示例#1
0
    def run(self):
        os.putenv("LANG", "C")
        os.putenv("ASAN_SYMBOLIZER_PATH", self.asan_symbolizer_path)

        cmd = self.program
        print "Running %s" % cmd

        cmd_obj = TimeoutCommand(cmd)
        cmd_obj.run(self.timeout, get_output=True)

        buf = cmd_obj.stderr
        self.asan.parse_buffer(buf)

        if self.asan.reason is not None:
            crash_data = CCrashData(self.asan.pc, self.asan.reason)
            i = 0
            for line in self.asan.stack_trace:
                crash_data.add_data("stack trace", "%d" % i,
                                    (line[0], line[1]))
                i += 1

            crash_data.add_data("registers", "pc", self.asan.pc)
            crash_data.add_data("registers", "bp", self.asan.bp)
            crash_data.add_data("registers", "sp", self.asan.sp)

            crash_data.add_data("disassembly", int(self.asan.pc), "")
            j = 0
            for line in self.asan.additional:
                crash_data.add_data("information", j, line)
                j += 1
            crash_data.disasm = [self.asan.pc, ""]

            if not self.asan.reason.startswith("SIG"):
                crash_data.exploitable = "EXPLOITABLE"
            else:
                crash_data.exploitable = "UNKNOWN"

            crash_data.add_data("exploitability", "reason", self.asan.reason)

            crash_data_buf = crash_data.dump_json()
            crash_data_dict = crash_data.dump_dict()

            line = "Program received %s at PC 0x%x SP 0x%x BP 0x%x"
            print line % (self.asan.reason, self.asan.pc, self.asan.sp,
                          self.asan.bp)
            print
            for i, line in enumerate(self.asan.stack_trace):
                if i > 10:
                    break
                print "0x%08x %s" % (line[0], line[1])

            print
            print "Yep, we got a crash! \o/"
            print

            return crash_data_dict

        return
示例#2
0
  def run(self):
    os.putenv("LANG", "C")
    os.putenv("ASAN_SYMBOLIZER_PATH", self.asan_symbolizer_path)

    cmd = self.program
    print "Running %s" % cmd

    cmd_obj = TimeoutCommand(cmd)
    cmd_obj.run(self.timeout, get_output=True)

    buf = cmd_obj.stderr
    self.asan.parse_buffer(buf)

    if self.asan.reason is not None:
      crash_data = CCrashData(self.asan.pc, self.asan.reason)
      i = 0
      for line in self.asan.stack_trace:
        crash_data.add_data("stack trace", "%d" % i, (line[0], line[1]))
        i += 1

      crash_data.add_data("registers", "pc", self.asan.pc)
      crash_data.add_data("registers", "bp", self.asan.bp)
      crash_data.add_data("registers", "sp", self.asan.sp)

      crash_data.add_data("disassembly", int(self.asan.pc), "")
      j = 0
      for line in self.asan.additional:
        crash_data.add_data("information", j, line)
        j += 1
      crash_data.disasm = [self.asan.pc, ""]

      if not self.asan.reason.startswith("SIG"):
        crash_data.exploitable = "EXPLOITABLE"
      else:
        crash_data.exploitable = "UNKNOWN"

      crash_data.add_data("exploitability", "reason", self.asan.reason)

      crash_data_buf = crash_data.dump_json()
      crash_data_dict = crash_data.dump_dict()

      line = "Program received %s at PC 0x%x SP 0x%x BP 0x%x"
      print line % (self.asan.reason, self.asan.pc, self.asan.sp, self.asan.bp)
      print
      for i, line in enumerate(self.asan.stack_trace):
        if i > 10:
          break
        print "0x%08x %s" % (line[0], line[1])

      print
      print "Yep, we got a crash! \o/"
      print

      return crash_data_dict

    return
示例#3
0
    def run(self):
        global buf

        os.putenv("LANG", "C")

        logfile = mkstemp()[1]
        try:
            cmd = '/bin/bash -c "/usr/bin/gdb -q --batch --command=%s --args %s" 2>/dev/null > %s'
            cmd %= (self.gdb_commands, self.program, logfile)
            print cmd
            print "Running %s" % cmd

            cmd_obj = TimeoutCommand(cmd)
            #cmd_obj.shell = True
            cmd_obj.run(self.timeout)

            buf = open(logfile, "rb").readlines()
            self.parse_dump(buf)

            if self.signal:
                crash_data = CCrashData(self.pc, self.signal)
                i = 0
                for stack in self.stack:
                    crash_data.add_data("stack trace", "%d" % i, stack)
                    i += 1

                for reg in self.registers:
                    crash_data.add_data("registers", reg, self.registers[reg])

                crash_data.add_data("disassembly", int(self.pc), self.disasm)
                for dis in self.disasm_around:
                    if type(dis[0]) is int or dis[0].isdigit():
                        crash_data.add_data("disassembly", dis[0], dis[1])
                crash_data.disasm = [self.pc, self.disasm]

                if self.exploitability is not None:
                    crash_data.exploitable = self.exploitability

                if self.exploitability_reason is not None:
                    crash_data.add_data("exploitability", "reason",
                                        self.exploitability_reason)

                crash_data_buf = crash_data.dump_json()
                crash_data_dict = crash_data.dump_dict()

                print
                print "Yep, we got a crash! \o/"
                print

                return crash_data_dict

            return
        finally:
            os.remove(logfile)
示例#4
0
  def run(self):
    global buf

    os.putenv("LANG", "C")
    
    logfile = mkstemp()[1]
    try:
      cmd = '/bin/bash -c "/usr/bin/gdb -q --batch --command=%s --args %s" 2>/dev/null > %s'
      cmd %= (self.gdb_commands, self.program, logfile)
      print cmd
      print "Running %s" % cmd

      cmd_obj = TimeoutCommand(cmd)
      #cmd_obj.shell = True
      cmd_obj.run(self.timeout)
      
      buf = open(logfile, "rb").readlines()
      self.parse_dump(buf)

      if self.signal:
        crash_data = CCrashData(self.pc, self.signal)
        i = 0
        for stack in self.stack:
          crash_data.add_data("stack trace", "%d" % i, stack)
          i += 1

        for reg in self.registers:
          crash_data.add_data("registers", reg, self.registers[reg])

        crash_data.add_data("disassembly", int(self.pc), self.disasm)
        for dis in self.disasm_around:
          if type(dis[0]) is int or dis[0].isdigit():
            crash_data.add_data("disassembly", dis[0], dis[1])
        crash_data.disasm = [self.pc, self.disasm]
        
        if self.exploitability is not None:
          crash_data.exploitable = self.exploitability
        
        if self.exploitability_reason is not None:
          crash_data.add_data("exploitability", "reason", self.exploitability_reason)

        crash_data_buf = crash_data.dump_json()
        crash_data_dict = crash_data.dump_dict()

        print
        print "Yep, we got a crash! \o/"
        print

        return crash_data_dict

      return
    finally:
      os.remove(logfile)
示例#5
0
def main(args):
  crash_data_dict = None
  tr = vtrace.getTrace()
  
  global timeout
  if os.getenv("NIGHTMARE_TIMEOUT"):
    timeout = float(os.getenv("NIGHTMARE_TIMEOUT"))

  if args[0] in ["--attach", "-A"]:
    if len(args) == 1:
      usage()
      sys.exit(1)
    else:
      pid = int(args[1])
      if timeout != 0:
        # Schedule a timer to detach from the process after some seconds
        timer = threading.Timer(timeout, kill_process, (tr, False, ))
        timer.start()
      tr.attach(pid)
  else:    
    if timeout != 0:
      # Schedule a timer to kill the process after 5 seconds
      timer = threading.Timer(timeout, kill_process, (tr, True, ))
      timer.start()
    tr.execute(" ".join(args))
    tr.run()

  signal = tr.getCurrentSignal()
  signal_name = signal_to_name(signal)
  ignore_list = ["Unknown", "SIGUSR1", "SIGUSR2", "SIGTTIN", "SIGPIPE", "SIGINT"]
  while signal is None or signal_name in ignore_list:
    signal = tr.getCurrentSignal()
    signal_name = signal_to_name(signal)
    try:
      tr.run()
    except:
      break

  if timeout != 0:
    timer.cancel()
  # Don't do anything else, the process is gone
  if os.name != "nt" and not tr.attached:
    return None

  if signal is not None:
    print tr, hex(signal)
    print " ".join(sys.argv)
    crash_name = os.getenv("NFP_INFO_CRASH")

    # Create the object to store all the crash data
    crash_data = CCrashData(tr.getProgramCounter(), sig2name(signal))
    if crash_name is None:
      crash_name = "info.crash"
    #f = open(crash_name, "wb")

    exploitability_reason = None
    if os.name != "nt" and signal == 4:
      # Due to illegal instruction
      exploitable = EXPLOITABLE
      exploitability_reason = "Illegal instruction"
    elif os.name == "nt" and signal in [0xc0000096, 0xc000001d]:
      # Due to illegal or privileged instruction
      exploitable = EXPLOITABLE
      if signal == 0xc000001d:
        exploitability_reason = "Illegal instruction"
      else:
        exploitability_reason = "Privileged instruction"
    else:
      exploitable = NOT_EXPLOITABLE

    crash_data.add_data("process", "pid", tr.getPid())
    if os.name == "nt":
      print "Process %d crashed with exception 0x%x (%s)" % (tr.getPid(), signal, win32_exc_to_name(signal))
    else:
      print "Process %d crashed with signal %d (%s)" % (tr.getPid(), signal, signal_to_name(signal))

    i = 0
    for t in tr.getThreads():
      i += 1
      crash_data.add_data("threads", "%d" % i, t)

    stack_trace = tr.getStackTrace()
    total = len(stack_trace)
    i = 0
    for x in stack_trace:
      i += 1
      sym = tr.getSymByAddr(x[0], exact=False)
      if sym is None:
        sym = ""
      
      crash_data.add_data("stack trace", "%d" % i, [x[0], str(sym)])
      total -= 1

    regs = tr.getRegisterContext().getRegisters()
    for reg in regs:
      crash_data.add_data("registers", reg, regs[reg])
      if reg.startswith("r"):
        line = reg.ljust(5) + "%016x" % regs[reg]
        try:
          mem = tr.readMemory(regs[reg], 32)
          mem = base64.b64encode(mem)
          crash_data.add_data("registers memory", reg, mem)
          line += "\t" + repr(mem)
        except:
          pass

    for reg in COMMON_REGS:
      if reg in regs:
        if reg in crash_data.data["registers memory"]:
          print reg, hex(regs[reg]), repr(base64.b64decode(crash_data.data["registers memory"][reg]))
        else:
          print reg, hex(regs[reg])
    print

    total_around = 40
    if 'rip' in regs or 'rsp' in regs or 'rbp' in regs:
      if len("%08x" % regs['rip']) > 8 or len("%08x" % regs['rsp']) > 8 or len("%08x" % regs['rbp']) > 8:
        mode = CS_MODE_64
      else:
        mode = CS_MODE_32
    else:
      mode = CS_MODE_32

    md = Cs(CS_ARCH_X86, mode)
    md.skipdata = True
    pc = tr.getProgramCounter()
    crash_mnem = None
    crash_ops = None
    try:
      pc_mem = tr.readMemory(pc-total_around/2, total_around)
      offset = regs["rip"]-total_around/2

      ret = []
      found = False
      for x in md.disasm(pc_mem, 0):
        line = "%016x %s %s" % ((offset + x.address), x.mnemonic, x.op_str)
        crash_data.add_data("disassembly", offset + x.address, "%s %s" %(x.mnemonic, x.op_str))
        if offset + x.address == pc:
          crash_data.disasm = [x.address + offset, "%s %s" %(x.mnemonic, x.op_str)]
          line += "\t\t<--------- CRASH"
          print line
          found = True
        ret.append(line)

      if not found:
        offset = pc = tr.getProgramCounter()
        pc_mem = tr.readMemory(pc, total_around)
        for x in md.disasm(pc_mem, 0):
          line = "%016x %s %s" % ((offset + x.address), x.mnemonic, x.op_str)
          if offset + x.address == pc:
            line += "\t\t<--------- CRASH"
            crash_data.disasm = [x.address + offset, "%s %s" % (x.mnemonic, x.op_str)]
          print line
    except:
      # Due to invalid memory at $PC
      if signal != 6:
        exploitable = True
        exploitability_reason = "Invalid memory at program counter"
      print "Exception:", sys.exc_info()[1]

    if crash_mnem:
      if crash_mnem in ["call", "jmp"] or \
         crash_mnem.startswith("jmp") or \
         crash_mnem.startswith("call"):
        if crash_ops.find("[") > -1:
          # Due to jump/call with a register that maybe controllable
          exploitable = EXPLOITABLE
          exploitability_reason = "Jump or call with a probably controllable register"
      elif crash_mnem.startswith(".byte"):
        # Due to illegal instruction
        exploitable = MAYBE_EXPLOITABLE
        exploitability_reason = "Illegal instruction"
      elif crash_mnem.startswith("in") or \
           crash_mnem.startswith("out") or \
           crash_mnem in ["hlt", "iret", "clts", "lgdt", "lidt",
                                     "lldt", "lmsw", "ltr", "cli", "sti"]:
        if crash_mnem != "int":
          # Due to privileged instruction (which makes no sense in user-land)
          exploitable = MAYBE_EXPLOITABLE
          exploitability_reason = "Privileged instruction"

    #print >>f
    #print >>f, "Maps:"
    i = 0
    for m in tr.getMemoryMaps():
      i += 1
      line = "%016x %s %s %s" % (m[0], str(m[1]).rjust(8), get_permision_str(m[2]), m[3])
      crash_data.add_data("memory maps", "%d" % i, m)
      #print >>f, line

    #print >>f
    if exploitable > 0:
      crash_data.exploitable = is_exploitable(exploitable)
      crash_data.add_data("exploitability", "reason", exploitability_reason)
      #print >>f, "Exploitable: %s. %s." % (is_exploitable(exploitable), exploitability_reason)
    else:
      #print >>f, "Exploitable: Unknown."
      pass

    crash_data_buf = crash_data.dump_json()
    crash_data_dict = crash_data.dump_dict()
    print "Yep, we got a crash! \o/"
    print
    #print "Dumping JSON...."
    #print crash_data_buf
    #print 

  if tr.attached:
    try:
      tr.kill()
    except:
      pass
  try:
    tr.release()
  except:
    pass

  return crash_data_dict
示例#6
0
def main(args):
    crash_data_dict = None
    tr = vtrace.getTrace()

    global timeout
    if os.getenv("NIGHTMARE_TIMEOUT"):
        timeout = float(os.getenv("NIGHTMARE_TIMEOUT"))

    if args[0] in ["--attach", "-A"]:
        if len(args) == 1:
            usage()
            sys.exit(1)
        else:
            pid = int(args[1])
            # Schedule a timer to detach from the process after some seconds
            timer = threading.Timer(timeout, kill_process, (
                tr,
                False,
            ))
            timer.start()
            tr.attach(pid)
    else:
        # Schedule a timer to kill the process after 5 seconds
        timer = threading.Timer(timeout, kill_process, (
            tr,
            True,
        ))
        timer.start()
        tr.execute(" ".join(args))
        tr.run()

    signal = tr.getCurrentSignal()
    signal_name = signal_to_name(signal)
    ignore_list = [
        "Unknown", "SIGUSR1", "SIGUSR2", "SIGTTIN", "SIGPIPE", "SIGINT"
    ]
    while signal is None or signal_name in ignore_list:
        signal = tr.getCurrentSignal()
        signal_name = signal_to_name(signal)
        try:
            tr.run()
        except:
            break

    timer.cancel()
    # Don't do anything else, the process is gone
    if os.name != "nt" and not tr.attached:
        return None

    if signal is not None:
        print tr, hex(signal)
        print " ".join(sys.argv)
        crash_name = os.getenv("NFP_INFO_CRASH")

        # Create the object to store all the crash data
        crash_data = CCrashData(tr.getProgramCounter(), sig2name(signal))
        if crash_name is None:
            crash_name = "info.crash"
        #f = open(crash_name, "wb")

        exploitability_reason = None
        if os.name != "nt" and signal == 4:
            # Due to illegal instruction
            exploitable = EXPLOITABLE
            exploitability_reason = "Illegal instruction"
        elif os.name == "nt" and signal in [0xc0000096, 0xc000001d]:
            # Due to illegal or privileged instruction
            exploitable = EXPLOITABLE
            if signal == 0xc000001d:
                exploitability_reason = "Illegal instruction"
            else:
                exploitability_reason = "Privileged instruction"
        else:
            exploitable = NOT_EXPLOITABLE

        crash_data.add_data("process", "pid", tr.getPid())
        if os.name == "nt":
            print "Process %d crashed with exception 0x%x (%s)" % (
                tr.getPid(), signal, win32_exc_to_name(signal))
        else:
            print "Process %d crashed with signal %d (%s)" % (
                tr.getPid(), signal, signal_to_name(signal))

        i = 0
        for t in tr.getThreads():
            i += 1
            crash_data.add_data("threads", "%d" % i, t)

        stack_trace = tr.getStackTrace()
        total = len(stack_trace)
        i = 0
        for x in stack_trace:
            i += 1
            sym = tr.getSymByAddr(x[0], exact=False)
            if sym is None:
                sym = ""

            crash_data.add_data("stack trace", "%d" % i, [x[0], str(sym)])
            total -= 1

        regs = tr.getRegisterContext().getRegisters()
        for reg in regs:
            crash_data.add_data("registers", reg, regs[reg])
            if reg.startswith("r"):
                line = reg.ljust(5) + "%016x" % regs[reg]
                try:
                    mem = tr.readMemory(regs[reg], 32)
                    mem = base64.b64encode(mem)
                    crash_data.add_data("registers memory", reg, mem)
                    line += "\t" + repr(mem)
                except:
                    pass

        for reg in COMMON_REGS:
            if reg in regs:
                if reg in crash_data.data["registers memory"]:
                    print reg, hex(regs[reg]), repr(
                        base64.b64decode(
                            crash_data.data["registers memory"][reg]))
                else:
                    print reg, hex(regs[reg])
        print

        total_around = 40
        if 'rip' in regs:
            if len("%08x" % regs['rip']) > 8:
                decoder = Decode64Bits
            else:
                decoder = Decode32Bits
        else:
            decoder = Decode32Bits

        pc = tr.getProgramCounter()
        pc_line = None
        try:
            pc_mem = tr.readMemory(pc - total_around / 2, total_around)
            offset = regs["rip"] - total_around / 2

            ret = []
            found = False
            for x in Decode(0, pc_mem, decoder):
                line = "%016x %s" % ((offset + x.offset), str(x))
                crash_data.add_data("disassembly", offset + x.offset, str(x))
                if offset + x.offset == pc:
                    crash_data.disasm = [x.offset + offset, str(x)]
                    line += "\t\t<--------- CRASH"
                    print line
                    pc_line = x
                    found = True
                ret.append(line)
            if found:
                #print "\n".join(ret)
                pass
            else:
                offset = pc = tr.getProgramCounter()
                pc_mem = tr.readMemory(pc, total_around)
                for x in Decode(0, pc_mem, decoder):
                    line = "%016x %s" % ((offset + x.offset), str(x))
                    if offset + x.offset == pc:
                        line += "\t\t<--------- CRASH"
                        pc_line = x
                    print line
        except:
            # Due to invalid memory at $PC
            if signal != 6:
                exploitable = True
                exploitability_reason = "Invalid memory at program counter"
            print "Exception:", sys.exc_info()[1]

        if pc_line:
            if str(pc_line.mnemonic) in ["CALL", "JMP"] or \
               str(pc_line.mnemonic).startswith("JMP") or \
               str(pc_line.mnemonic).startswith("CALL"):
                if str(pc_line.operands).find("[") > -1:
                    # Due to jump/call with a register that maybe controllable
                    exploitable = EXPLOITABLE
                    exploitability_reason = "Jump or call with a probably controllable register"
            elif str(pc_line.mnemonic).startswith("DB "):
                # Due to illegal instruction
                exploitable = MAYBE_EXPLOITABLE
                exploitability_reason = "Illegal instruction"
            elif str(pc_line.mnemonic).startswith("IN") or \
                 str(pc_line.mnemonic).startswith("OUT") or \
                 str(pc_line.mnemonic) in ["HLT", "IRET", "CLTS", "LGDT", "LIDT",
                                           "LLDT", "LMSW", "LTR", "CLI", "STI"]:
                if str(pc_line.mnemonic) != "INT":
                    # Due to privileged instruction (which makes no sense in user-land)
                    exploitable = MAYBE_EXPLOITABLE
                    exploitability_reason = "Privileged instruction"

        #print >>f
        #print >>f, "Maps:"
        i = 0
        for m in tr.getMemoryMaps():
            i += 1
            line = "%016x %s %s %s" % (m[0], str(
                m[1]).rjust(8), get_permision_str(m[2]), m[3])
            crash_data.add_data("memory maps", "%d" % i, m)
            #print >>f, line

        #print >>f
        if exploitable > 0:
            crash_data.exploitable = is_exploitable(exploitable)
            crash_data.add_data("exploitability", "reason",
                                exploitability_reason)
            #print >>f, "Exploitable: %s. %s." % (is_exploitable(exploitable), exploitability_reason)
        else:
            #print >>f, "Exploitable: Unknown."
            pass

        crash_data_buf = crash_data.dump_json()
        crash_data_dict = crash_data.dump_dict()
        print "Yep, we got a crash! \o/"
        print
        #print "Dumping JSON...."
        #print crash_data_buf
        #print

    if tr.attached:
        try:
            tr.kill()
        except:
            pass
    try:
        tr.release()
    except:
        pass

    return crash_data_dict