Generating String Inputs Using Constrained Symbolic Execution

Size: px

Start display at page:

Download "Generating String Inputs Using Constrained Symbolic Execution"

Hortense Booth
6 years ago
Views:

1 Generating String Inuts Using Cnstrained Symblic Executin Pieter Himeijer University f Virginia 1

2 The Prblem: SQL Injectin

3 Mtivatin Mntage 3

4 Mitre Cr. data rerted n htt://

5 Mtivatin Mntage #2 Mitre Cr. data; rerted n htt:// 5

6 Mtivatin Mntage String variables have lst their inncence... [Thiemann05] #2 Mitre Cr. data; rerted n htt:// 6

7 Mtivatin Mntage // $userid is untrusted if (!eregi('[0-9]+', $userid)) { un_msg('yu entered an invalid user ID.'); exit; } $user = $DB->query( SELECT * FROM `un_user`. WHERE userid='$userid' ); String variables if (!DB->is_single_rw($user)) have lst { their un_msg('yu inncence... entered an invalid user ID.'); exit; [Thiemann05] } #2 Mitre Cr. data; rerted n htt:// 7

8 Mtivatin Mntage // $userid is untrusted if (!eregi('[0-9]+', $userid)) { un_msg('yu entered an invalid user ID.'); exit; } Matches any string that cntains a sequence f $user = $DB->query( SELECT * FROM `un_user`. WHERE digits... userid='$userid' ); String variables if (!DB->is_single_rw($user)) have lst { their un_msg('yu inncence... entered an invalid user ID.'); exit; [Thiemann05] } #2 Mitre Cr. data; rerted n htt:// 8

9 Mtivatin Mntage // $userid is untrusted SELECT * FROM `un_user` if (!eregi('[0-9]+', $userid)) { un_msg('yu entered WHERE an invalid userid='1'; ID.'); exit; DROP TABLE un_user; } --' $user = $DB->query( SELECT * FROM `un_user`. WHERE userid='$userid' ); String variables if (!DB->is_single_rw($user)) have lst { their un_msg('yu inncence... entered an invalid user ID.'); exit; [Thiemann05] } #2 Mitre Cr. data; rerted n htt:// 9

10 Mtivatin Mntage if (!eregi('[0-9]+', SELECT * FROM `un_user` $userid)) { un_msg('yu entered WHERE userid='1'; an invalid user ID.'); exit; DROP TABLE un_user; } --' $user = $DB->query( SELECT * FROM `un_user`. WHERE userid='$userid' ); if (!DB->is_single_rw($user)) { un_msg('yu entered an invalid user ID.'); exit; } String variables have lst their inncence... [Thiemann05] #2 Mitre Cr. data; rerted n htt:// 10

11 The Plan Wassermann and Su '07: detect SQL Cmmand Injectin Vulnerabilities in real PHP cde Inut: PHP cde Outut: Cntext-Free Grammar Plan: Extend this t generate actual attack inuts 11

12 Why? 12

13 Why? Our Outut: STRING: 004 =$251 =$1486. == "" (len 0) STRING: 013 =$558 =$559 =$561. '99 == "'99" (len 3) ANSWER: $$558 == '99 == "'99" (len 3) 13

14 U Next 1. Describe Wassermann and Su '07 2. Hw t run PHP cde backwards 14

15 WSU: An Examle x = 'z'; Sme Cde: while(n < 5) { x = '('. x. ')'; n ++; } We want a cntext-free grammar t mdel x Suse we dn't knw anything abut n 15

16 WSU: An Examle >x = 'z'; Sme Cde: A -> z Grammar: while(n < 5) { x = '('. x. ')'; n ++; } 16

17 WSU: An Examle x = 'z'; Sme Cde: A -> z Grammar: >while(n < 5) { > x = '('. x. ')'; > n ++; >} 17

18 WSU: An Examle x = 'z'; Sme Cde: while(n < 5) { > x = '('. x. ')'; n ++; } A -> z B -> (A) Grammar: 18

19 The Nugget x = 'z'; Sme Cde: while(n < 5) { x = '('. x. ')'; n ++; >>} A -> z Grammar: B -> (A) C -> A B 19

20 WSU: Yet Mre Examle x = 'z'; Sme Cde: while(n < 5) { x = '('. x. ')'; n ++; >>} Grammar: A -> z B -> (C) C -> A B 20

21 WSU: An Examle x = 'z'; Sme Cde: while(n < 5) { x = '('. x. ')'; n ++; >>} X -> C Grammar: A -> z B -> (C) C -> A B 21

22 Is that gd? Can mdel hme-grwn string sanitizing functins using finite state transducers [Minamide05] Des nt require rgrammer assistance; always terminates 20% False sitives; utut may be difficult t interret 22

23 23

24 Befre: Surce Wassermann & Su Cntext-Free Grammar 24

25 After: Surce Wassermann & Su Cntext-Free Grammar + Prgram Lcatins String(s) Executin Path(s) Actual Inuts 25

26 After: Surce Wassermann & Su Cntext-Free Grammar + Prgram Lcatins Cntributins String(s) Executin Path(s) Actual Inuts 26

27 Cntributins Add a maing frm cntext-free grammar back t the surce Use maing t find bad strings and executin aths Use symblic executin t reverse string eratins alng a ath 27

28 U Next: Surce Wassermann & Su Cntext-Free Grammar + Prgram Lcatins String(s) Executin Path(s) Actual Inuts 28

29 Grammar Anntatins Surce Wassermann & Su Cntext-Free Grammar + Prgram Lcatins = 'y'; if (myth()) { = 'xyzz'. ; } rint ; P -> Q P -> R String(s) Q -> xyzzr R -> y Executin Path(s) Actual Inuts 29

30 Grammar Anntatins Surce Wassermann & Su Cntext-Free Grammar + Prgram Lcatins = 'y'; if (myth()) { = 'xyzz'. ; } rint ; P -> Q P -> R String(s) Q -> xyzzr R -> y Executin Path(s) Actual Inuts [TRUE] [!myth] [myth] [TRUE] 30

31 Surce Wassermann & Su Cntext-Free Grammar + Prgram Lcatins String(s) Executin Path(s) Actual Inuts 31

32 U Next: Surce Wassermann & Su Cntext-Free Grammar + Prgram Lcatins String(s) Executin Path(s) Actual Inuts 32

33 Hw t Find Inuts 1. Create a deendency grah 2. Detect imlicit cycles 3. Slve cnstraints 33

34 Creating a Deendency Grah 1 $userid = $_POST['uid']; 2 if (!eregi('[0-9]+', $userid)) { 3 exit; 4 } 5 6 query( SELECT * FROM `un_user`. 7 WHERE userid=. $userid); Path:

35 Creating a Deendency Grah 1 $userid = $_POST['uid']; 2 if (!eregi('[0-9]+', $userid)) { 3 exit; 4 } 5 6 query( SELECT * FROM `un_user`. 7 WHERE userid=. $userid); t0 t2 t1 Path:

36 1 $userid = $_POST['uid']; 2 if (!eregi('[0-9]+', $userid)) { 3 exit; 4 } 5 6 query( SELECT * FROM `un_user`. 7 WHERE userid=. $userid); t0 t2 t1 t1 t2 t3 u t0 t4 36

37 Slving Cnstraints SELECT... WHERE userid... t1 t2 t3 u t0 Σ* Σ* [0-9]+ t4 w SELECT * FROM `un_user` WHERE userid=1 OR 1=1 Σ* 37

38 Slving Cnstraints SELECT... WHERE userid... t1 t2 t3 u t0 Σ* Σ* [0-9]+ t4 w SELECT * FROM `un_user` WHERE userid=1 OR 1=1 Σ* 38

39 Slving Cnstraints SELECT... WHERE userid... t1 t2 t3 u t0 SELECT... WHERE userid =... Σ* [0-9]+ t4 SELECT * FROM `un_user` WHERE userid=1 OR 1=1 Σ* 39

40 Slving Cnstraints t3 u t0 SELECT... WHERE userid =... Σ* [0-9]+ t4 w SELECT * FROM `un_user` WHERE userid=1 OR 1=1 Σ* 40

41 Slving Cnstraints SELECT... WHERE userid =... t3 t4 u [0-9]+ w SELECT * FROM `un_user` WHERE userid=1 OR 1=1 Σ* 41

42 Slving Basic Cnstraints t4 w SELECT... WHERE userid = Σ*[0-9]+Σ* SELECT * FROM `un_user` WHERE userid=1 OR 1=1 42

43 Prblem: Backward Pragatin Hw d we ma 1 OR 1=1 back nt u? SELECT... WHERE userid =... t3 t4 u [0-9]+ w SELECT * FROM `un_user` WHERE userid=1 OR 1=1 Σ* 43

44 Cncat-Intersect Examle I // a and b are user inuts if (!ereg('()+', a)){ exit; } if (!ereg('*q', b)){ exit; } d = a. b; // cncat if (!ereg('q', d) { exit; } 44

45 Cncat-Intersect Examle I L1 = ()+ L2 = *q a1 a2 a3 a4 b1 q b2 L3 = 4 q d1 d2 d3 d4 d5 d6 q d7 45

46 a1 a2 a3 a4 b1 q b2 d1 d2 d3 d4 d5 q d6 d7 46

47 a1 a2 a3 a4 b1 q b2 d1 a1d1 d2 d3 d4 d5 q d6 d7 47

48 a1 a2 a3 a4 b1 q b2 d1 d2 d3 d4 d5 a1d1 a2d2 q d6 d7 48

49 a1 a2 a3 a4 b1 q b2 d1 a1d1 d2 a2d2 d3 a3d3 d4 a4d4 d5 q d6 d7 49

50 a1 a2 a3 a4 b1 q b2 d1 a1d1 d2 a2d2 d3 d4 a2d4 a3d3 a4d4 b1d4 d5 q d6 d7 50

51 a1 a2 a3 a4 b1 q b2 d1 a1d1 d2 a2d2 d3 d4 d5 a2d4 a3d3 a3d5 a4d4 b1d4 d6 q d7 a4d6 51

52 a1 a2 a3 a4 b1 q b2 d1 a1d1 d2 a2d2 d3 d4 d5 d6 q d7 a2d4 a3d3 a3d5 a4d4 a4d6 b1d4 b1d6 52

53 a1 a2 a3 a4 b1 q b2 d1 a1d1 d2 a2d2 d3 a3d3 d4 a2d4 a4d4 b1d4 d5 d6 a3d5 a4d6 b1d5 b1d6 q d7 53

54 a1 a2 a3 a4 b1 q b2 d1 a1d1 d2 a2d2 d3 a3d3 d4 a2d4 a4d4 b1d4 d5 d6 a3d5 a4d6 b1d5 b1d6 q d7 q b2d7 54

55 a1 a2 a3 a4 b1 q b2 d1 a1d1 d2 a2d2 d3 a3d3 d4 a2d4 a4d4 b1d4 d5 d6 a3d5 a4d6 b1d5 b1d6 q d7 q b2d7 55

56 a1 a2 a3 a4 b1 q b2 d1 a1d1 Slutin I: ' L1 = ' L2 = q d2 a2d2 d3 a3d3 d4 a2d4 a4d4 b1d4 d5 d6 a3d5 a4d6 b1d5 b1d6 q d7 q b2d7 56

57 a1 a2 a3 a4 b1 q b2 d1 a1d1 Slutin I: ' L1 = ' L2 = q d2 a2d2 d3 d4 a2d4 d5 d6 Slutin q II: ' L1 = ' L2 = q d7 a3d3 a3d5 a4d4 a4d6 b1d4 b1d5 b1d6 q b2d7 57

58 Evaluatin Fund inuts fr 17/22 vulnerabilities Min: 1s Avg: 86s Med: 36s Max: 697s 58

59 Cnclusin We resented a general cnstraint-slving arach fr string variables It can find inuts fr SQL injectins within a reasnable time We used a three-stage algrithm: 1. Generate anntated grammar 2. Search fr strings and assciated aths 3. Slving (cyclic) cnstraints ver strings

Hospital Task Scheduling using Constraint Programming

Hospital Task Scheduling using Constraint Programming Hspital Task Scheduling using Cnstraint Prgramming Authr: Chaman Chahal Supervisr: Dr. P. Bse, Schl f Cmputer Science Organizatin: Carletn University Curse: COMP4905 Date: Dec. 11, 2012 1 Abstract Hspitals