信息安全 - Fuzzer 导致崩溃。怎么办？ - 吾爱随笔录

谁能指出一些关于如何识别 !exploitable 报告的漏洞类型以及从那里去哪里的好教程的方向？

本质上，我已经为自己建立了一个小型模糊测试实验室，我正在努力扩大我对漏洞利用研究和开发的理解。所以我有一个应用程序崩溃，!exploitable 报告为 EXPLOITABLE 和写访问冲突。在这一点上，我的问题是我不确定发生了什么样的问题，以及如何进行。

那里有很多漏洞利用教程，除了它们都演示了缓冲区溢出……我不确定这是缓冲区溢出。在 Immunity Debugger 中打开导致崩溃的模糊文件会导致与 !exploitable 报告相同的内存地址发生相同的崩溃。我将干净文件与 bindiffer 应用程序中的模糊文件进行了比较，可以看到导致崩溃的确切十六进制更改，但我可以使用一些关于如何从这里开始的建议，以便开始组合利用代码。我附上了 !exploitable 读出的内容，以防有人可以为我提供更多关于它的见解以及如何从中收集有意义的信息。

(834.b7c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=7fffffff ebx=00726afc ecx=0000c9f0 edx=02adc080 esi=02957b18 edi=00000000
eip=005ec57f esp=0187f810 ebp=0187f978 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010216
*** WARNING: Unable to verify timestamp for image00400000
*** ERROR: Module load completed but symbols could not be loaded for image00400000
image00400000+0x1ec57f:
005ec57f c704ca00000000  mov     dword ptr [edx+ecx*8],0 ds:0023:02b41000=????????
0:000> r;!exploitable -v;q
eax=7fffffff ebx=00726afc ecx=0000c9f0 edx=02adc080 esi=02957b18 edi=00000000
eip=005ec57f esp=0187f810 ebp=0187f978 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010216
image00400000+0x1ec57f:
005ec57f c704ca00000000  mov     dword ptr [edx+ecx*8],0 ds:0023:02b41000=????????
HostMachine\HostUser
Executing Processor Architecture is x86
Debuggee is in User Mode
Debuggee is a live user mode debugging session on the local machine
Event Type: Exception
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll - 
Exception Faulting Address: 0x2b41000
First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)
Exception Sub-Type: Write Access Violation

Exception Hash (Major/Minor): 0x00020e6f.0x435e5a76

Stack Trace:
image00400000+0x1ec57f
image00400000+0x1ebe05
image00400000+0x1eb966
image00400000+0x1eb7f3
image00400000+0x64405
image00400000+0x63eae
image00400000+0x63d2f
image00400000+0x41ca5
image00400000+0x39022
image00400000+0x5d9fa
image00400000+0x5e63f
image00400000+0x38862
image00400000+0x3032
image00400000+0x11d91
Instruction Address: 0x00000000005ec57f

Description: User Mode Write AV
Short Description: WriteAV
Exploitability Classification: EXPLOITABLE
Recommended Bug Title: Exploitable - User Mode Write AV starting at    
image00400000+0x00000000001ec57f (Hash=0x00020e6f.0x435e5a76)

User mode write access violations that are not near NULL are exploitable. 
quit: