Abstract:Assessing the exploitability of vulnerabilities is critical for defenders. But the vulnerability-triggering samples available for analysts often do not trigger exploitable states, making it hard to accurately assess whether the underlying vulnerabilities are exploitable. Several customized fuzzing solutions have been proposed to address this problem, by searching for new vulnerability-triggering test cases that can enter exploitable program states. However, such solutions are inefficient and in general take an overwhelmingly long time to find exploitable states, due to the large number of program paths to explore and complicated path constraints to satisfy. In this paper, we present a new automated solution Tunter to assess the exploitability of vulnerabilities. It could explore exploitable program states and generate working exploits, even if only non-exploitable vulnerability-triggering samples are given. It adopts two novel techniques: (1) a taint-guided exploration procedure to explore candidate exploitable states; and (2) a pruning mechanism to prune unwanted states for exploitation to alleviate the state explosion issue faced by symbolic execution. We have implemented a prototype of Tunter and evaluated it on 14 capture-the-flag (CTF) programs and two real-world applications. The experimental results demonstrate that it has significant performance than state-of-the-art solution Revery (Wang et al., 2018). Specifically, it finds exploitable states for these 16 programs with a 75% recall and an 88.9% precision, and eventually generates working exploits for 11 out of these 16 programs. Moreover, Tunter is 41.02 times faster than Revery.

Poster: Unider: Exploit Attack Emulator Armed with State-of-Art Exploit Techniques

UniID: Spoofing Face Authentication System by Universal Identity

AutoPwn: Artifact-Assisted Heap Exploit Generation for CTF PWN Competitions

EXAMINER-PRO: Testing Arm Emulators Across Different Privileges

From Proof-of-concept to Exploitable

Accurate and Efficient Exploit Capture and Classification

Xede: Practical Exploit Early Detection

AutoExploit: Automatic Exploit Generation with Security Mitigation

Tunter: Assessing Exploitability of Vulnerabilities with Taint-Guided Exploitable States Exploration

A New Multi-Function System to Deal with Hacker Intrusion

Demo Abstract: A HIL Emulator-Based Cyber Security Testbed for DC Microgrids

A Vulnerability Automation Exploitation Method Based on Symbolic Execution

Adaptive Exploit Generation against Security Devices and Security APIs

A Generic Testbed for Security Enhancement Tools

Revery: From Proof-Of-Concept To Exploitable (One Step Towards Automatic Exploit Generation)

Revery

Automatic Polymorphic Exploit Generation for Software Vulnerabilities

Automatic Exploit Generation System Based on Symbolic Execution

Evolution of Exploitation and Exploit Mitigation

A cross-platform multifunctional testbed for vulnerability attack

MetaSymploit: Day-One Defense against Script-based Attacks with Security-Enhanced Symbolic Analysis.