automatic_exploit_generation 💎

---

• Description
  • Limitations
• How It Works
• Setup
• Development
• Usage
  • As a CLI Tool
    • Recommend Exploiters to Use
    • Exploit a Binary
    • Get Help
  • As a Python Module

---

Description

automatic_exploit_generation is the module of OpenCRS that deals with automatically generating exploits.

Limitations

• ELF format
• x86 architecture

How It Works

With the input streams, mitigations, and vulnerabilities for the executable to exploit, the module will iterate through the implemented submodules and recommend the ones that may produce a workable exploit. In the case of Zeratool, which is currently the only module accessible, a new Docker container is built with which gRPC communication occurs. The submodule decides which configuration to use for Zeratool based on the available information (both input and extracted).

Setup

1. Make sure you have set up the repositories and Python environment according to the top-level instructions. That is:

   • Docker is installed and is properly running. Check using:

     docker version
     docker ps -a
     docker run --rm hello-world

     These commands should run without errors.

   • The current module repository and all other module repositories (particularly the zeratool_lib repository and the commons repository) are cloned in the same directory.

   • You are running all commands inside a Python virtual environment. There should be (.venv) prefix to your prompt.

   • You have installed Poetry in the virtual environment. If you run:

     which poetry

     you should get a path ending with .venv/bin/poetry.

2. Disable the Python Keyring:

   export PYTHON_KEYRING_BACKEND=keyring.backends.null.Keyring

   This is a problem that may occur in certain situations, preventing Poetry from getting packages.

3. Install the required packages with Poetry (based on pyprojects.toml):

   poetry install --only main

4. Build the Docker image:

        docker build --tag zeratool_lib -f docker/Dockerfile.zeratool_lib .

5. Ensure the Docker API is accessible by:

   • Running the module as root; or
   • Changing the Docker socket permissions (unsecure approach) via sudo chmod 777 /var/run/docker.sock.

6. Build the arguments' adapter via cd others/argv_adapter && make.

Development

If you make modifications to the Protobuf definition, please regenerate the Python sources with console poetry run python3 -m grpc_tools.protoc -I. --python_out=. --grpc_python_out=. ./automatic_exploit_generation/exploiters/zeratool/protobuf/exploit.proto

Usage

As a CLI Tool

Recommend Exploiters to Use

➜ poetry run automatic_exploit_generation recommend  --elf=key-manager.elf --stream=STDIN --mitigation=NX --weakness=STACK_OUT_OF_BOUND_WRITE
Exploiters that can be used considering the context are:
- ZERATOOL

Exploit a Binary

➜ poetry run automatic_exploit_generation exploit --exploiter=ZERATOOL --elf=key-manager.elf --stream=STDIN --mitigation=NX --weakness=STACK_OUT_OF_BOUND_WRITE
The exploiter could generate an exploit with the outcome of DENIAL_OF_SERVICE and the following payloads:
- For STDIN:

00000000: 61 61 61 61 61 61 61 61                           aaaaaaaa

- For ARGUMENTS:

00000000: 61 61 61 61 61 61 61 61                           aaaaaaaa

Get help

➜ poetry run automatic_exploit_generation 
Usage: automatic_exploit_generation [OPTIONS] COMMAND [ARGS]...

  Exploits vulnerabilities in executables.

Options:
  --help  Show this message and exit.

Commands:
  exploit    Exploits vulnerabilities.
  recommend  Get suitable exploiters for a binary.

As a Python Module

from automatic_exploit_generation.exploiter_generator import (
    Exploiters,
    create_exploiter_by_name,
    get_suitable_exploiters,
)
from commons.input_streams import InputStreams
from commons.weaknesses import Weaknesses

elf = "key-manager.elf"
input_streams = InputStreams.STDIN
weakness_enum = Weaknesses

for exploiter in get_suitable_exploiters(
    elf, InputStreams.STDIN, None, Weaknesses.STACK_OUT_OF_BOUND_WRITE
):
  generated_exploit = exploiter.exploit()