog
- "sleep", // pauses
- "usleep", // pauses
- "time_sleep_until", // pauses
- "time_nanosleep", // pauses
- "pcntl_wait", // pauses
- "pcntl_waitstatus", // pauses
- "pcntl_waitpid", // pauses
- "pcntl_sigwaitinfo", // pauses
- "pcntl_sigtimedwait", // pauses
- "stream_socket_recvfrom", // pauses
- "posix_kill", // ends own process
- "ereg", // cpu dos
- "eregi", // cpu dos
- "eregi_replace", // cpu dos
- "ereg_replace", // cpu dos
- "similar_text", // cpu dos
- "snmpwalk", // cpu dos
- "snmpwalkoid", // cpu dos
- "snmpget", // cpu dos
- "split", // cpu dos
- "spliti", // cpu dos
- "snmpgetnext", // cpu dos
- "mcrypt_create_iv", // cpu dos
- "gmp_fact", // cpu dos
- "posix_setrlimit"
- );
https://bugs.php.net/bug.php?id=79029
本文翻譯自：https://blog.jmpesp.org/2020/01/fuzzing-php-with-domato.html?m=1&fbclid=IwAR16VPIISd2dERbma9o5bmYrEo-iBS7gPhsr0UqjUJWLlctWiHO1zpmPjHg如若轉(zhuǎn)載，請注明原文地址。
責(zé)任編輯：姜華
來源：
嘶吼網(wǎng)
