Experimental Analysis & Refinement of a Guided Exploit Generation Technique for Language Virtual Machines

Creative Commons License

Yilmaz F., Sridhar M., Choi W.

Learning from Authoritative Security Experiment Results, Texas, Amerika Birleşik Devletleri, 08 Aralık 2020, ss.1-12, (Tam Metin Bildiri)

Özet

Background: We discussed GuidExp, a semi-automatic exploit generation tool, in our paper at ACSAC 2020. GuidExp generates an exploit script for a given ActionScript vulnerability. Unlike the other exploit generators, GuidExp does not use fuzzing or a symbolic execution; rather, it relies on human expertise to guide it in successfully discovering vulnerable execution paths. This paper augments our ACSAC paper and provides more details on the experiments we conducted.


Aim: We sought to show that \tool can generate working exploit scripts for real-world vulnerabilities in open- and closed-source ActionScript Virtual Machine (AVM) implementations. 


Data: We used community artifacts as \tool inputs: a ROP gadget sequence, used to generate a \tool sub-goal; a proof-of-concept (PoC) exploit script for CVE-2015-5119; and vulnerable AVM implementations.



Method: We conducted a series of experiments, where the results of each informed the development of the next. First, we tested \tool on an open-source AVM using a single ActionScript vulnerability (CVE-2015-5119). We measured the number of candidate slices generated by GuidExp, the number of candidate slices executed successfully, and the time required to achieve each exploit subgoal. We then implemented \tool optimization techniques based on what we learned and repeated the same experiment using the optimizations. Next, we ran the experiment using eleven different vulnerabilities in a closed-source AVM. Finally, we ran the original experiment using a larger search space to understand how less accurate human guidance might impact GuidExp's performance.


Results: Using an optimal search space (expert human guidance), GuidExp generated a successful exploit script for CVE-2015-5119 in an open-sourced AVM in just over 14 minutes. When the search space was increased by a factor of 2, the time increased to just over 59 hours. \tool generated successful exploit scripts for 11 vulnerabilities in closed-source Flash Player v11.2.202.262, with the longest completion time being just under 14 hours when using an optimal search space.


Conclusions: GuidExp needs to be human-guided to generate an exploit script. Its performance is greatly affected by the accuracy of the provided exploit subgoals.  Redundant instructions for an exploit subgoal significantly increase the search space and subsequently, the time that \tool needs to generate an exploit script.