劍走偏鋒：基于靜態檢測的IE漏洞檢測工具IEFuzz
本文主要分享一款靜態的IE瀏覽器模糊測試工具，該工具被稱為IEFuzz。我們知道，像其他大部分軟件一樣，瀏覽器也往往通過兩種方式進行模糊測試，一種為靜態，另外一種則為動態。
在此前，我們在其他文章中也了解過其他的Fuzzer，如X-Fuzzer，PKAV HTTP Fuzzer，也了解過相關的Fuzzing方法,如從零開始學Fuzzing系列：瀏覽器挖掘框架Morph誕生記等。本文主要講述靜態瀏覽器Fuzzer的情況。
在當下，動態瀏覽器Fuzzer占據著主流，因為它們的運行效率高(純粹是用JavaScript寫的)。然而，當我們在進行動態Fuzzing 的時候，往往面臨著一個共同的問題，就是“異常事件重現”。所以一般我們在構建JS 瀏覽器 Fuzzer時都需要非常仔細，否則在運行過程中可能會由于瀏覽器Fuzzer是動態的，將導致異常事件不可重現。
所以，在Fuzzing之前，我們往往需要考慮以下幾個方面的問題：
1、測試實例(樣本)如何生成? 2、對異常事件如何監控? 3、對于引起異常事件的測試實例如何保存? 4、異常事件如何重現?
對于上述使用動態 Fuzzer面臨的問題，另外一種解決思路是，采用靜態Fuzzer進行檢測。雖然靜態Fuzzer效率較低，但是一般都可以重現異常事件的。
IEFuzz簡介
該靜態IE fuzzer 是用python編寫的，包括使用到以下模塊:
pywin32com ——用于加載或者重載*.html測試實例;
pydbg——用于監控IE瀏覽器的異常事件;
paimei——用于生成異常事件的dump文件，下載鏈接為：paimei。
IEFuzz使用配置
為了能夠順利進行Fuzzing,我們需要在IE設置中做如下更改。
1、首先，因為Fuzzer 需要在本地加載測試實例(如加載路徑為file://c:/fuzzer/testcases/temp.html)所以應該先將IE的ActiveX告警提示關閉，通過如下步驟：
(1)工具->Internet 選項->安全->自定義級別;
(2)隨后將ActiveX告警提示關閉。
2、接著，為了能夠使用 Python win32com來監控IE，我們還需要關閉IE的保護模塊。但是請注意其中的風險。
(1)工具->Internet 選項->安全->受信任的站點：自定義級別為低;
(2)工具->Internet 選項->安全->Internet:自定義級別為中，同時關閉保護模式;
(3)工具->Internet 選項->安全->受限站點：關閉保護模式。
編寫測試實例
首先我們可以基于該fuzzer編寫自己的靜態測試用例生成器。之后可以將其放在/TestCases文件夾中。在GitHub源碼中， 也提供了一個樣本以供參考：’TestCases/SampleTestCase.py。因源碼篇幅較長，鏈接如下，
在編寫測試實例時也請注意，實例中需要包含一個TestCase類以及getFinalTestCase()方法。 getFinalTestCase()方法需要能夠返回完整的 Html頁面。
在動態fuzzer的應用過程中，需要從對象中提取不同的Html元素屬性，然后在運行狀態下進行模糊檢測。而對于一個靜態Fuzzer，我們能夠在我們的python測試實例中預定義html元素以及屬性，并將之作為字典dict。
dict舉例如下：
- attr = {'CANVAS':['height','width','getContext', ... , ... , ... ]}
對于這種屬性生成列表，也提供了一個JavaScript 應用供參考。
- <html>
- <head>
- <script>
- /*
- ----------------------------------------------------------------------------
- "THE BEER-WARE LICENSE" (Revision 42):
- <debasishm89_at_gmail.com> wrote this file. As long as you retain this notice you
- can do whatever you want with this stuff. If we meet some day, and you think
- this stuff is worth it, you can buy me a beer in return. Debasish Mandal
- ----------------------------------------------------------------------------
- This JS code should be used for generating a python dict. of element attributes of different HTML elements.
- In case of dynamic fuzzer, its usually generated on the fly, since its a static fuzzer you need to pre define html elements and their attributes to your test case.
- Other wise you can use a list of well known attributes. It's completely your choice, how you write your test case.
- */
- function getEleAttributes(ele){
- buff = "['"
- for( var p in ele ){
- buff += p + "','";
- }
- buff = buff.slice(0, -2) + "]";
- return buff
- }
- function generate() {
- /*
- Add your element list in this here and open this html in IE.
- */
- var elements = ["ARTICLE","ASISE","B","BDI","BDO", "BLOCKQUOTE","BR","BUTTON","CANVAS","CAPTION","CITE","COL","CODE","COMMAND","DATALIST","DD","DEL","DETAILS","DFN","DL","DT", "EM","STYLE","FIELDSET","FIGCAPTION","SCRIPT", "EMBED","FIGURE","FOOTER","HEADER","HGROUP","HR","I","INPUT","INS","KEYGEN","KBD","LEGEND","MARK","MENU","METER","NAV","NOSCRIPT","OPTGROUP","OUTPUT","P","PARAM","PRE","PROGRESS","Q","RP","RT","RUBY","S","SAMP","SECTION","SELECT","SMALL","SOURCE","SPAN","SUP","TH","THEAD","TIME","OBJECT","IFRAME","TEXTAREA","TRACK","U","VAR","WBR","FORM","A","BODY","HTML","DIV","TABLE","AREA","TD","TR","LINK","BASE","FONT","HEAD","IMG","MAP","META","OL","LI","TBODY","TITLE","H1","BLINK","AREA","COL","SPAN","FRAMESET","FRAME","UL","OPTION","NOFRAMES","TFOOT","XMP","ISINDEX","CENTER","HR","LABEL","OPTGROUP","AUDIO","VIDEO","TEMPLATE","SVG"]
- main_buff = "ele_dict = {"
- for (ele in elements){
- var id_0 = document.createElement( elements[ele] );
- all_props = getEleAttributes(id_0)
- main_buff += "'"+elements[ele]
- main_buff += "':"
- main_buff += all_props
- main_buff += ","
- }
- main_buff = main_buff.slice(0,-1)
- main_buff += "}"
- document.getElementById('result').innerHTML = main_buff;
- }
- </script>
- </head>
- <body onload='generate();'>
- <b>Output : (Copy paste following python dictionary to your testcase generator script and fuzz using them )</b></br><textarea id="result" rows="100" cols="200"></textarea>
- </body>
- </html>
參考鏈接為：Generate_Elements_Dict.html
IEFuzz運行步驟
那么IEFuzz 是如何運行的?請參考往下步驟:
1、啟動IE; 2、將iexplore.exe進程掛載到 Debugger(pydbg) 中，然后對其父進程以及子進程所有類型的事件進行監控; 3、生成一個靜態實例(Html + JavaScript); 4、通過win32COM加載該靜態實例到本地(如file://c:/fuzzer/testcases/temp.html) 5、如果沒有產生異常事件，那么就需要重新生成一個Html測試實例，然后再使用win32COM (python模塊)進行重載。(在這里先不關閉IE或者重新打開IE。可以說，我們只是重新刷新了頁面，但是頁面的代碼或者內容是不同的，這也給測試節省了時間); 6、在出現異常事件時，先復制或者保存測試實例到一個單獨的文件夾，然后再關閉IE進程; 7、返回步驟1。
