xx
2 years ago
parent
42e11c6d02
commit
62ef57dfc5
@ -0,0 +1,124 @@ |
|||||||
|
## BinAbsInspector <https://github.com/KeenSecurityLab/BinAbsInspector> |
||||||
|
<!--auto_detail_badge_begin_0b490ffb61b26b45de3ea5d7dd8a582e--> |
||||||
|
 |
||||||
|
 |
||||||
|
 |
||||||
|
 |
||||||
|
 |
||||||
|
<!--auto_detail_badge_end_fef74f2d7ea73fcc43ff78e05b1e7451--> |
||||||
|
|
||||||
|
# What is BinAbsInspector? |
||||||
|
|
||||||
|
BinAbsInspector (Binary Abstract Inspector) is a static analyzer for automated reverse engineering and scanning vulnerabilities in binaries, which is a long-term research project incubated at [Keenlab](https://keenlab.tencent.com/). It is based on abstract interpretation with the support from Ghidra. It works on Ghidra's Pcode instead of assembly. Currently it supports binaries on x86,x64, armv7 and aarch64. |
||||||
|
|
||||||
|
# Installation |
||||||
|
+ Install Ghidra according to [Ghidra's documentation](https://github.com/NationalSecurityAgency/ghidra#install) |
||||||
|
+ Install [Z3](https://github.com/Z3Prover/z3) (tested version: 4.8.15) |
||||||
|
+ Note that generally there are two parts for Z3 library: one is Java package, the other one is native library. The Java package is already included in "/lib" directory, but we suggest that you replace it with your own Java package for version compatibility. |
||||||
|
+ For Windows, download a pre-built package from [here](https://github.com/Z3Prover/z3/releases), extract the zip file and add a PATH environment variable pointing to `z3-${version}-win/bin` |
||||||
|
+ For Linux, install with package manager is NOT recommended, there are two options: |
||||||
|
1. You can download suitable pre-build package from [here](https://github.com/Z3Prover/z3/releases), extract the zip file and copy `z3-${version}-win/bin/*.so` to `/usr/local/lib/` |
||||||
|
2. or you can build and install z3 according to [Building Z3 using make and GCC/Clang](https://github.com/Z3Prover/z3#building-z3-using-make-and-gccclang) |
||||||
|
+ For MacOS, it is similar to Linux. |
||||||
|
+ Download the extension zip file from [release page](https://github.com/KeenSecurityLab/BinAbsInspector/releases) |
||||||
|
+ Install the extension according to [Ghidra Extension Notes](https://ghidra-sre.org/InstallationGuide.html#GhidraExtensionNotes) |
||||||
|
|
||||||
|
# Building |
||||||
|
Build the extension by yourself, if you want to develop a new feature, please refer to [development guide](https://github.com/KeenSecurityLab/BinAbsInspector/wiki/Developer-Guide). |
||||||
|
+ Install Ghidra and Z3 |
||||||
|
+ Install [Gradle 7.x](https://gradle.org/releases/) (tested version: 7.4) |
||||||
|
+ Pull the repository |
||||||
|
+ Run `gradle buildExtension` under repository root |
||||||
|
+ The extension will be generated at `dist/${GhidraVersion}_${date}_BinAbsInspector.zip` |
||||||
|
|
||||||
|
# Usage |
||||||
|
You can run BinAbsInspector in headless mode, GUI mode, or with docker. |
||||||
|
|
||||||
|
+ With Ghidra headless mode. |
||||||
|
``` |
||||||
|
$GHIDRA_INSTALL_DIR/support/analyzeHeadless <projectPath> <projectName> -import <file> -postScript BinAbsInspector "@@<scriptParams>" |
||||||
|
``` |
||||||
|
`<projectPath>` -- Ghidra project path. |
||||||
|
`<projectName>` -- Ghidra project name. |
||||||
|
`<scriptParams>` -- The argument for our analyzer, provides following options: |
||||||
|
|
||||||
|
| Parameter | Description | |
||||||
|
| ----------------------------------------- | --------------------------------------| |
||||||
|
| `[-K <kElement>]` | KSet size limit [K](https://github.com/KeenSecurityLab/BinAbsInspector/wiki/Technical-Details#kset) | |
||||||
|
| `[-callStringK <callStringMaxLen>]` | Call string maximum length [K](https://github.com/KeenSecurityLab/BinAbsInspector/wiki/Technical-Details#context)| |
||||||
|
| `[-Z3Timeout <timeout>]` | Z3 timeout | |
||||||
|
| `[-timeout <timeout>]` | Analysis timeout | |
||||||
|
| `[-entry <address>]` | Entry address | |
||||||
|
| `[-externalMap <file>]` | External function model config | |
||||||
|
| `[-json]` | Output in json format | |
||||||
|
| `[-disableZ3]` | Disable Z3 | |
||||||
|
| `[-all]` | Enable all checkers | |
||||||
|
| `[-debug]` | Enable debugging log output | |
||||||
|
| `[-check "<cweNo1>[;<cweNo2>...]"]` | Enable specific checkers | |
||||||
|
|
||||||
|
+ With Ghidra GUI |
||||||
|
1. Run Ghidra and import the target binary into a project |
||||||
|
2. Analyze the binary with default settings |
||||||
|
3. When the analysis is done, open `Window -> Script Manager` and find `BinAbsInspector.java` |
||||||
|
4. Double-click on `BinAbsInspector.java` entry, set the parameters in configuration window and click OK |
||||||
|
5. When the analysis is done, you can see the CWE reports in console window, double-click the addresses from the report can jump to corresponding address |
||||||
|
|
||||||
|
+ With Docker |
||||||
|
|
||||||
|
```shell |
||||||
|
git clone git@github.com:KeenSecurityLab/BinAbsInspector.git |
||||||
|
cd BinAbsInspector |
||||||
|
docker build . -t bai |
||||||
|
docker run -v $(pwd):/data/workspace bai "@@<script parameters>" -import <file> |
||||||
|
``` |
||||||
|
|
||||||
|
# Implemented Checkers |
||||||
|
So far BinAbsInspector supports following checkers: |
||||||
|
|
||||||
|
+ [CWE78](https://cwe.mitre.org/data/definitions/78.html) (OS Command Injection) |
||||||
|
+ [CWE119](https://cwe.mitre.org/data/definitions/119.html) (Buffer Overflow (generic case)) |
||||||
|
+ [CWE125](https://cwe.mitre.org/data/definitions/125.html) (Buffer Overflow (Out-of-bounds Read)) |
||||||
|
+ [CWE134](https://cwe.mitre.org/data/definitions/134.html) (Use of Externally-Controlled Format string) |
||||||
|
+ [CWE190](https://cwe.mitre.org/data/definitions/190.html) (Integer overflow or wraparound) |
||||||
|
+ [CWE367](https://cwe.mitre.org/data/definitions/367.html) (Time-of-check Time-of-use (TOCTOU)) |
||||||
|
+ [CWE415](https://cwe.mitre.org/data/definitions/415.html) (Double free) |
||||||
|
+ [CWE416](https://cwe.mitre.org/data/definitions/416.html) (Use After Free) |
||||||
|
+ [CWE426](https://cwe.mitre.org/data/definitions/426.html) (Untrusted Search Path) |
||||||
|
+ [CWE467](https://cwe.mitre.org/data/definitions/467.html) (Use of sizeof() on a pointer type) |
||||||
|
+ [CWE476](https://cwe.mitre.org/data/definitions/476.htmll) (NULL Pointer Dereference) |
||||||
|
+ [CWE676](https://cwe.mitre.org/data/definitions/676.html) (Use of Potentially Dangerous Function) |
||||||
|
+ [CWE787](https://cwe.mitre.org/data/definitions/787.html) (Buffer Overflow (Out-of-bounds Write)) |
||||||
|
|
||||||
|
# Project Structure |
||||||
|
The structure of this project is as follows, please refer to [technical details](https://github.com/KeenSecurityLab/BinAbsInspector/wiki/Technical-Details) for more details. |
||||||
|
``` |
||||||
|
├── main |
||||||
|
│ ├── java |
||||||
|
│ │ └── com |
||||||
|
│ │ └── bai |
||||||
|
│ │ ├── checkers checker implementatiom |
||||||
|
│ │ ├── env |
||||||
|
│ │ │ ├── funcs function modeling |
||||||
|
│ │ │ │ ├── externalfuncs external function modeling |
||||||
|
│ │ │ │ └── stdfuncs cpp std modeling |
||||||
|
│ │ │ └── region memory modeling |
||||||
|
│ │ ├── solver analyze core and grpah module |
||||||
|
│ │ └── util utilities |
||||||
|
│ └── resources |
||||||
|
└── test |
||||||
|
``` |
||||||
|
You can also build the javadoc with `gradle javadoc`, the API documentation will be generated in `./build/docs/javadoc`. |
||||||
|
|
||||||
|
# Acknowledgement |
||||||
|
We employ [Ghidra](https://ghidra-sre.org/) as our foundation and frequently leverage [JImmutable Collections](http://brianburton.github.io/java-immutable-collections/) for better performance. |
||||||
|
Here we would like to thank them for their great help! |
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<!--auto_detail_active_begin_e1c6fb434b6f0baf6912c7a1934f772b--> |
||||||
|
## 项目相关 |
||||||
|
|
||||||
|
|
||||||
|
## 最近更新 |
||||||
|
|
||||||
|
<!--auto_detail_active_end_f9cf7911015e9913b7e691a7a5878527--> |
||||||
@ -0,0 +1,87 @@ |
|||||||
|
## afrog <https://github.com/zan8in/afrog> |
||||||
|
<!--auto_detail_badge_begin_0b490ffb61b26b45de3ea5d7dd8a582e--> |
||||||
|
 |
||||||
|
 |
||||||
|
 |
||||||
|
 |
||||||
|
 |
||||||
|
<!--auto_detail_badge_end_fef74f2d7ea73fcc43ff78e05b1e7451--> |
||||||
|
|
||||||
|
## 什么是 afrog |
||||||
|
|
||||||
|
afrog 是一款性能卓越、快速稳定、PoC 可定制的漏洞扫描工具，PoC 包含 CVE、CNVD、默认口令、信息泄露、指纹识别、未授权访问、任意文件读取、命令执行等多种漏洞类型，帮助网络安全从业者快速验证并及时修复漏洞。 |
||||||
|
|
||||||
|
## 特点 |
||||||
|
|
||||||
|
* [x] 基于 xray 内核，又不像 xray（[**afrog 模板语法**](https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/README.md)） |
||||||
|
* [x] 性能卓越，快速稳定 |
||||||
|
* [x] 实时显示，扫描进度 |
||||||
|
* [x] 输出 html 报告，方便查看 `request` 和 `response` |
||||||
|
* [x] 启动程序，自动更新本地 PoC 库 |
||||||
|
* [x] 长期维护、更新 PoC（[**afrog-pocs**](https://github.com/zan8in/afrog/tree/main/pocs/afrog-pocs)） |
||||||
|
* [x] 二次开发，参考 `cmd/afrog/main.go` 或加入 **[交流群](https://github.com/zan8in/afrog#%E4%BA%A4%E6%B5%81%E7%BE%A4)** |
||||||
|
|
||||||
|
## 下载 |
||||||
|
|
||||||
|
### [下载地址](https://github.com/zan8in/afrog/releases) |
||||||
|
|
||||||
|
## 使用指南 |
||||||
|
|
||||||
|
### [查看指南](https://github.com/zan8in/afrog/blob/main/GUIDE.md) |
||||||
|
|
||||||
|
## 例子 |
||||||
|
|
||||||
|
扫描单个目标 |
||||||
|
``` |
||||||
|
afrog -t http://127.0.0.1 -o result.html |
||||||
|
``` |
||||||
|
 |
||||||
|
|
||||||
|
扫描多个目标 |
||||||
|
|
||||||
|
``` |
||||||
|
afrog -T urls.txt -o result.html |
||||||
|
``` |
||||||
|
例如：`urls.txt` |
||||||
|
``` |
||||||
|
http://192.168.139.129:8080 |
||||||
|
http://127.0.0.1 |
||||||
|
``` |
||||||
|
 |
||||||
|
|
||||||
|
测试单个 PoC 文件 |
||||||
|
|
||||||
|
``` |
||||||
|
afrog -t http://127.0.0.1 -P ./testing/poc-test.yaml -o result.html |
||||||
|
``` |
||||||
|
 |
||||||
|
|
||||||
|
测试多个 PoC 文件 |
||||||
|
|
||||||
|
``` |
||||||
|
afrog -t http://127.0.0.1 -P ./testing/ -o result.html |
||||||
|
``` |
||||||
|
 |
||||||
|
|
||||||
|
输出 html 报告 |
||||||
|
|
||||||
|
 |
||||||
|
|
||||||
|
 |
||||||
|
|
||||||
|
## 如何贡献 PoC？ |
||||||
|
|
||||||
|
### [查看教程](https://github.com/zan8in/afrog/blob/main/CONTRIBUTION.md) |
||||||
|
|
||||||
|
## PoC 列表 |
||||||
|
### [查看 PoC 列表](https://github.com/zan8in/afrog/blob/main/POCLIST.md) |
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<!--auto_detail_active_begin_e1c6fb434b6f0baf6912c7a1934f772b--> |
||||||
|
## 项目相关 |
||||||
|
|
||||||
|
|
||||||
|
## 最近更新 |
||||||
|
|
||||||
|
<!--auto_detail_active_end_f9cf7911015e9913b7e691a7a5878527--> |
||||||
Loading…
Reference in new issue