Method, apparatus, device, and storage medium for exploit generation

Abstract

The present invention provides a method, apparatus, device, and storage medium for vulnerability exploitation generation. The method includes: unpacking a firmware image and classifying the unpacked firmware files into a front-end program file and a back-end program file; extracting shared keywords of the front-end program file and performing taint analysis on the back-end program file based on the shared keywords to obtain status information of the vulnerability; performing exploitability analysis according to the status information of the vulnerability to obtain exploitability state constraints of the vulnerability; solving the exploitability state constraints to obtain results of vulnerability variables in the back-end program file; parsing the front-end program file, constructing a request packet, and generating a vulnerability exploitation program based on the request packet and the results of the vulnerability variables. The present invention can reduce the generation process of redundant vulnerability exploitation, and improve the efficiency and accuracy of vulnerability exploitation generation.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular, to a method, device, equipment and storage medium for generating vulnerability exploitation. Background Art

[0002] The Internet of Things has brought human life into an unprecedented intelligent era, providing brand-new intelligent services for people's daily lives. However, with the wide application of Internet of Things technology in multiple fields such as critical infrastructure, industrial sectors and smart homes, the security risks of its system architecture have also increased, and the attack surface facing the Internet of Things is also increasing.

[0003] Detecting the exploitability of vulnerabilities in a program can effectively help manufacturers mitigate firmware security issues to the greatest extent. Automated exploit generation (AEG) is an effective solution for detecting the exploitability of vulnerabilities. Firmware developers can use the AEG solution to evaluate vulnerabilities and prioritize patching high-risk vulnerabilities, while defenders can analyze the generated vulnerability exploitation to generate security rules to prevent 0-day attacks.

[0004] Path exploration is the core technology of vulnerability exploitation. An application program may contain thousands of execution paths, and each path has different constraints. Fuzz testing and symbolic execution are the key technologies of current AEG. Due to the large number of paths in the target application program, it is difficult for fuzz testing in existing AEG to achieve sufficient coverage, and symbolic execution cannot guarantee to meet the different constraints of each path within a limited time. As a result, the current method for automatically generating vulnerability exploitation cannot meet the requirements of path exploration. Summary of the Invention

[0005] Embodiments of the present invention provide a method, device, equipment and storage medium for generating vulnerability exploitation to solve the problem that the current method for generating vulnerability exploitation cannot meet the requirements of path exploration.

[0006] In a first aspect, an embodiment of the present invention provides a method for generating vulnerability exploitation, including:

[0007] Unpack the firmware image and classify the unpacked firmware files into front-end program files and back-end program files;

[0008] Extract the shared keywords of the front-end program files and perform taint analysis on the back-end program files based on the shared keywords to obtain the status information of the vulnerabilities;

[0009] Perform exploitability analysis according to the status information of the vulnerabilities to obtain the exploitability state constraints of the vulnerabilities;

[0010] Solve the exploitable state constraints to obtain the results of the vulnerability variables in the backend program file;

[0011] Parse the frontend program file, construct a request packet, and generate an exploit program based on the request packet and the results of the vulnerability variables.

[0012] In a possible implementation, parsing the frontend program file and constructing a request packet includes:

[0013] Based on string matching, determine the page where the vulnerability variable exists in the frontend program file;

[0014] Build the correspondence between the frontend program file and the page where the vulnerability exists;

[0015] Based on the correspondence, extract key information from the page where the vulnerability exists, and construct a request packet based on the obtained key information; where the key information includes the request address, request parameters, request method, and data format.

[0016] In a possible implementation, perform exploitability analysis based on the status information of the vulnerability to obtain the exploitable state constraints of the vulnerability, including:

[0017] Based on the status information of the vulnerability, use the call location of the shared keyword in the backend program file as the starting point of symbolic execution and the target exploitation state as the end point of symbolic execution to construct a vulnerability path;

[0018] Perform exploitability analysis on the vulnerability path based on symbolic execution to obtain the exploitable state constraints of the vulnerability.

[0019] In a possible implementation, perform exploitability analysis on the vulnerability path based on symbolic execution to obtain the exploitable state constraints of the vulnerability, including:

[0020] Based on the vulnerability variable, analyze the memory of the target function to obtain the memory layout of the target exploitation state and the length of the damaged memory; where the vulnerability variable includes pointer type and string type. When the vulnerability variable is of pointer type, the vulnerability is marked as non-exploitable; when the vulnerability variable is of string type and the detected damaged memory location is a heap address, the vulnerability is marked as non-exploitable;

[0021] When there is a vulnerability variable operation function, update the state of the memory of the target exploitation state based on the memory operation function;

[0022] Perform path exploration on the target exploitation state to determine the exploitable state constraints of the vulnerability.

[0023] In a possible implementation, solve the exploitable state constraints to obtain the vulnerability variable results, including:

[0024] Use symbolic variables to replace vulnerability variables, and solve the exploitable state constraint based on the symbolic variable constraints generated during the process of determining the exploitable state of the vulnerability to obtain the result of the vulnerability variable; wherein, the symbolic variable constraints include the number of bits of the variable and the value range of the variable.

[0025] In one possible implementation, solving the exploitable state constraint includes:

[0026] Solve the exploitable state constraint based on only constraining the preset bytes in the symbolic variable constraint.

[0027] In one possible implementation, the status information of the vulnerability includes the vulnerability start point, the vulnerability variable, and the vulnerability trigger location;

[0028] The shared keywords include parameter keywords and operation keywords.

[0029] In a second aspect, an embodiment of the present invention provides a device for generating a vulnerability exploit, including:

[0030] A firmware unpacking module, configured to unpack a firmware image and distinguish the unpacked firmware files into a front-end program file and a back-end program file;

[0031] A taint analysis module, configured to extract the shared keywords of the front-end program file and perform taint analysis on the back-end program file based on the shared keywords to obtain the status information of the vulnerability;

[0032] An analysis module, configured to perform exploitability analysis according to the status information of the vulnerability to obtain the exploitable state constraint of the vulnerability;

[0033] A solving module, configured to solve the exploitable state constraint to obtain the result of the vulnerability variable in the back-end program file;

[0034] A generating module, configured to parse the front-end program file, construct a request packet, and generate a vulnerability exploit program based on the request packet and the result of the vulnerability variable.

[0035] In a third aspect, an embodiment of the present invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the method described in the first aspect or any possible implementation manner of the first aspect above are implemented.

[0036] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, where the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method described in the first aspect or any possible implementation manner of the first aspect above are implemented.

[0037] An embodiment of the present invention provides a method, apparatus, device, and storage medium for generating exploit programs. In order to distinguish front-end program files from back-end program files, it is necessary to first unpack the firmware image. Then, extract the shared keywords of the front-end program files, and perform taint analysis on the back-end program files based on the shared keywords to obtain the status information of the vulnerabilities. Next, perform exploitability analysis on the status information of the vulnerabilities to obtain the exploitability status constraints of the vulnerabilities. Then, solve the exploitability status constraints to obtain the results of the vulnerable variables in the back-end program files. Finally, parse the front-end program files, construct request packets, and generate exploit programs based on the request packets and the results of the vulnerable variables. The present invention extracts the shared keywords of the front-end program files, and establishes an association between the shared keywords and the back-end program files to obtain the status information of the vulnerabilities. By performing exploitability analysis on the status information of the vulnerabilities, the non-exploitable vulnerabilities are filtered out by the exploitability analysis, reducing the performance consumption of redundant exploit generation. By utilizing the characteristics of the shared keywords, the hardware dependence can be eliminated, and a complete exploit program is generated by parsing the front-end program files. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for use in the embodiments or the description of the prior art. Obviously, the following drawings are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0039] Figure 1 is a flowchart of the method for generating exploit programs provided by the embodiment of the present invention;

[0040] Figure 2 is a process block diagram of the method for generating exploit programs provided by the embodiment of the present invention;

[0041] Figure 3 is a schematic structural diagram of the apparatus for generating exploit programs provided by the embodiment of the present invention;

[0042] Figure 4 is a schematic diagram of the electronic device provided by the embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0043] In the following description, specific details such as specific system structures and technologies are presented for the purpose of illustration rather than limitation, so as to thoroughly understand the embodiments of the present invention. However, those skilled in the art should clearly understand that the present invention can also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid unnecessary details from interfering with the description of the present invention.

[0044] To make the objectives, technical solutions, and advantages of the present invention clearer, the following will be described through specific embodiments in conjunction with the accompanying drawings.

[0045] As introduced in the background art, AEG is an effective solution for evaluating vulnerability exploitability. Firmware developers can use the AEG solution to evaluate vulnerabilities and prioritize patching high-risk vulnerabilities, while defenders can analyze the generated vulnerability exploits to generate security rules to prevent 0-day attacks.

[0046] The core technologies adopted by AEG are fuzz testing and symbolic execution. Fuzz testing searches for inputs that cause the program to enter a crash state through random inputs. Fuzz testing can effectively discover vulnerabilities and generate Proof of Concept (POC) for vulnerabilities, but it cannot provide the requirements for generating vulnerability exploits, such as information on variable overflow length, hijacking address location, control flow condition constraints, etc. Therefore, generating vulnerability exploits using fuzz testing is random and has extremely low efficiency. Symbolic execution technology is used for control flow analysis and data flow analysis. Control flow analysis checks whether the program contains function calls to vulnerable functions. Data flow analysis checks whether tainted data can reach the vulnerability point. However, neither of the two solutions checks the constraints of the input on the branch structure, which is extremely likely to cause false positives of vulnerabilities. [[ID=~]]

[0047] Path exploration is the core technology of vulnerability exploitation. However, the existing path exploration technologies have the following dilemmas: An application program contains thousands of execution paths, and each path has different constraints. Considering the large number of paths in the target application program, it is very difficult for fuzz testing to achieve sufficient coverage. In addition, fuzz testing cannot guarantee to meet strict constraints within a limited time.

[0048] As shown in the code of List 1, the server variable has 0xffffffff different addresses, and 0x6a000 of these addresses satisfy the constraint in line 8. For the random algorithm of fuzz testing, the probability of satisfying this constraint is 1 Therefore, it is almost impossible for fuzz testing to satisfy the constraints and explore subsequent paths.

[0049] Table 1 Code from CVE-2024-27567

[0050]

[0051] Symbolic execution can satisfy strict constraint conditions and achieve sufficient path coverage in small-scale programs. However, as the program scale increases, path explosion may occur. Therefore, in large-scale programs, symbolic execution may fail due to path explosion.

[0052] Different from binary program exploitation, IoT firmware exploitation not only requires solving vulnerability variables but also constructing a complete request packet. Table 2 shows the Poc of CVE-2024-27567, including the request header and request content. The existing IoT vulnerability exploitation generation scheme, IoTAEG, cannot generate vulnerability Pocs based on firmware programs and relies on simulation environments and real device environments. Therefore, it is unable to generate vulnerability exploitation for firmware vulnerabilities lacking real devices and simulation environments.

[0053] Table 2. Poc of CVE-2024-27567

[0054]

[0055]

[0056] It can be seen that the existing vulnerability exploitation generation technologies have limitations in path exploration and exploitation generation. The probability of fuzz testing satisfying path constraints is extremely low and it cannot be applied to path exploration; symbolic execution can strictly satisfy path constraints, but path explosion occurs in large-scale programs.

[0057] To solve the existing technical problems, embodiments of the present invention provide a method, device, equipment, and storage medium for generating vulnerability exploitation. First, the method for generating vulnerability exploitation provided by the embodiments of the present invention will be introduced below.

[0058] See Figure 1 and Figure 2 , which shows the implementation process of the method for generating vulnerability exploitation provided by the embodiments of the present invention, and is described in detail as follows:

[0059] S110. Unpack the firmware image and distinguish the unpacked firmware files into front-end program files and back-end program files.

[0060] When performing vulnerability detection, the firmware image is usually used as the input. Use a firmware unpacker to unpack the firmware image and distinguish the unpacked firmware files into front-end program files and back-end program files according to the file type.

[0061] HTML, JavaScript, and ASP files are usually front-end program files, and executable binary files and dynamic link library files are back-end program files.

[0062] S120. Extract the shared keywords of the front-end program files and perform taint analysis on the back-end program files based on the shared keywords to obtain the status information of the vulnerability.

[0063] Among them, the status information of the vulnerability includes the vulnerability starting point, vulnerability variables, and vulnerability trigger location. The shared keywords include parameter keywords and operation keywords.

[0064] After distinguishing the firmware file into a front-end program file and a back-end program file, it is also necessary to extract the keywords of the front-end program file. The specific extraction process is as follows:

[0065] First, extract potential keywords from the front-end program file. Then, by analyzing the potential keywords, extract shared keywords. According to the role of the shared keywords in the back-end program file, they can be divided into parameter keywords and operation keywords. Parameter keywords are passed as parameters into the back-end program file, such as username, password. Operation keywords are used to mark handler functions, such as register.

[0066] When extracting potential keywords, it is necessary to extract according to the type of the file. Different file types select different extraction rules to reduce false positives.

[0067] After extracting the shared keywords, taint analysis can be performed based on the shared keywords. Starting from the extraction position of the shared keywords, taint information is passed along the program data flow. When the memory location is not covered by taint information or is restricted, the taint label will be deleted.

[0068] There are two cases when the shared keywords appear in the back-end program file, namely extraction and setting. The extraction keyword needs to pass in the content of the request packet, and the setting keyword only needs the string corresponding to the shared keyword. According to this feature, the starting point of taint analysis can be quickly determined. After the taint analysis is completed, the vulnerability status can be obtained. The vulnerability status includes information such as the vulnerability starting point, vulnerability variables, and vulnerability trigger location.

[0069] S130. Perform exploitability analysis based on the status information of the vulnerability to obtain the exploitability status constraint of the vulnerability.

[0070] In some embodiments, first, based on the status information of the vulnerability, construct a vulnerability path with the call location of the shared keyword in the back-end program file as the starting point of symbolic execution and the target exploitation status as the end point of symbolic execution. Then, perform exploitability analysis on the vulnerability path based on symbolic execution to obtain the exploitability status constraint of the vulnerability.

[0071] In this embodiment, the memory of the target function can be analyzed based on vulnerability variables to obtain the memory layout of the target exploitation state and the length of the damaged memory. The vulnerability variables include pointer types and string types. When the vulnerability variable is of the pointer type, the vulnerability is marked as non-exploitable. When the vulnerability variable is of the string type and the detected damaged memory location is a heap address, the vulnerability is marked as non-exploitable. Then, when there is a vulnerability variable operation function, the memory of the target exploitation state is updated based on the memory operation function. Finally, path exploration is performed on the target exploitation state to determine the exploitable state constraints of the vulnerability. The vulnerability path is obtained through the vulnerability status information, with the call function as the symbolic execution entry point and the target exploitation state as the end point.

[0072] Specifically, first, the memory of the target function is analyzed to obtain the memory layout of the target exploitation state and the length of the damaged memory. The vulnerability variables can be identified as pointers and strings. If the vulnerability variable is stored in the pointer type and the program flow cannot be controlled, the vulnerability is marked as non-exploitable. If the vulnerability variable is stored in the string type, it is detected whether the damaged memory is located on the current stack. When the damaged memory location is a heap address, such as the address allocated by malloc and the global string, and the program flow cannot be controlled, the vulnerability is marked as non-exploitable.

[0073] Then, Hook the vulnerability variable operation functions such as memory operation functions like strcpy and nvramget to update the memory changes. Three Hook methods can be adopted. One is that the vulnerability variable extraction function uses symbolic variables to replace the vulnerability variables to obtain the vulnerability variable data constraints for reaching the program target state. Another is that the taint variable operation function updates the corresponding memory content. The third is that the irrelevant variable operation function is bypassed.

[0074] Finally, path exploration is performed on the target state. If there is no reachable path, the vulnerability is marked as non-exploitable. Once there is a reachable path, the corresponding exploitable state constraints will be generated.

[0075] S140. Solve the exploitable state constraints to obtain the results of the vulnerability variables in the backend program file.

[0076] In some embodiments, symbolic variables can be used to replace the vulnerability variables, and based on the symbolic variable constraints generated during the process of determining the exploitable state constraints of the vulnerability, the exploitable state constraints are solved to obtain the vulnerability variable results. Among them, the symbolic variable constraints include the variable bit number and the variable value range.

[0077] In this embodiment, the exploitable state constraints can be solved by only constraining the preset bytes in the symbolic variable constraints. Exemplarily, the preset bytes can be address bytes.

[0078] By adopting the strategy of only constraining the preset bytes in the symbolic variable constraints and using the pruning strategy, the problems of path explosion and constraint solving failure can be solved.

[0079] Specifically, during the exploitability analysis process, symbolic variables can be used to replace vulnerability variables for path exploration. During the process of finding the path to the target state, symbolic variable constraints are generated concomitantly. Solving the symbolic variables can generate the content of the vulnerability variables that meet the conditions. Constraints include the number of bits of the variable, the value range of the variable, etc. When the variable length is large and the value range is large, it will lead to an excessive number of constraints, causing the symbolic execution engine to crash and unable to solve successfully. Therefore, to ensure the successful solution of symbolic variables, only the address bytes can be constrained, and the jump address in the control flow hijacking is the address constraint. For the character value range constraint, specific values within the value range can be selected for assignment without further solving. For example, if the character in the vulnerability variable should be a letter or a number, the character in the vulnerability variable will be set to the same value.

[0080] S150. Parse the front-end program file, construct a request packet, and generate an exploit program based on the request packet and the result of the vulnerability variable.

[0081] In some embodiments, when constructing a request packet, first, based on string matching, determine the page where the vulnerability variable exists in the front-end program file. Then, establish the correspondence between the front-end program file and the page where the vulnerability exists. Finally, based on the correspondence, extract key information from the page where the vulnerability exists, and construct a request packet based on the obtained key information. Among them, the key information includes the request address, request parameters, request method, and data format.

[0082] In this embodiment, a request packet can be constructed by parsing according to the front-end file where the shared keyword of the vulnerability variable is located. Since a front-end page may be composed of multiple front-end files, it is necessary to establish the correspondence between the front-end program file and the page where the vulnerability exists. Find the page where the vulnerability variable is located through string matching.

[0083] For constructing an HTTP program request, the HTML and ASP files can be analyzed by using regular expressions, and the JS files can be analyzed through the AST. For programs such as UPNP and SOAP, find the XML file that stores the request format and parse it to obtain the request parameter keyword and the operation keyword.

[0084] By adopting symbolic execution to explore exploitable states, using exploitability analysis to filter out non-exploitable vulnerabilities, reducing the number of symbolic executions, and solving the path explosion problem based on pruning strategies by solving the constraints of exploitable states. In addition, in order to get rid of the hardware dependence in the process of exploit generation, the present invention introduces shared keywords. As can be seen from Table 1 and Table 2 above, the variables of the backend program file are passed in by the request packet of the frontend program file. Therefore, the corresponding relationship between the vulnerability variables in the frontend program file and the backend program file can be effectively established through the shared keywords, and finally the frontend program file related to the vulnerability can be statically analyzed to generate an exploit program. In addition, by only constraining the preset bytes in the symbolic variable constraints, the pruning strategy is adopted to solve the path explosion problem faced by symbolic execution in the process of exploitability analysis.

[0085] The present invention determines the source of vulnerability keywords and the composition of request packets by analyzing the frontend files, and then quickly realizes exploit generation by combining with the vulnerability keyword constraints of the backend. SKAEG can achieve vulnerability detection and exploit generation on 10 Internet of Things devices from 4 manufacturers and 8 CVE vulnerabilities. The exploitability analysis effectively detects 51 non-exploitable vulnerabilities, the optimized symbolic execution process successfully solves the solver crash problem, and the exploit generation efficiency of SKAEG is better than that of IOTAEG.

[0086] The present invention provides a method for exploit generation. In order to distinguish between the frontend program file and the backend program file, it is necessary to first unpack the firmware image. Then, extract the shared keywords of the frontend program file, and perform taint analysis on the backend program file based on the shared keywords to obtain the status information of the vulnerability. Then, perform exploitability analysis according to the status information of the vulnerability to obtain the exploitable state constraints of the vulnerability. Next, solve the exploitable state constraints to obtain the results of the vulnerability variables in the backend program file. Finally, parse the frontend program file, construct a request packet, and generate an exploit program based on the request packet and the results of the vulnerability variables. The present invention extracts the shared keywords of the frontend program file, establishes an association with the backend program file in combination with the shared keywords to obtain the status information of the vulnerability. By performing exploitability analysis on the status information of the vulnerability, the non-exploitable vulnerabilities are filtered out by the exploitability analysis, reducing the performance consumption of redundant exploit generation. By utilizing the characteristics of the shared keywords, the hardware dependence can be eliminated, and a complete exploit program is generated through the parsing of the frontend program file.

[0087] It should be understood that the sequence numbers of the steps in the above embodiments do not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation to the implementation process of the embodiments of the present invention.

[0088] Based on the method for generating exploit provided in the above embodiments, correspondingly, the present invention also provides a specific implementation manner of an exploit generation device applied to the method for generating exploit. Please refer to the following embodiments.

[0089] As Figure 3 shown, an exploit generation device 300 is provided, and the device includes:

[0090] A firmware unpacking module 310, configured to unpack a firmware image and distinguish the unpacked firmware files into a front-end program file and a back-end program file;

[0091] A taint analysis module 320, configured to extract shared keywords of the front-end program file and perform taint analysis on the back-end program file based on the shared keywords to obtain status information of the vulnerability;

[0092] An analysis module 330, configured to perform exploitability analysis according to the status information of the vulnerability to obtain an exploitability status constraint of the vulnerability;

[0093] A solving module 340, configured to solve the exploitability status constraint to obtain a result of a vulnerability variable in the back-end program file;

[0094] A generation module 350, configured to parse the front-end program file, construct a request packet, and generate an exploit program based on the request packet and the result of the vulnerability variable.

[0095] In a possible implementation manner, the generation module 350 is configured to determine a vulnerability existence page of the vulnerability variable in the front-end program file based on string matching;

[0096] Construct a correspondence between the front-end program file and the vulnerability existence page;

[0097] Extract key information from the vulnerability existence page based on the correspondence, and construct a request packet based on the obtained key information; wherein the key information includes a request address, request parameters, a request method, and a data format.

[0098] In a possible implementation manner, the analysis module 330 is configured to construct a vulnerability path based on the status information of the vulnerability, with the call position of the shared keyword in the back-end program file as the starting point of symbolic execution and the target exploitation status as the ending point of symbolic execution;

[0099] Perform exploitability analysis on the vulnerability path based on symbolic execution to obtain an exploitability status constraint of the vulnerability.

[0100] In a possible implementation, the analysis module 330 is configured to analyze the memory of the target function based on vulnerability variables, and obtain the memory layout of the target exploitation state and the length of the damaged memory; wherein, the vulnerability variables include pointer types and string types. When the vulnerability variable is of the pointer type, the vulnerability is marked as non-exploitable; when the vulnerability variable is of the string type and the detected damaged memory location is a heap address, the vulnerability is marked as non-exploitable.

[0101] When there is a vulnerability variable operation function, update the state of the memory of the target exploitation state based on the memory operation function.

[0102] Perform path exploration on the target exploitation state to determine the exploitable state constraints of the vulnerability.

[0103] In a possible implementation, the solving module 340 is configured to use symbolic variables to replace the vulnerability variables, and solve the exploitable state constraints based on the symbolic variable constraints generated during the process of determining the exploitable state constraints of the vulnerability, to obtain the vulnerability variable results; wherein, the symbolic variable constraints include variable bit widths and variable value ranges.

[0104] In a possible implementation, the solving module 340 is configured to solve the exploitable state constraints by only constraining the preset bytes in the symbolic variable constraints.

[0105] In a possible implementation, the status information of the vulnerability includes the vulnerability starting point, vulnerability variables, and vulnerability trigger location.

[0106] The shared keywords include parameter keywords and operation keywords.

[0107] Figure 4 It is a schematic diagram of the electronic device provided by the embodiments of the present invention. As Figure 4 shown, the electronic device 4 of this embodiment includes: a processor 40, a memory 41, and a computer program 42 stored in the memory 41 and executable on the processor 40. When the processor 40 executes the computer program 42, it implements the steps in the method embodiments of the above various vulnerability exploitation generations, such as Figure 1 the steps 110 to 150 shown. Alternatively, when the processor 40 executes the computer program 42, it implements the functions of each module in the above device embodiments, such as Figure 3 the functions of the modules 310 to 350 shown.

[0108] Exemplarily, the computer program 42 can be divided into one or more modules, which are stored in the memory 41 and executed by the processor 40 to implement the present invention. The one or more modules can be a series of computer program instruction segments capable of performing specific functions, and these instruction segments are used to describe the execution process of the computer program 42 in the electronic device 4. For example, the computer program 42 can be divided into Figure 3 the modules 310 to 350 shown.

[0109] The electronic device 4 may include, but is not limited to, a processor 40 and a memory 41. Those skilled in the art can understand that Figure 4 merely being examples of the electronic device 4 does not constitute a limitation on the electronic device 4. It may include more or fewer components than shown in the figure, or combine certain components, or different components. For example, the electronic device may also include input / output devices, network access devices, buses, etc.

[0110] The so-called processor 40 may be a central processing unit (CPU), or may also be other general-purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0111] The memory 41 may be an internal storage unit of the electronic device 4, such as the hard disk or memory of the electronic device 4. The memory 41 may also be an external storage device of the electronic device 4, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device 4. Further, the memory 41 may also include both the internal storage unit and the external storage device of the electronic device 4. The memory 41 is used to store the computer program and other programs and data required by the electronic device. The memory 41 may also be used to temporarily store data that has been output or will be output.

[0112] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above-mentioned division of each functional unit and module is used as an example. In actual applications, the above functions can be allocated to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. Each functional unit and module in the embodiments can be integrated into a processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit. In addition, the specific names of each functional unit and module are only for the convenience of mutual distinction and do not limit the protection scope of this application. The specific working processes of the units and modules in the above system can refer to the corresponding processes in the foregoing method embodiments and will not be elaborated herein.

[0113] In the above embodiments, the descriptions of the respective embodiments have their own emphases. For the parts not detailed or recorded in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0114] Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be implemented by electronic hardware, or by a combination of computer software and electronic hardware. Whether these functions are executed in hardware or software depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0115] In the embodiments provided by the present invention, it should be understood that the disclosed device / electronic device and method can be implemented in other ways. For example, the device / electronic device embodiments described above are only illustrative. For example, the division of the modules or units is only a logical function division, and there can be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed couplings or direct couplings or communication connections to each other can be through some interfaces. The indirect couplings or communication connections of the devices or units can be in electrical, mechanical or other forms.

[0116] The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they can be located in one place or distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0117] In addition, in each embodiment of the present invention, each functional unit can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

[0118] If the above-mentioned integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, to implement all or part of the processes in the above-mentioned embodiment methods of the present invention, it can also be completed by instructing relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by a processor, it can implement the steps of the above-mentioned method embodiments for generating each vulnerability exploitation. Among them, the computer program includes computer program code, and the computer program code can be in the form of source code, object code, executable file, or some intermediate form, etc. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disc, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal, and software distribution medium, etc.

[0119] The above-mentioned embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of each embodiment of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A method for generating exploit, characterized in that, Including: Unpack the firmware image and distinguish the unpacked firmware files into a front-end program file and a back-end program file; Extract the shared keywords of the front-end program file and perform taint analysis on the back-end program file based on the shared keywords to obtain the status information of the vulnerability; Based on the status information of the vulnerability, construct a vulnerability path with the call location of the shared keyword in the back-end program file as the starting point of symbolic execution and the target exploitation status as the ending point of symbolic execution; Analyze the memory of the target function based on the vulnerability variable to obtain the memory layout of the target exploitation status and the length of the damaged memory; wherein, the vulnerability variable includes a pointer type and a string type. When the vulnerability variable is of the pointer type, the vulnerability is marked as non-exploitable; when the vulnerability variable is of the string type and the detected damaged memory location is a heap address, the vulnerability is marked as non-exploitable; When there is a vulnerability variable operation function, update the status of the memory of the target exploitation status based on the memory operation function; Perform path exploration on the target exploitation status to determine the exploitable state constraints of the vulnerability; Solve the exploitable state constraints to obtain the results of the vulnerability variables in the back-end program file; Parse the front-end program file, construct a request packet, and generate an exploit program based on the request packet and the results of the vulnerability variables.

2. The method for generating an exploit as claimed in claim 1, wherein The parsing of the front-end program file and constructing a request packet includes: Based on string matching, determine the page where the vulnerability variable exists in the front-end program file; Construct the correspondence between the front-end program file and the page where the vulnerability exists; Based on the correspondence, extract key information from the page where the vulnerability exists and construct a request packet based on the obtained key information; wherein, the key information includes a request address, request parameters, a request method, and a data format.

3. The method for generating an exploit as claimed in claim 1, wherein, The solving of the exploitable state constraints to obtain the results of the vulnerability variables includes: Use symbolic variables to replace the vulnerability variables and solve the exploitable state constraints based on the symbolic variable constraints generated during the process of determining the exploitable state constraints of the vulnerability to obtain the results of the vulnerability variables; wherein, the symbolic variable constraints include the variable bit width and the variable value range.

4. The method for generating an exploit according to claim 3, characterized in that, The solving of the exploitable state constraints includes: Based on only constraining the preset bytes in the symbolic variable constraints, solve the exploitable state constraints.

5. The method for generating an exploit according to any one of claims 1-4, characterized in that, The status information of the vulnerability includes a vulnerability starting point, a vulnerability variable, and a vulnerability trigger location; The shared keywords include parameter keywords and operation keywords.

6. An apparatus for exploit generation, characterized in that, Including: A firmware unpacking module for unpacking the firmware image and distinguishing the unpacked firmware files into a front-end program file and a back-end program file; A taint analysis module for extracting the shared keywords of the front-end program file and performing taint analysis on the back-end program file based on the shared keywords to obtain the status information of the vulnerability; An analysis module, configured to construct a vulnerability path with the call location of the shared keyword in the backend program file as the starting point of symbolic execution and the target exploitation state as the ending point of symbolic execution based on the status information of the vulnerability; Analyze the memory of the target function based on the vulnerability variable to obtain the memory layout of the target exploitation state and the length of the damaged memory; wherein, the vulnerability variable includes a pointer type and a string type. When the vulnerability variable is of the pointer type, the vulnerability is marked as non-exploitable; when the vulnerability variable is of the string type and the detected damaged memory location is a heap address, the vulnerability is marked as non-exploitable; when there is a vulnerability variable operation function, update the status of the memory of the target exploitation state based on the memory operation function; perform path exploration on the target exploitation state to determine the exploitable state constraint of the vulnerability; A solution module, configured to solve the exploitable state constraint to obtain the result of the vulnerability variable in the backend program file; A generation module, configured to parse the frontend program file, construct a request packet, and generate a vulnerability exploitation program based on the request packet and the result of the vulnerability variable.

7. An electronic device, characterized in that, It includes a memory and a processor. The memory is used to store a computer program, and the processor is used to call and run the computer program stored in the memory to execute the method according to any one of claims 1 to 5.

8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images