转载

剑走偏锋：基于静态检测的IE漏洞检测工具IEFuzz

本文主要分享一款静态的IE浏览器模糊测试工具，该工具被称为IEFuzz。我们知道，像其他大部分软件一样，浏览器也往往通过两种方式进行模糊测试，一种为静态，另外一种则为动态。

在此前，我们在其他文章中也了解过其他的Fuzzer，如X-Fuzzer，PKAV HTTP Fuzzer，也了解过相关的Fuzzing方法,如从零开始学Fuzzing系列：浏览器挖掘框架Morph诞生记等。本文主要讲述静态浏览器Fuzzer的情况。

在当下，动态浏览器Fuzzer占据着主流，因为它们的运行效率高（纯粹是用JavaScript写的）。然而，当我们在进行动态Fuzzing 的时候，往往面临着一个共同的问题，就是“异常事件重现”。所以一般我们在构建JS 浏览器 Fuzzer时都需要非常仔细，否则在运行过程中可能会由于浏览器Fuzzer是动态的，将导致异常事件不可重现。

所以，在Fuzzing之前，我们往往需要考虑以下几个方面的问题：

1、测试实例（样本）如何生成？ 2、对异常事件如何监控？ 3、对于引起异常事件的测试实例如何保存？ 4、异常事件如何重现？

对于上述使用动态 Fuzzer面临的问题，另外一种解决思路是，采用静态Fuzzer进行检测。虽然静态Fuzzer效率较低，但是一般都可以重现异常事件的。

IEFuzz简介

该静态IE fuzzer 是用python编写的，包括使用到以下模块:

pywin32com ——用于加载或者重载*.html测试实例；

pydbg——用于监控IE浏览器的异常事件；

paimei——用于生成异常事件的dump文件，下载链接为： paimei 。

IEFuzz使用配置

为了能够顺利进行Fuzzing,我们需要在IE设置中做如下更改。

1、首先，因为Fuzzer 需要在本地加载测试实例（如加载路径为file://c:/fuzzer/testcases/temp.html）所以应该先将IE的ActiveX告警提示关闭，通过如下步骤：

（1）工具->Internet 选项->安全->自定义级别；

（2）随后将ActiveX告警提示关闭。

2、接着，为了能够使用 Python win32com来监控IE，我们还需要关闭IE的保护模块。但是请注意其中的风险。

（1）工具->Internet 选项->安全->受信任的站点：自定义级别为低；

（2）工具->Internet 选项->安全->Internet:自定义级别为中，同时关闭保护模式；

（3）工具->Internet 选项->安全->受限站点：关闭保护模式。

编写测试实例

首先我们可以基于该fuzzer编写自己的静态测试用例生成器。之后可以将其放在/TestCases文件夹中。在GitHub源码中，也提供了一个样本以供参考：’TestCases/SampleTestCase.py。因源码篇幅较长，链接如下，

TestCases/SampleTestCase.py

在编写测试实例时也请注意，实例中需要包含一个TestCase类以及getFinalTestCase()方法。 getFinalTestCase()方法需要能够返回完整的 Html页面。

在动态fuzzer的应用过程中，需要从对象中提取不同的Html元素属性，然后在运行状态下进行模糊检测。而对于一个静态Fuzzer，我们能够在我们的python测试实例中预定义html元素以及属性，并将之作为字典dict。

dict举例如下：

attr = {'CANVAS':['height','width','getContext', ... , ... , ... ]}

对于这种属性生成列表，也提供了一个JavaScript 应用供参考。

<html>     <head>     <script>     /*     ----------------------------------------------------------------------------     "THE BEER-WARE LICENSE" (Revision 42):     <debasishm89_at_gmail.com> wrote this file.  As long as you retain this notice you     can do whatever you want with this stuff. If we meet some day, and you think     this stuff is worth it, you can buy me a beer in return.   Debasish Mandal     ----------------------------------------------------------------------------     This JS code should be used for generating a python dict. of element attributes of different HTML elements.     In case of dynamic fuzzer, its usually generated on the fly, since its a static fuzzer you need to pre define html elements and their attributes to your test case.     Other wise you can use a list of well known attributes. It's completely your choice, how you write your test case.      */     function getEleAttributes(ele){     buff = "['"     for( var p in ele ){     buff += p + "','";     }     buff = buff.slice(0, -2) + "]";     return buff     }     function generate() {     /*     Add your element list in this here and open this html in IE.     */     var elements = ["ARTICLE","ASISE","B","BDI","BDO", "BLOCKQUOTE","BR","BUTTON","CANVAS","CAPTION","CITE","COL","CODE","COMMAND","DATALIST","DD","DEL","DETAILS","DFN","DL","DT", "EM","STYLE","FIELDSET","FIGCAPTION","SCRIPT", "EMBED","FIGURE","FOOTER","HEADER","HGROUP","HR","I","INPUT","INS","KEYGEN","KBD","LEGEND","MARK","MENU","METER","NAV","NOSCRIPT","OPTGROUP","OUTPUT","P","PARAM","PRE","PROGRESS","Q","RP","RT","RUBY","S","SAMP","SECTION","SELECT","SMALL","SOURCE","SPAN","SUP","TH","THEAD","TIME","OBJECT","IFRAME","TEXTAREA","TRACK","U","VAR","WBR","FORM","A","BODY","HTML","DIV","TABLE","AREA","TD","TR","LINK","BASE","FONT","HEAD","IMG","MAP","META","OL","LI","TBODY","TITLE","H1","BLINK","AREA","COL","SPAN","FRAMESET","FRAME","UL","OPTION","NOFRAMES","TFOOT","XMP","ISINDEX","CENTER","HR","LABEL","OPTGROUP","AUDIO","VIDEO","TEMPLATE","SVG"]     main_buff = "ele_dict = {"     for (ele in elements){     var id_0 = document.createElement( elements[ele] );     all_props = getEleAttributes(id_0)     main_buff += "'"+elements[ele]      main_buff += "':"     main_buff += all_props     main_buff += ","     }     main_buff = main_buff.slice(0,-1)     main_buff += "}"     document.getElementById('result').innerHTML = main_buff;     }     </script>     </head>     <body onload='generate();'>     <b>Output : (Copy paste following python dictionary to your testcase generator script and fuzz using them )</b></br><textarea id="result" rows="100" cols="200"></textarea>     </body>     </html>

参考链接为： Generate_Elements_Dict.html

IEFuzz运行步骤

那么IEFuzz 是如何运行的？请参考往下步骤:

1、启动IE； 2、将iexplore.exe进程挂载到 Debugger(pydbg) 中，然后对其父进程以及子进程所有类型的事件进行监控； 3、生成一个静态实例(Html + JavaScript)； 4、通过win32COM加载该静态实例到本地（如file://c:/fuzzer/testcases/temp.html） 5、如果没有产生异常事件，那么就需要重新生成一个Html测试实例，然后再使用win32COM （python模块）进行重载。（在这里先不关闭IE或者重新打开IE。可以说，我们只是重新刷新了页面，但是页面的代码或者内容是不同的，这也给测试节省了时间）； 6、在出现异常事件时，先复制或者保存测试实例到一个单独的文件夹，然后再关闭IE进程； 7、返回步骤1。

Demo 演示视频