ROP漏洞利用脚本的语义还原和自动化移植方法  

Semantic Restoration and Automatic Transplant for ROP Exploit Script

作　　者：施瑞恒 朱云聪 赵易如 赵磊[1] SHI Rui-heng;ZHU Yun-cong;ZHAO Yi-ru;ZHAO Lei(Key Laboratory of Aerospace Information Security and Trusted Computing,Ministry of Education,School of Cyber Science and Engineering,Wuhan University,Wuhan 430072,China)

机构地区：[1]空天信息安全与可信计算教育部重点实验室(武汉大学国家网络安全学院),武汉430072

出　　处：《计算机科学》2022年第11期49-54,共6页Computer Science

基　　金：国家自然科学基金(62172305,U1836112);湖北省重点研发计划(2020BAA003)。

摘　　要：漏洞利用脚本在安全研究中有着极为重要的作用,安全研究人员需要研究漏洞利用脚本触发以及利用漏洞的方式,来对漏洞程序进行有效的防护。然而,从网络中获取的大量漏洞利用脚本的通用性和适配性都很差,局限于特定的操作系统及环境,会因运行环境的改变而失效。这个问题在基于ROP的漏洞利用脚本中尤为普遍,使得ROP漏洞利用脚本的移植利用分析变得非常困难,需要依赖于大量的人工辅助与专家经验。针对ROP漏洞利用脚本的移植利用难题,提出了ROPTrans系统,通过ROP漏洞利用脚本的语义识别,定位与运行环境相关的关键语义及其变量,随后自动化适配环境,生成目标环境下的ROP漏洞利用脚本,以实现ROP脚本的自动化移植。实验结果表明,ROPTrans的成功率可以到达80%,验证了该方法的有效性。Exploit script plays an important role in security research.Security researchers need to study how the exploit script trigger and exploit the vulnerability,so as to effectively protect the vulnerable program.However,many exploit scripts obtained from network have poor generality and adaptability.They are limited to specific operating system and execution environment,and the change of environment will lead to execution failure.This problem is particular common in exploit scripts based on return-orinted programming(ROP),makes the transplanting and exploit analysis of ROP scripts are difficult and rely on manual assistance and expert knowledge.To solve this problem,we propose ROPTrans system,which locates key semantics and its variables related to the running environment through analysing the semantic of ROP script,and then automatically generates ROP script adapted to the target environment,so as to achieve the target of transplanting ROP scripts automatically.Experimental results show that the success rate of ROPTrans can reach up to 80%,which verifies the effectiveness of our method.

关 键 词：漏洞利用 控制流劫持 ROP 移植 

分 类 号：TP399[自动化与计算机技术—计算机应用技术]