/FUGIO

FUGIO: Automatic Exploit Generation for PHP Object Injection Vulnerabilities

Primary LanguagePHP

FUGIO

FUGIO is the first automatic exploit generation (AEG) tool for PHP object injection (POI) vulnerabilities. When exploiting a POI vulnerability, an attacker crafts an injection object by carefully choosing its property values to invoke a chain of existing class methods or functions (gadgets) for finally triggering a sensitive function with attack payloads. The technique used in composing this exploit object is called property-oriented programming (POP). FUGIO identifies feasible POP gadget chains considering the availability of gadgets and their caller-callee relationships via static and dynamic analyses. FUGIO then conducts a feedback-driven fuzzing campaign for each identified POP chain, thus producing exploit objects. For more details, please refer to our paper, "FUGIO: Automatic Exploit Generation for PHP Object Injection Vulnerabilities", which will appear in USENIX Security 2022.

Installation

FUGIO is tested on a machine running Ubuntu 18.04. Python 3 and PHP (5.4, 5.6, or 7.2) are required to run FUGIO. We provide three Docker images depending on PHP versions in FUGIO-artifact. If you use the given Docker images, follow the instructions in Prepare Docker containers and then go to the phase 2.

Phase 1

  • Clone git repo

    git clone --recurse-submodules https://github.com/WSP-LAB/FUGIO.git
cd FUGIO

  • Install Docker

    • To install Docker CE, please follow the instructions in this link.
    • For our scripts not to ask you for sudo password, we assumed that you run Docker commands as a non-root user. Please follow the instructions in this link.

  • Run RabbitMQ Docker

    • You can set up RabbitMQ by running ./run_rabbitmq.sh.
      • Username: fugio
      • Password: fugio_password
      • RabbitMQ Management port: 15672

  • Install Python 3 pip

    sudo apt-get install -y python3-pip

  • Install PHP Composer

    php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" && \
php composer-setup.php && \
php -r "unlink('composer-setup.php');" && \
mv composer.phar /usr/local/bin/composer

  • Install PHP libraries

    • PHP 5.4: we installed PHP 5.4 by compiling source code 
      sudo apt-get install -y autoconf apache2-dev libxml2-dev libbz2-dev \
libcurl4-gnutls-dev libjpeg-dev libpng-dev libmcrypt-dev
sudo ln -s /usr/include/x86_64-linux-gnu/curl /usr/local/include/

wget -O /tmp/bison-2.6.tar.gz http://ftp.gnu.org/gnu/bison/bison-2.6.tar.gz
tar -xvf /tmp/bison-2.6.tar.gz -C /tmp
cd /tmp/bison-2.6
./configure --prefix=/usr/local/bison --with-libiconv-prefix=/usr/local/libiconv/
make
sudo make install
sudo ln -s /usr/local/bison/bin/bison /usr/bin/bison

git clone https://github.com/openssl/openssl.git /tmp/openssl
cd /tmp/openssl
git checkout OpenSSL_1_0_2-stable
./config shared
make
sudo make install

git clone https://github.com/php/php-src.git /tmp/php-src
cd /tmp/php-src
git checkout PHP-5.4
./buildconf
./configure --with-mysql --with-zlib --with-gd --with-mhash --with-mcrypt \
    --with-curl --with-openssl --with-zlib --with-jpeg-dir --with-png-dir --with-gettext \
    --with-pcre-regex --with-pdo-mysql --enable-calendar --enable-exif --with-bz2 \
    --enable-ftp --enable-mbstring --enable-shmop --enable-soap --enable-bcmath \
    --enable-sockets --enable-wddx --enable-zip --with-mysqli --with-apxs2=/usr/bin/apxs2
make
sudo make install
sudo cp php.ini-production /usr/local/lib/php.ini
    • PHP 5.6 
      sudo apt-get install -y php5.6-dev php5.6-bcmath php5.6-mbstring php5.6-xml
    • PHP 7.2 
      sudo apt-get install -y php7.2-dev php7.2-bcmath php7.2-mbstring php7.2-xml

Phase 2

  • Install dependencies

    • We provide scripts for installing all dependencies and changing PHP settings. Run ./install_XX.sh depending on the version of PHP.
      • PHP 5.4: ./install_54.sh
      • PHP 5.6: ./install_56.sh
      • PHP 7.2: ./install_72.sh

  • Prepare the target application source code and its running service

  • Setting for monitoring POI vulnerabilities

    • Add .htaccess file for monitoring POI vulnerabilities by running ./htaccess.py on. If you want to stop monitoring, run htaccess.py off.

Usage

  • Execute FUGIO using ./run.py.

    # ./run.py
usage: run.py [-h] [--all] [--rabbitmq_ip RABBITMQ_IP]
              [--php_ver {5,7}] [--hook_extension {uopz,runkit}] [--cpus CPUS]
              target
    • rabbitmq_ip: the IP address of RabbitMQ
    • php_ver: the version of PHP, choose 5 or 7 (default 5)
    • hook_extension: the library for using hooks to PHP built-in functions, choose uopz or runkit (default uopz)
      Since some applications such as CubeCart conflicts with uopz library, we also support runkit.
    • cpus: the number of CPU cores for assigning to run FUGIO (default all CPU cores)
    • target: the path of the target application source code
    • all: enable if you want to consider all gadgets regardless of their availability (default false)
      In Dahse et al., the authors assume that all existing classes are loadable when there exists at least one autoloader callback in an application. Although this assumption is no longer valid because this bug was patched in PHP 5.4.24 and 5.5.8, we added this option for a fair comparison to FUGIO in the paper.

    For more concrete examples, refer to scripts run_FUGIO_XX.sh.

    If you run the command, FUGIO starts to analyze the source code of the target application. At the first run, FUGIO generates a dump file in Files/dump_files. It is for reducing time to analyze the target source code when you run FUGIO again for the same application. If the source code of the target application changed, you need to delete its dump file and run the script again.

  • Monitor POI vulnerabilities After FUGIO finishes analyzing the source code, FUGIO starts to monitor a POI vulnerability. We can trigger POI vulnerabilities using crawlers, spiders, or manual browsing. In Trigger folder, we provide scripts for triggering POI vulnerabilities of our benchmarks; you can find the details in FUGIO-artifact.

Results

All outputs are generated in the Files/fuzzing/[app_path.time]/PUT/ directory.

  • put-head.php and put-body.php: a PUT file
  • inst_PUT.php: an instrumented PUT file for fuzzing the target application
  • procX_X_X_X_X_X.chain: an identified POP chain
  • PROBABLY_EXPLOITABLE: a directory for probably exploitable exploit objects (payloads)
  • EXPLOITABLE: a directory for exploitable exploit objects (payloads)