【作者】 彭青白；

【导师】 吴永英；

【作者基本信息】 华中科技大学 ， 计算机系统结构， 2009， 硕士

【摘要】 随着计算机及网络技术的飞速发展,计算机网络犯罪事件层出不穷,打击计算机网络犯罪日显重要。此外,信息战不可避免地会成为未来新的作战方式。因此,研究漏洞挖掘与利用技术,无论是从打击计算机网络犯罪还是从信息对抗来说都具有重要的理论意义和实用价值。分析了目前两种主流的漏洞挖掘方法,说明了这些方法进行漏洞挖掘的技术思路,总结了各自优缺点,在此基础上给出了漏洞分析的基本步骤。围绕漏洞利用技术的发展,分析了栈溢出和堆溢出的基本原理和利用技巧。在总结传统漏洞挖掘方法不足的基础上,探索性地给出了一种基于逆向工程和Fuzzing测试的漏洞挖掘方法,阐述了该方法的指导思想和技术思路。基于所提出的漏洞挖掘方法,围绕超星阅览器存在的一个0day安全漏洞,说明了该漏洞的详细挖掘过程,给出了该漏洞的形成原因。针对所挖掘出的超星阅览器的漏洞,探讨了利用该漏洞的可行性,给出了漏洞利用程序的设计原则和设计思想,设计了相应的漏洞利用程序。围绕漏洞利用程序实现中涉及到的关键技术,重点说明了Shellcode编写的要点,包括返回地址的定位、API(Application Programming Interface)函数调用地址的动态定位以及对Shellcode的安全保护措施。实际运行结果表明,基于逆向工程和Fuzzing测试的漏洞挖掘方法是一种兼顾了自动化和目的性的漏洞挖掘方法,能有效地挖掘出某些未知漏洞。而面向SSR(Super Star Reader)漏洞的利用程序除具有较强的通用性和稳定性外,还能在多个操作系统中运行,并能成功避免主流反病毒软件的监控和查杀,具有一定的实用价值。更多还原

【Abstract】 With the rapid development of computer and network technology, cyber-crimes are emerging in an endless stream, hence, it has being increasingly important to crack down cyber-crimes. Besides, information warfare will inevitably become a new way of warfare in future. Therefore, the research of vulnerability detecting and exploiting technologies is very significative for both beating cyber-crimes and information antagonizing.Based on the analysis of two existing mainstream vulnerability detecting methods, the technical characteristics of the methods are described, their advantages and disadvantages are summarized, and the basic process of vulnerability analyzing is illustrated as well. And then, referring to the development of exploiting technology, the basic principle and exploiting skills of stack overflow and heap overflow, which are the mainstream exploiting technologies are discussed. At analyzing the weak points of traditional methods of vulnerability detecting, an approach of vulnerability detecting based on reverse engineering and Fuzzing test is exploratory proposed in this paper, and the guiding ideologies and technical ideas of this approach are also discussed. Moreover, based on the approach proposed before, the detecting process is described and the cause of the 0day vulnerability from Super Star Reader is presented.For the given 0day vulnerability which is detected before, the feasibility of exploiting the 0day vulnerability is discussed, the design principles and ideas of the vulnerability exploiting program are given out, and the relevant program is designed. Concerning the key technologies involved in the realization of the vulnerability exploiting program, the key points how to write Shellcode are discussed in this paper, including the location of the return address, the dynamic positioning of the call addresses of Application Programming Interfaces and the security measures for the Shellcode.The experiment results conclude that the detecting method based on reverse engineering and Fuzzing test gives attention to both automation and purposiveness, and it can detect some unknown vulnerabilities effectively. While, besides its universal property and stability, the practical exploiting program for the 0day vulnerability can run on several operating systems, and avoid the monitoring and killing by antivirus software successfully.更多还原