【发布时间】：2018-04-12 14:07:23
【问题描述】：
我正在尝试了解模糊未知协议以定位应用程序中的漏洞的复杂性。我正在使用一个众所周知的易受攻击的应用程序 Disk Savvy Enterprise 10.4.18，其中包含已知的 SEH 缓冲区溢出。
我目前有一个 boofuzz 脚本，我正在尝试使用 process_monitor.py 脚本，但无法重新启动崩溃的服务。我在我的目标机器上运行了process_monitor.py，并且正在从我的模糊测试机器成功连接到它。我的问题是问题标题中的错误——当应用程序崩溃时，它“尝试”重新启动进程，但我得到了错误
PED-RPC> remote method restart_target cannot be found
我的 python 脚本的相关位是：
session = sessions.Session(
crash_threshold="10000", # Arbitrary, high crash threshold
check_data_received_each_request=0, # Don't check data after every request (slow)
restart_sleep_time=0.1,
sleep_time=0.1,
)
# Define target
target = sessions.Target(
connection = SocketConnection(dst, dport, proto='tcp')
)
# Define procmon options
target.procmon = pedrpc.Client(dst, 26002)
target.procmon_options = {
"proc_name" : "disksvs.exe",
"stop_commands" : ['net stop "Disk Savvy Enterprise"'],
"start_commands" : ['net start "Disk Savvy Enterprise"']
}
我在目标计算机上使用以下行开始 process_monitor.py：
python process_monitor.py --port 26002 --crash_bin diskSaavy_Crashes.txt
这是启动后的结果输出，在它崩溃后：
Couldn't import dot_parser, loading of dot files will not be possible.
[03:11.00] Process Monitor PED-RPC server initialized:
[03:11.00] crash file: C:\Python27\Lib\site-packages\boofuzz\diskSaavy_Crashes.txt
[03:11.00] # records: 3
[03:11.00] proc name: None
[03:11.00] log level: 1
[03:11.00] awaiting requests...
[03:23.29] updating target process name to 'disksvs.exe'
[03:23.30] updating stop commands to: ['net stop "Disk Savvy Enterprise"']
[03:23.30] updating start commands to: ['net start "Disk Savvy Enterprise"']
[03:23.30] debugger thread-1523215410 looking for process name: disksvs.exe
[03:23.42] debugger thread-1523215410 found match on pid 2908
[03:23.48] updating target process name to 'disksvs.exe'
[03:23.48] updating stop commands to: ['net stop "Disk Savvy Enterprise"']
[03:23.48] updating start commands to: ['net start "Disk Savvy Enterprise"']
[03:23.49] debugger thread-1523215410 caught access violation: 'libpal.dll:004a9
19f movsx ebp,[eax+ebx] from thread 2424 caused access violation'
[03:23.49] debugger thread-1523215410 exiting
PED-RPC> remote method restart_target cannot be found
这是我的 fuzzing 机器上 boofuzz 的输出，同样的崩溃：
[2018-04-08 15:23:49,996] Test Step: Failure summary
[2018-04-08 15:23:49,996] Info: procmon detected crash on test case #2: libpal.dll:004a919f movsx ebp,[eax+ebx] from thread 2424 caused access violation
[2018-04-08 15:23:49,996] Test Step: restarting target
[2018-04-08 15:23:49,996] Info: restarting target process
[2018-04-08 15:23:50,206] Error!!!! Restarting the target failed, exiting.
Traceback (most recent call last):
File "./boofuzz-diskSaavy.py", line 72, in <module>
main()
File "./boofuzz-diskSaavy.py", line 17, in main
fuzz(dst, dport)
File "./boofuzz-diskSaavy.py", line 69, in fuzz
session.fuzz()
File "/usr/local/lib/python2.7/dist-packages/boofuzz/sessions.py", line 414, in fuzz
self._fuzz_current_case(*fuzz_args)
File "/usr/local/lib/python2.7/dist-packages/boofuzz/sessions.py", line 893, in _fuzz_current_case
self._process_failures(target=target)
File "/usr/local/lib/python2.7/dist-packages/boofuzz/sessions.py", line 603, in _process_failures
self.restart_target(target)
File "/usr/local/lib/python2.7/dist-packages/boofuzz/sessions.py", line 680, in restart_target
raise sex.BoofuzzRestartFailedError()
boofuzz.sex.BoofuzzRestartFailedError
我尝试了我的start_commands 的不同变体，不发送proc_name 或stop_commands，并在指定它们的情况下运行process_monitor.py，不同的start_commands，例如包括net.exe 的完整路径和服务名称周围的引号等的不同转义。到目前为止，我没有尝试过任何工作。
查看sessions.py、pedrpc.py和其他多个文件，我看到__getattr__被用于处理方法调用，但据我所知，restart_target存在于sessions.py中，所以我'不知道为什么 PEDRPC 说找不到 restart_target ......我把头发拉出来了。 boofuzz 正在做我想做的一切，减去重新启动。
如果这还不够，我可以提供更多信息，如果我能得到任何帮助，我将不胜感激。
谢谢！
【问题讨论】：