Skip to content

Commit 64a2feb

Browse files
sunnyeosunnyeo
committed
Initial commit
0 parents  commit 64a2feb

File tree

89 files changed

+26643
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

89 files changed

+26643
-0
lines changed

‎.gitattributes‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
*.tar.gz filter=lfs diff=lfs merge=lfs -text

‎README.md‎

Lines changed: 358 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,358 @@
1+
# FUGIO-artifact
2+
[FUGIO](https://github.com/WSL-LAB/FUGIO) is the first
3+
automatic exploit generation (AEG) tool for PHP object injection (POI) vulnerabilities.
4+
This repository includes Docker images to run the experiments performed in the paper.
5+
We tested our Docker images and running scripts on Ubuntu 18.04 host machine.
6+
7+
## Prepare Docker containers
8+
#### 1. Install Docker
9+
To install Docker CE, please follow the instructions in this
10+
[link](https://docs.docker.com/install/linux/docker-ce/ubuntu/).
11+
12+
#### 2. Prepare Docker as a non-root user
13+
For our scripts not to ask you for sudo password, we assumed that
14+
you run Docker commands as a non-root user. Please follow the instructions in
15+
this [link](https://docs.docker.com/install/linux/linux-postinstall/).
16+
17+
#### 3. Build Docker images
18+
We provide three Docker images depending on PHP versions: PHP 5.4, PHP 5.6, and PHP 7.2.
19+
Build each Docker image by running `1_docker_build.sh` in each folder. Each takes about 5 ~ 20 minutes.
20+
> When building a Docker image for PHP 5.4,
21+
>
22+
> ```
23+
> cd php5.4
24+
> ./1_docker_build.sh
25+
> ```
26+
27+
28+
#### 4. Run Docker containers
29+
After building a Docker image, run the corresponding `2_docker_run.sh` and `3_docker_exec.sh` scripts.
30+
31+
#### 5. Run RabbitMQ Docker
32+
FUGIO uses RabbitMQ for communicating between different modules.
33+
We can set up RabbitMQ using `run_rabbitmq.sh`.
34+
- Username: fugio
35+
- Password: fugio_password
36+
- RabbitMQ Management port: 15672
37+
38+
## Prepare for running FUGIO
39+
#### 1. Install dependencies
40+
In the Docker container, execute the following commands.
41+
- PHP 5.4:
42+
```
43+
cd /FUGIO
44+
./install_54.sh
45+
/start.sh &
46+
/create_user.sh
47+
```
48+
49+
- PHP 5.6:
50+
```
51+
cd /FUGIO
52+
./install_56.sh
53+
/start.sh &
54+
/create_user.sh
55+
```
56+
57+
- PHP 7.2:
58+
```
59+
cd /FUGIO
60+
./install_72.sh
61+
/start.sh &
62+
/create_user.sh
63+
```
64+
65+
#### 2. Build benchmarks
66+
We evaluated 30 PHP applications in the paper.
67+
We uploaded all target applications' source code in each `benchmarks/org_code`.
68+
69+
We also provide dump files of applications and databases for convenient settings.
70+
If you want to install all applications, run `install.py all`.
71+
If you want to install each application, `install.py [dump file path]`.
72+
The applications will be installed in `/app/` directory.
73+
```
74+
cd /FUGIO/benchmarks
75+
./install.py [all/dump file path]
76+
```
77+
78+
For other applications, it requires manual installation.
79+
80+
## Run FUGIO
81+
#### 1. Setting for monitoring POI vulnerabilities
82+
Add .htaccess file for monitoring POI vulnerabilities by running `htaccess.py`.
83+
```
84+
cd /FUGIO
85+
./htaccess.py on
86+
```
87+
If you want to stop monitoring, run `htaccess.py off`.
88+
89+
#### 2. Prepare two terminals
90+
We need at least two Docker container terminals. One is for running FUGIO and the other is for triggering POI vulnerabilities.
91+
You can connect two shells by running `3_docker_exec.sh` in two terminals respectively.
92+
93+
94+
#### 3. Run FUGIO
95+
In the first terminal, run FUGIO using `run_FUGIO_XX.sh` with the target applications path (i.e. `/app/[target application]`).
96+
In the other terminal, trigger the corresponding POI vulnerability using the given scripts.
97+
98+
I recommend the following applications for obtaining results fastly.
99+
- PHP 5.4: Open Web Analytics, CMS Made Simple, SwiftMailer 5.0.1, SwiftMailer 5.1.0, Smarty, CubeCart
100+
- PHP 5.6: EverestForms, Emailsubscribers, PHPExcel 1.8.1, PHPExcel 1.8.2, WooCommerce 2.6.0
101+
- PHP 7.2: SwiftMailer 5.4.12, SwiftMailer 6.0.0, Monolog 1.7.0, Laminas
102+
103+
**_Warning._** If you get the results that you expect, I recommend stopping the FUGIO.
104+
If not, FUGIO might last 12 hours and require hundreds GBs of disk space for some applications.
105+
Since it might identify millions of POP chains and try fuzzing for the identified chains.
106+
107+
#### 3-1. Run FUGIO in the first terminal
108+
- PHP 5.4:
109+
```
110+
./run_FUGIO_54.sh [target application path]
111+
```
112+
- For CubeCart,
113+
```
114+
./run_FUGIO_cubecart.sh [target application path]
115+
```
116+
117+
- PHP 5.6:
118+
```
119+
./run_FUGIO_56.sh [target application path]
120+
```
121+
122+
- PHP 7.2:
123+
```
124+
./run_FUGIO_72.sh [target application path]
125+
```
126+
127+
**_Warning._** FUGIO uses all CPU cores by default. If you want to change it, add `--cpus=` option.
128+
Also, the size of each Docker container can be over 20 GB after running FUGIO.
129+
```
130+
./run_FUGIO_XX.sh --cpus=12 [target application path]
131+
```
132+
133+
If you run the command, FUGIO starts to analyze the source code of the target application.
134+
At the first run, FUGIO generates a dump file in `Files/dump_files`.
135+
It is for reducing time to analyze the target source code when you run FUGIO again for the same application.
136+
If the source code of the target application changed, you need to delete its dump file and run the script again.
137+
138+
> When you run FUGIO on Smarty (PHP 5.4),
139+
>
140+
> ```
141+
> # ./run_FUGIO.sh /app/smarty-3.1.28/
142+
> /app/smarty-3.1.28/index.php
143+
>
144+
> /app/smarty-3.1.28/libs/Smarty.class.php
145+
>
146+
> /app/smarty-3.1.28/libs/Autoloader.php
147+
>
148+
> /app/smarty-3.1.28/libs/SmartyBC.class.php
149+
>
150+
> ...
151+
>
152+
> /app/smarty-3.1.28/vendor/composer/installed.php
153+
>
154+
> /app/smarty-3.1.28/vendor/composer/InstalledVersions.php
155+
>
156+
> /app/smarty-3.1.28/vendor/composer/autoload_namespaces.php
157+
>
158+
> Done! (215)
159+
> CLASSES: 175 (Before autoload)
160+
>
161+
> ```
162+
>
163+
> FUGIO generates `app.smarty-3.1.28.dump` file in `Files/dump_files/` after successfully analyzing the source code.
164+
>
165+
> ```
166+
> # ls Files/dump_files/
167+
> app.smarty-3.1.28.dump
168+
> ```
169+
170+
171+
#### 3-2. Trigger POI vulnerabilities in the second terminal
172+
After FUGIO finishes analyzing the source code, FUGIO starts to monitor a POI vulnerability.
173+
We can trigger POI vulnerabilities using crawlers, spiders, or manual browsing.
174+
In this artifact, we provide scripts for triggering each POI vulnerability.
175+
176+
- PHP 5.4:
177+
- Contao CMS, Piwik, GLPI, Joomla, CubeCart, CMS Made Simple, Open Web Analytics, Vanilla Forums:
178+
```
179+
cd /FUGIO/Trigger/
180+
./ccs_run.py [target application path]
181+
```
182+
- SwiftMailer 5.0.1, SwiftMailer 5.1.0, Smarty, ZendFramework:
183+
```
184+
cd /FUGIO/Trigger/
185+
./lib_run.py [target application path]
186+
```
187+
188+
- PHP 5.6:
189+
- PHPExcel 1.8.1, PHPExcel 1.8.2, Dompdf, Guzzle, WooCommerce 2.6.0, WooCommerce 3.4.0, Emailsubscribers, EverestForms:
190+
```
191+
cd /FUGIO/Trigger/
192+
./wp_run.py [target application path]
193+
```
194+
195+
- PHP 7.2:
196+
- TCPDF, SwiftMailer 5.4.12, SwiftMailer 6.0.0, Monolog 1.7.0, Monolog 1.18.0, Monolog 2.0.0, Laminas, Yii:
197+
```
198+
cd /FUGIO/Trigger/
199+
./lib_run.py [target application path]
200+
```
201+
- Drupal7: https://github.com/WSP-LAB/FUGIO/tree/main/Trigger/drupal
202+
- TYPO3: https://github.com/WSP-LAB/FUGIO/tree/main/Trigger/typo3
203+
204+
> When you trigger the POI vulnerability of Smarty (PHP 5.4),
205+
>
206+
> ```
207+
> # cd Trigger/
208+
> # ./lib_run.py /app/smarty-3.1.28/
209+
> ```
210+
>
211+
> FUGIO starts to analyze the POI vulnerability and identify POP chains and generate their exploit objects.
212+
> ```
213+
> [#] Exploitable!
214+
> - Injected Function: unserialize()
215+
> MAGIC METHODS: ['__destruct', '__call', '__callStatic', '__get', '__set', '__isset', '__unset', '__sleep', '__wakeup', '__toString', '__set_state', '__clone']
216+
> DECL_CLASSES: 304 (After autoload)
217+
> DECL_INTERFACES: 15 (After autoload)
218+
> DECL_TRAITS: 0 (After autoload)
219+
> USER_CLASSES: 170 (After autoload)
220+
> CLASSES: 175 (Before autoload)
221+
>
222+
> ...
223+
>
224+
> [+] Time: 00:00:01:09
225+
> [+] Fuzzer - Chain Found: 7/49 (14.29 %)
226+
> [+] Fuzzer - Chain Tried: 15/15 (100.0 %) - Skip: 0
227+
> [+] Fuzzer - Chain Tried (+ Skip): 15/15 (100.0 %)
228+
> [+] Fuzzer - Running: 4/12 (33.33 %)
229+
> [+] Fuzzer - Sink Reach: 1/7 (14.29 %)
230+
> [+] Fuzzer - Success: 1/7 (14.29 %)
231+
>
232+
> ...
233+
> ```
234+
235+
236+
#### 3. The results of FUGIO
237+
All outputs are generated in the `Files/fuzzing/[app_path.time]/PUT/` directory.
238+
- `put-head.php` and `put-body.php`: a PUT file
239+
- `inst_PUT.php`: an instrumented PUT file for fuzzing the target application
240+
- `procX_X_X_X_X_X.chain`: an identified POP chain
241+
- `PROBABLY_EXPLOITABLE`: a directory for probably exploitable exploit objects (payloads)
242+
- `EXPLOITABLE`: a directory for exploitable exploit objects (payloads)
243+
244+
> When running FUGIO on Smarty (PHP 5.4),
245+
> - this is the final result:
246+
> ```
247+
> [+] Time: 00:00:01:54
248+
> [+] Fuzzer - Chain Found: 7/49 (14.29 %)
249+
> [+] Fuzzer - Chain Tried: 15/15 (100.0 %) - Skip: 0
250+
> [+] Fuzzer - Chain Tried (+ Skip): 15/15 (100.0 %)
251+
> [+] Fuzzer - Running: 0/12 (0.0 %)
252+
> [+] Fuzzer - Sink Reach: 1/7 (14.29 %)
253+
> [+] Fuzzer - Success: 1/7 (14.29 %)
254+
>
255+
> Total time: 120.78427648544312(s)
256+
> ```
257+
> - there are 15 POP chains:
258+
> ```
259+
> # cd Files/fuzzing/app.smarty-3.1.28.yymmddhhmmss/PUT
260+
> # ls proc*.chain
261+
> proc0_1_3_1_240_2.chain proc0_4_3_1_240_2.chain proc1_2_3_0_252_2.chain proc1_5_3_0_252_2.chain proc32_1_3_2_45_1.chain
262+
> proc0_2_3_1_240_2.chain proc0_5_3_1_240_2.chain proc1_3_3_0_252_2.chain proc24_1_3_2_45_1.chain proc3_1_2_1_22_1.chain
263+
> proc0_3_3_1_240_2.chain proc1_1_3_0_252_2.chain proc1_4_3_0_252_2.chain proc2_1_2_0_14_2.chain proc44_1_3_1_37_2.chain
264+
> ```
265+
> - there is one exploit object:
266+
> ```
267+
> # ls EXPLOITABLE
268+
> XXXXXXXXXXXXXX_proc44_1_3_1_37_2.chain.php_887700_unlink
269+
> ```
270+
> - there are 214 probably exploititable objects:
271+
> ```
272+
> # ls PROBABLY_EXPLOITABLE | wc -l
273+
> 214
274+
> # ls PROBABLY_EXPLOITABLE/
275+
> # ls PROBABLY_EXPLOITABLE/
276+
> XXXXXXXXXXXXXX_proc44_1_3_1_37_2.chain.php_887700_unlink XXXXXXXXXXXXXX_proc2_1_2_0_14_2.chain.php_909905_call_user_func_array
277+
> XXXXXXXXXXXXXX_proc2_1_2_0_14_2.chain.php_909905_call_user_func_array XXXXXXXXXXXXXX_proc2_1_2_0_14_2.chain.php_909905_call_user_func_array
278+
> XXXXXXXXXXXXXX_proc2_1_2_0_14_2.chain.php_909905_call_user_func_array XXXXXXXXXXXXXX_proc2_1_2_0_14_2.chain.php_909905_call_user_func_array
279+
> XXXXXXXXXXXXXX_proc2_1_2_0_14_2.chain.php_909905_call_user_func_array XXXXXXXXXXXXXX_proc2_1_2_0_14_2.chain.php_909905_call_user_func_array
280+
> XXXXXXXXXXXXXX_proc2_1_2_0_14_2.chain.php_909905_call_user_func_array XXXXXXXXXXXXXX_proc2_1_2_0_14_2.chain.php_909905_call_user_func_array
281+
> XXXXXXXXXXXXXX_proc2_1_2_0_14_2.chain.php_909905_call_user_func_array XXXXXXXXXXXXXX_proc2_1_2_0_14_2.chain.php_909905_call_user_func_array
282+
> ...
283+
> ```
284+
> Among 214 POP chains, there are unique 2 POP chains: `proc44_1_3_1_37_2.chain` and `proc2_1_2_0_14_2.chain`.
285+
> When counting the number of probably exploitable POP chains, we exclude exploitable POP chains.
286+
> Thus `proc44_1_3_1_37_2.chain` is excluded and the number of probably exploitable POP chains is one.
287+
288+
289+
#### 4. Reproduce evaluations in the paper
290+
This artifact provides environments for reproducing evaluations in Sections 7.2 and 7.3 producing Tables 1, 2, and 3 in the paper.
291+
292+
1. For reproducing Table 1, run `./config.py org` in php5.4. php5.6, and `php7.2` Docker containers
293+
before following the step 3 ["Run FUGIO"](https://github.com/WSP-LAB/FUGIO-artifact#3-run-fugio).
294+
```
295+
cd /FUGIO
296+
./config.py org
297+
```
298+
299+
Then, run the following commands depending on the version of PHP and applications.
300+
- php 5.4:
301+
- CubeCart: `./run_FUGIO_cubecart.sh`
302+
- Others: `./run_FUGIO_54.sh `
303+
- php 5.6: `./run_FUGIO_56.sh`
304+
- php 7.2: `./run_FUGIO_72.sh`
305+
306+
The number of true positive chains in Table 1 is manually analyzed.
307+
We provide an utility for helping the analysis of the generated POP chains
308+
in the step 5 ["Analyzing the results"](https://github.com/WSP-LAB/FUGIO-artifact#5-analyzing-the-results).
309+
310+
2. For reproducing Table 2, run `./config.py ccs` in `php5.4` Docker container
311+
before following the step 3 ["Run FUGIO"](https://github.com/WSP-LAB/FUGIO-artifact#3-run-fugio).
312+
```
313+
cd /FUGIO
314+
./config.py ccs
315+
```
316+
317+
Then, run the following commands depending on the applications.
318+
- php 5.4:
319+
- CubeCart: `./run_FUGIO_cubecart_all.sh`
320+
- Others: `./run_FUGIO_54_all.sh`
321+
322+
Since Dahse et al. did not provide the details of each chain, we could not match each exploitable chain.
323+
Thus, we compared the numbers of exploit objects that FUGIO reported with the numbers reported in their paper.
324+
325+
3. For reproducing Table 3, run `./config.py phpggc` in `php5.4`, `php5.6` and `php7.2` Docker containers,
326+
before following the step 3 ["Run FUGIO"](https://github.com/WSP-LAB/FUGIO-artifact#3-run-fugio).
327+
```
328+
cd /FUGIO
329+
./config.py phpggc
330+
```
331+
332+
Then, run the following commands depending on the version of PHP.
333+
- php 5.4:
334+
- CubeCart: `./run_FUGIO_cubecart.sh`
335+
- Others: `./run_FUGIO_54.sh `
336+
- php 5.6: `./run_FUGIO_56.sh`
337+
- php 7.2: `./run_FUGIO_72.sh`
338+
339+
[PHPGGC](https://github.com/ambionics/phpggc) provides templates for generating POP exploits.
340+
However, it is not clear that what POP gadget each POP chain consists of.
341+
Thus, we provide POP chains from PHPGGC in the repo (https://github.com/WSP-LAB/FUGIO/tree/main/PHPGGC) by analyzing each template.
342+
`chain_analyzer` in ["Run FUGIO"](https://github.com/WSP-LAB/FUGIO-artifact#5-analyzing-the-results)
343+
also will be helpful for analyzing the reported POP chains.
344+
345+
#### 5. Analyzing the results
346+
We provide `chain_analyzer` to easily analyze the generated POP chains.
347+
For using it, follow the instructions.
348+
```
349+
cd /app
350+
ln -s /FUGIO/chain_analyzer
351+
```
352+
Then, enter website "http://[ip]:[port]/chain_analyzer/chain_analyzer.php?file_path=[chain_path]".
353+
For each Docker image, the port is assigned as 5454 (php 5.4), 5656 (php 5.6), and 7272 (php 7.2).
354+
For example, http://127.0.0.1:5454/chain_analyzer/chain_analyzer.php?file_path=/FUGIO/Files/fuzzing/app.owa-1.5.6.211101184553/PUT/proc33_1_2_1_18_1.chain
355+
shows the detils of the chain `proc33_1_2_1_18_1.chain`.
356+
It also can list all POP chains: http://127.0.0.1:5454/chain_analyzer/sink_list.php?dir_path=/FUGIO/Files/fuzzing/app.owa-1.5.6.211101184553/PUT.
357+
358+

‎php5.4/1_docker_build.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#!/bin/bash
2+
3+
docker build -t fugio_php5.4:v0.1 .

‎php5.4/2_docker_run.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#!/bin/bash
2+
3+
docker run --rm -dit --name fugio_php5.4 -p 5454:80 \
4+
-v $PWD/benchmarks:/FUGIO/benchmarks fugio_php5.4:v0.1

‎php5.4/3_docker_exec.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#!/bin/bash
2+
3+
docker exec -it $(docker ps -q -f status=running -f name=fugio_php5.4) /bin/bash

0 commit comments

Comments
 (0)