vulnerability_analytics

---

• Description
  • Limitations
• How It Works
• Setup
• Usage
  • As a CLI Tool
    • Test Binary Crash
    • Main Help
    • Get Help
  • As a Python Module

---

Description

vulnerability_analytics is the CRS module that explores a identified crash in order to gether more data in order to be used further by the CRS.

Limitations

• ELF format
• Limited vulnerability support - See Here

How It Works

This module executes the following steps for each given binary:

1. Creates a new Docker image containing that binary, this image will have a tag of form {binaryName}:crash

2. Sets up the EntryPoint of that new image to be the executable with user provided arguments (from the CLI).

3. Uses rex and archr in order to trace execution of the binary inside the Docker container.

4. Returns a JSON containing information at the moment of the crash like stackPointer, coreRegisters, crashType, etc.

Setup

We highly encourage you to use docker as this module has lots of dependencies and it helps to keep your machine as clean as possible.

1. Make sure you have set up the repositories and Python environment according to the top-level instructions. That is:

   • Docker is installed and is properly running. Check using:

     docker version
     docker ps -a
     docker run --rm hello-world

     These commands should run without errors.

   • The current module repository and all other module repositories (particularly the dataset repository and the commons repository) are cloned in the same directory.

   • You are running all commands inside a Python virtual environment. There should be (.venv) prefix to your prompt.

   • You have installed Poetry in the virtual environment. If you run:

     which poetry

     you should get a path ending with .venv/bin/poetry.

2. Disable the Python Keyring:

   export PYTHON_KEYRING_BACKEND=keyring.backends.null.Keyring

   This is a problem that may occur in certain situations, preventing Poetry from getting packages.

3. Ensure that you have docker installed.

4. Build the Docker image from the module repo root (with commons/ and zeratool_lib/ cloned alongside it): docker build -t vulnerability_analytics:1.0.0-alpha -f ./docker/Dockerfile ..

5. Start a new container and give it access to the docker engine running on your machine: docker run -it -v /var/run/docker.sock:/var/run/docker.sock vulnerability_analytics:1.0.0-alpha bash

6. Run the module using poetry: /root/.local/bin/poetry run vulnerability_analytics get --help

Note: You can change the $PATH variable in order to acces poetry faster by running export PATH="/root/.local/bin:$PATH"

Usage

As a CLI Tool

As a CLI tool, you can either use the cli.py module:

vulnerability_analytics/cli.py

or the Poetry interface:

poetry run vulnerability_analytics

Test Binary Crash

➜ /root/.local/bin/poetry run python vulnerability_analytics get --binary-path=./test_binary/source.bin --binary-arguments="--string,santa"

INFO    | 2022-12-20 02:52:50,013 | rex.Crash | Filtering memory writes.
INFO    | 2022-12-20 02:52:50,019 | rex.Crash | Triaging the crash.
INFO    | 2022-12-20 02:52:50,023 | rex.Crash | Identifying bad_bytes
INFO    | 2022-12-20 02:52:50,032 | crs.vulnerability_analytics | []
Press Enter to continue...
{"crashTypes": [], "functionAddress": "0x401136", "basicBlockAddress": "0x401136", "returnAddress": "0x500060", "stackPointer": "0x4000800ed8", "jumpKind": "Ijk_Call", "coreRegisters": {"r15": 274886537280, "r14": 0, "r13": 4198710, "r12": 274886299080, "rbp": 274886298800, "rbx": 0, "r11": 274886540016, "r10": 274886297952, "r9": 274886324288, "r8": 274888769296, "rax": 0, "rcx": 0, "rdx": 8, "rsi": 4202500, "rdi": 274886299495, "orig_rax": 0, "rip": 4198802, "cs": 51, "eflags": 582, "rsp": 274886298768, "ss": 43, "fs_base": 0, "gs_base": 0, "ds": 0, "es": 0, "fs": 0, "gs": 0}}

➜ /root/.local/bin/poetry run python vulnerability_analytics get --binary-path=./test_binary/hammer_controller.bin --binary-arguments="himinbjörg_is_home,loki_sucks_ass" --binary-input="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

INFO    | 2022-12-20 03:00:01,956 | rex.Crash | Preconstraining file stream <rex.preconstrained_file_stream.SimPreconstrainedFileStream object at 0x7f3d6040ee80> upon the first read().
WARNING | 2022-12-20 03:00:06,500 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 aeg_input_default_5f_95_8 .. aeg_input_default_5e_94_8 .. aeg_input_default_5d_93_8 .. aeg_input_default_5c_92_8 .. aeg_input_default_5b_91_8 .. aeg_input_default_5a_90_8 .. aeg_input_default_59_89_8 .. aeg_input_default_58_88_8>
INFO    | 2022-12-20 03:00:06,513 | rex.Crash | Filtering memory writes.
INFO    | 2022-12-20 03:00:06,539 | rex.Crash | Triaging the crash.
INFO    | 2022-12-20 03:00:06,548 | rex.Crash | detected ip overwrite vulnerability
INFO    | 2022-12-20 03:00:06,551 | rex.Crash | Identifying bad_bytes
INFO    | 2022-12-20 03:00:07,478 | crs.vulnerability_analytics | ['ip_overwrite']
Press Enter to continue...
{"crashTypes": ["ip_overwrite"], "functionAddress": "0x400086adc0", "basicBlockAddress": "0x400086adc0", "returnAddress": "0x40059a", "stackPointer": "0x4000800ed8", "jumpKind": "Ijk_Call", "coreRegisters": {"r15": 274886537280, "r14": 0, "r13": 4195927, "r12": 274886299032, "rbp": 4702111234474983745, "rbx": 0, "r11": 0, "r10": 0, "r9": 2147483647, "r8": 65535, "rax": 0, "rcx": 1, "rdx": 0, "rsi": 4196442, "rdi": 274886297280, "orig_rax": 0, "rip": 4702111234474983745, "cs": 51, "eflags": 518, "rsp": 274886298768, "ss": 43, "fs_base": 0, "gs_base": 0, "ds": 0, "es": 0, "fs": 0, "gs": 0}}

Main Module Help

➜ poetry run vulnerability_analytics

Usage: vulnerability_analytics [OPTIONS] COMMAND [ARGS]...

  Displays information about a binary crash for given input.

Options:
  --help  Show this message and exit.

Commands:
  get  Displays information about the crash.

Get Command Help

➜ poetry run vulnerability_analytics get --help

Usage: vulnerability_analytics get [OPTIONS]

  Displays information about the crash.

Options:
  --binary-path TEXT       Desired binary path.  [required]
  --binary-arguments TEXT  Arguments provided to the binary, each argument
                           must be separated by comma and have no spaces if
                           none are required.
  --binary-input TEXT      Input to be provided to the binary after the
                           execution has started.
  --base64                 Marks that binary arguments and inpus are encoded
                           in base64.
  --help                   Show this message and exit.

As a Python Module

from vulnerability_analytics.rex_api.DockerBuilder import DockerBuilder
from vulnerability_analytics.rex_api.VunlerabilityAnalysis import VulnerabilityAnalysis

image = DockerBuilder()

# image.build_custom_image(path_to_the_binary_to_be_analyzed, image_tag, binary_args - given at startup)
image.build_custom_image(
    '{binary_path}', '{binary_name}' + ":crash", ['arg1', 'arg2'])

# VulnerabilityAnalysis(previouslt built image, provided_input_after_binary_has_started in bytes)
analyzer = VulnerabilityAnalysis(
    image, bytes("{input}", 'utf-8')).start()

print(analyzer.export2JSON())