Rooba
/
oss-fuzz
mirror of https://github.com/google/oss-fuzz.git
1
1
Fork 0
Code Issues Packages Projects Releases Wiki Activity
oss-fuzz/infra/experimental/SystemSan
History
jonathanmetzman a836616877
Delete Symlink Detection from syssan (#10479) 
I don't have time to work on it, and deploying it seriously breaks
libfuzzer on CF.
 		2023-06-07 21:23:57 -04:00
..
PoEs Rename execSan to SystemSan. (#8369) 2022-08-30 08:40:46 +10:00
Makefile Delete Symlink Detection from syssan (#10479) 2023-06-07 21:23:57 -04:00
README.md Rename execSan to SystemSan. (#8369) 2022-08-30 08:40:46 +10:00
SystemSan.cpp Delete Symlink Detection from syssan (#10479) 2023-06-07 21:23:57 -04:00
inspect_dns.cpp SystemSan: log correct dns type and class (#9476) 2023-01-23 09:48:14 +11:00
inspect_dns.h SystemSan: arbitrary DNS resolution detection (#9119) 2022-12-06 08:23:32 -05:00
inspect_utils.cpp Delete Symlink Detection from syssan (#10479) 2023-06-07 21:23:57 -04:00
inspect_utils.h Revert "[SystemSan] Add feature for opting out." (#9386) 2023-01-10 13:09:39 +11:00
target.cpp Rename execSan to SystemSan. (#8369) 2022-08-30 08:40:46 +10:00
target_dns.cpp [NFC] Minor SysSan improvements (#9149) 2022-12-14 08:40:06 +11:00
target_file.cpp Rename execSan to SystemSan. (#8369) 2022-08-30 08:40:46 +10:00
vuln.dict SystemSan: arbitrary DNS resolution detection (#9119) 2022-12-06 08:23:32 -05:00

README.md

System Sanitizers

We use ptrace to instrument system calls made by the target program to detect various vulnerabilities.

Command injection

This detector currently works by

  • Checking if execve is called with /tmp/tripwire (which comes from our dictionary).
  • Checking if execve is invoking a shell with invalid syntax. This is likely caused by our input.

Arbitrary file open

TODO: documentation.

Proof of concept

Cleanup

Note this will delete /tmp/tripwire if it exists.

make clean

Run test

Note this will overwrite /tmp/tripwire if it exists.

make test

Look for one of the following lines:

===BUG DETECTED: Shell injection===

which indicates the detection of executing the planted /tmp/tripwire.

===BUG DETECTED: Shell corruption===

which indicates the detection of executing a syntactic erroneous command.

Command injection PoC in Python with pytorch-lightning

With SystemSan, Artheris can detect a shell injection bug in version v1.5.10 of pytorch-lightning.

make pytorch-lightning-1.5.10

Command injection PoC in JavaScript with shell-quote

With SystemSan, Jsfuzz can detect a shell corrpution bug in the latest version (v1.7.3) of shell-quote without any seed.

make node-shell-quote-v1.7.3

This is based on a shell injection exploit report of version v1.7.2 of shell-quote. SystemSan can also discover the same shell injection bug with a corpus file containing:

`:`/tmp/tripwire``:`

Trophies