python - boofuzz/process_monitor.py - pdx : [50] DebugActiveProcess(X): The request is not supported

Question

我最近问了一个问题，得到了一个答案，为我的 boofuzz 同行解决了我当时的问题 viewable here 。不幸的是，我现在收到另一个错误:pdx:[50] DebugActiveProcess(X):不支持该请求。(注意，X值是PID值，现在之前的错误已得到解决，其变化如输出中所述。我在 64 位 Windows 7 Service Pack 1 计算机上运行 Python 2.7.9。

以下是我的 boofuzz 脚本的相关部分:

def fuzz(dst, dport):
    # Create session, specify high-arbitrary crash_threshold, low restart_sleep_time, check_data_received_each_request=False
    session = sessions.Session(
        crash_threshold="10000", 
        check_data_received_each_request=0,
        restart_sleep_time=0.1, 
        sleep_time=0.1,
    )
    # Define target
    target = sessions.Target(
        connection = SocketConnection(dst, dport, proto='tcp')
    )
    # Define procmon options
    target.procmon = pedrpc.Client(dst, 26002)
    target.procmon_options = {
        "proc_name" : "disksvs.exe",
        "stop_commands" : ['net stop "Disk Savvy Enterprise"'],
        "start_commands" : ['net start "Disk Savvy Enterprise"']        
    }

连接后，我的 procmon 机器上出现错误。这是运行时的输出:

起毛机:

root@kali:~/scripts/exploits/diskSaavy# ./boofuzz-diskSaavy.py 192.168.138.142 9124
[2018-04-12 18:41:16,385]     Info: current fuzz path:  -> packet
[2018-04-12 18:41:16,385] Test Case: 1
[2018-04-12 18:41:16,385]     Info: primitive name: "SC 1", type: String, default value: SERVER_GET_INFO
[2018-04-12 18:41:16,385]     Info: Test case 1 of 6380 for this node. 1 of 6380 overall.
[2018-04-12 18:41:23,456]   Test Step: Fuzzing Node 'packet'
[2018-04-12 18:41:23,456]     Transmitting 37 bytes: 75 19 ba ab 03 00 00 00 00 00 00 00 1a 00 00 cc 20 00 00 00 02 32 01 44 41 54 41 01 30 01 00 00 00 60 c0 f1 02 b'u\x19\xba\xab\x03\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\xcc \x00\x00\x00\x022\x01DATA\x010\x01\x00\x00\x00`\xc0\xf1\x02'
[2018-04-12 18:41:23,456]     Info: 37 bytes sent
[2018-04-12 18:41:23,456]   Test Step: Calling post_send function:
[2018-04-12 18:41:23,456]     Info: No post_send callback registered.
[2018-04-12 18:41:23,456]   Test Step: Sleep between tests.
[2018-04-12 18:41:23,457]     Info: sleeping for 0.100000 seconds
[2018-04-12 18:41:23,557]   Test Step: Contact process monitor
[2018-04-12 18:41:23,557]     Check: procmon.post_send()
^C[2018-04-12 18:41:23,696]     Error!!!! SIGINT received ... exiting

Procmon 机器:

C:\Python27\Lib\site-packages\boofuzz>python process_monitor.py
Couldn't import dot_parser, loading of dot files will not be possible.
[06:31.24] Process Monitor PED-RPC server initialized:
[06:31.24]       crash file:  C:\Python27\Lib\site-packages\boofuzz\crash-bin
[06:31.24]       # records:   0
[06:31.24]       proc name:   None
[06:31.24]       log level:   1
[06:31.24] awaiting requests...
[06:31.56] updating target process name to 'disksvs.exe'
[06:31.56] updating stop commands to: ['net stop "Disk Savvy Enterprise"']
[06:31.57] updating start commands to: ['net start "Disk Savvy Enterprise"']
[06:31.57] starting target process
[06:31.57] done. target up and running, giving it 5 seconds to settle in.
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.

[06:32.02] debugger thread-1523572322 attaching to pid: 3436
Exception in thread 1523572322:
Traceback (most recent call last):
  File "C:\Python27\lib\threading.py", line 530, in __bootstrap_inner
    self.run()
  File "process_monitor.py", line 100, in run
    self.dbg.attach(self.pid)
  File "C:\Python27\lib\site-packages\pydbg\pydbg.py", line 226, in attach
    self.debug_active_process(pid)
  File "C:\Python27\lib\site-packages\pydbg\pydbg.py", line 839, in debug_active_process
    raise pdx("DebugActiveProcess(%d)" % pid, True)
pdx: [50] DebugActiveProcess(3436): The request is not supported.


[06:32.04] starting target process
[06:32.04] done. target up and running, giving it 5 seconds to settle in.
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.

[06:32.09] debugger thread-1523572329 attaching to pid: 1460
Exception in thread 1523572329:
Traceback (most recent call last):
  File "C:\Python27\lib\threading.py", line 530, in __bootstrap_inner
    self.run()
  File "process_monitor.py", line 100, in run
    self.dbg.attach(self.pid)
  File "C:\Python27\lib\site-packages\pydbg\pydbg.py", line 226, in attach
    self.debug_active_process(pid)
  File "C:\Python27\lib\site-packages\pydbg\pydbg.py", line 839, in debug_active_process
    raise pdx("DebugActiveProcess(%d)" % pid, True)
pdx: [50] DebugActiveProcess(1460): The request is not supported.

所以对我来说，看起来我连接正确，并且 procmon 收到了我的启动、停止命令和进程名称(所有这些都是准确的)。然而有趣的是，该进程似乎没有重新启动，但 PID 随着每次迭代而变化(在 procmon 中)。这显然会导致问题，因为 disksvs.exe 的 PID 与 procmon 尝试附加的不匹配。我有点不知所措，因为我查看了源文件，但无法准确理解为什么 procmon 会获取不正确的 PID。

如果在模糊测试开始时未启动服务，Procmon 会正确启动服务，这很好，但还远远不够。我还尝试删除 proc_name 参数只是为了看看会发生什么，但没有运气 - 同样的错误。

我非常乐意提供更多信息，请告诉我您需要什么。

谢谢!

Answer 1

您可能正在尝试运行 32 位应用程序。如果 process_monitor.py 尝试附加到 64 位进程，我会收到相同的错误。您的目标似乎同时提供 32 位和 64 位选项。

32 位 list 是:

1. 用于运行 procmon 的 Python 安装应该是 32 位。
2. Procmon 只能附加到 32 位进程。

如果目标应用程序是 64 位并且它过早终止，我会看到“访问被拒绝”。而不是“不支持该请求。”

我创建了this pull request改进错误处理和消息。