WinDBG 技巧：剖析器漏洞是否可以被利用 (!exploitable 命令)

微軟在最近的CanSec West 發布了一個開源的WinDBG 外掛程式 MSEC.dll ， 該外掛程式可以智能剖析器的漏洞是否可以被駭客利用。 可以去MSEC 開源項目的首頁： http://msecdbg.codeplex.com/ 下載該外掛程式。 解壓之後，把  MSEC.dll 放到 WinDBG 安裝目錄的的 winext 子目錄下。

 

啟動WinDBG的之後， 使用 !load MSEC 來裝載該外掛程式。接下來就可以用 !exploitable 命令來分析漏洞了。 通常加上-v 選項來列印詳細的資訊(!exploitable -v)。

 

下面示範當程式出現null 指標訪問漏洞的時候如何利用!exploitable 來分析：

 

0:000> g
ModLoad: 7e410000 7e4a1000   C:/WINDOWS/system32/USER32.dll
ModLoad: 77f10000 77f59000   C:/WINDOWS/system32/GDI32.dll
ModLoad: 76390000 763ad000   C:/WINDOWS/system32/IMM32.DLL
ModLoad: 77dd0000 77e6b000   C:/WINDOWS/system32/ADVAPI32.dll
ModLoad: 77e70000 77f02000   C:/WINDOWS/system32/RPCRT4.dll
ModLoad: 77fe0000 77ff1000   C:/WINDOWS/system32/Secur32.dll
ModLoad: 629c0000 629c9000   C:/WINDOWS/system32/LPK.DLL
ModLoad: 74d90000 74dfb000   C:/WINDOWS/system32/USP10.dll
ModLoad: 77b40000 77b62000   C:/WINDOWS/system32/Apphelp.dll
ModLoad: 77c00000 77c08000   C:/WINDOWS/system32/VERSION.dll
(a3c.10e0): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000000 ecx=785bb6f8 edx=00000000 esi=00000001 edi=0040337c
eip=00401002 esp=0012ff80 ebp=0012ffc0 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
TestConsole!wmain+0x2:
00401002 8800            mov     byte ptr [eax],al          ds:0023:00000000=??

0:000> !load MSEC.dll
0:000> !exploitable -v
HostMachine/HostUser
Executing Processor Architecture is x86
Debuggee is in User Mode
Debuggee is a live user mode debugging session on the local machine
Event Type: Exception
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:/WINDOWS/system32/kernel32.dll -
Exception Faulting Address: 0x0
First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)
Exception Sub-Type: Write Access Violation

Exception Hash (Major/Minor): 0x34777202.0x123b6b02

Stack Trace:
TestConsole!wmain+0x2
TestConsole!__tmainCRTStartup+0x10f
kernel32!RegisterWaitForInputIdle+0x49
Instruction Address: 0x401002

Description: User Mode Write AV near NULL
Short Description: WriteAV
Exploitability Classification: PROBABLY_EXPLOITABLE
Recommended Bug Title: Probably Exploitable - User Mode Write AV near NULL starting at TestConsole!wmain+0x2 (Hash=0x34777202.0x123b6b02)

User mode write access violations that are near NULL are probably exploitable.