Question

我最近问了一个问题，答案是我的boofuzz同行修复了我当时的问题，可见here。不幸的是，我现在收到另一个错误：pdx: [50] DebugActiveProcess(X): The request is not supported.（注意，X值是PID值，如输出中所述的那样改变）现在已经解决了上一个错误。我在64位Windows 7 Service Pack 1计算机上运行Python 2.7.9。

这里是我的boofuzz脚本的相关部分：

def fuzz(dst, dport):
    # Create session, specify high-arbitrary crash_threshold, low restart_sleep_time, check_data_received_each_request=False
    session = sessions.Session(
        crash_threshold="10000", 
        check_data_received_each_request=0,
        restart_sleep_time=0.1, 
        sleep_time=0.1,
    )
    # Define target
    target = sessions.Target(
        connection = SocketConnection(dst, dport, proto='tcp')
    )
    # Define procmon options
    target.procmon = pedrpc.Client(dst, 26002)
    target.procmon_options = {
        "proc_name" : "disksvs.exe",
        "stop_commands" : ['net stop "Disk Savvy Enterprise"'],
        "start_commands" : ['net start "Disk Savvy Enterprise"']        
    }

连接后我的procmon机器出错了。这是输出，运行：

模糊测试机

root@kali:~/scripts/exploits/diskSaavy# ./boofuzz-diskSaavy.py 192.168.138.142 9124
[2018-04-12 18:41:16,385]     Info: current fuzz path:  -> packet
[2018-04-12 18:41:16,385] Test Case: 1
[2018-04-12 18:41:16,385]     Info: primitive name: "SC 1", type: String, default value: SERVER_GET_INFO
[2018-04-12 18:41:16,385]     Info: Test case 1 of 6380 for this node. 1 of 6380 overall.
[2018-04-12 18:41:23,456]   Test Step: Fuzzing Node 'packet'
[2018-04-12 18:41:23,456]     Transmitting 37 bytes: 75 19 ba ab 03 00 00 00 00 00 00 00 1a 00 00 cc 20 00 00 00 02 32 01 44 41 54 41 01 30 01 00 00 00 60 c0 f1 02 b'u\x19\xba\xab\x03\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\xcc \x00\x00\x00\x022\x01DATA\x010\x01\x00\x00\x00`\xc0\xf1\x02'
[2018-04-12 18:41:23,456]     Info: 37 bytes sent
[2018-04-12 18:41:23,456]   Test Step: Calling post_send function:
[2018-04-12 18:41:23,456]     Info: No post_send callback registered.
[2018-04-12 18:41:23,456]   Test Step: Sleep between tests.
[2018-04-12 18:41:23,457]     Info: sleeping for 0.100000 seconds
[2018-04-12 18:41:23,557]   Test Step: Contact process monitor
[2018-04-12 18:41:23,557]     Check: procmon.post_send()
^C[2018-04-12 18:41:23,696]     Error!!!! SIGINT received ... exiting

Procmon Machine：

C:\Python27\Lib\site-packages\boofuzz>python process_monitor.py
Couldn't import dot_parser, loading of dot files will not be possible.
[06:31.24] Process Monitor PED-RPC server initialized:
[06:31.24]       crash file:  C:\Python27\Lib\site-packages\boofuzz\crash-bin
[06:31.24]       # records:   0
[06:31.24]       proc name:   None
[06:31.24]       log level:   1
[06:31.24] awaiting requests...
[06:31.56] updating target process name to 'disksvs.exe'
[06:31.56] updating stop commands to: ['net stop "Disk Savvy Enterprise"']
[06:31.57] updating start commands to: ['net start "Disk Savvy Enterprise"']
[06:31.57] starting target process
[06:31.57] done. target up and running, giving it 5 seconds to settle in.
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.

[06:32.02] debugger thread-1523572322 attaching to pid: 3436
Exception in thread 1523572322:
Traceback (most recent call last):
  File "C:\Python27\lib\threading.py", line 530, in __bootstrap_inner
    self.run()
  File "process_monitor.py", line 100, in run
    self.dbg.attach(self.pid)
  File "C:\Python27\lib\site-packages\pydbg\pydbg.py", line 226, in attach
    self.debug_active_process(pid)
  File "C:\Python27\lib\site-packages\pydbg\pydbg.py", line 839, in debug_active_process
    raise pdx("DebugActiveProcess(%d)" % pid, True)
pdx: [50] DebugActiveProcess(3436): The request is not supported.


[06:32.04] starting target process
[06:32.04] done. target up and running, giving it 5 seconds to settle in.
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.

[06:32.09] debugger thread-1523572329 attaching to pid: 1460
Exception in thread 1523572329:
Traceback (most recent call last):
  File "C:\Python27\lib\threading.py", line 530, in __bootstrap_inner
    self.run()
  File "process_monitor.py", line 100, in run
    self.dbg.attach(self.pid)
  File "C:\Python27\lib\site-packages\pydbg\pydbg.py", line 226, in attach
    self.debug_active_process(pid)
  File "C:\Python27\lib\site-packages\pydbg\pydbg.py", line 839, in debug_active_process
    raise pdx("DebugActiveProcess(%d)" % pid, True)
pdx: [50] DebugActiveProcess(1460): The request is not supported.

所以对我来说，好像我正确连接并且procmon收到我的开始，停止命令和进程名称（所有这些都是准确的）。然而，有趣的是，该过程似乎没有重新开始，但PID随着每次迭代而改变（在procmon中）。这显然会导致问题，因为disksvs.exe的PID与procmon尝试附加的内容不匹配。我有点不知所措，因为我查看了源文件，但无法确定procmon为什么会抓取错误的PID。

如果在模糊测试开始时没有启动，Procmon会正确启动服务，这很好，但不会过时。我还尝试删除proc_name参数只是为了看看会发生什么，但没有运气 - 同样的错误。

我非常乐意提供更多信息，请告诉我您的需求。

谢谢！

Answer 1

可能是您尝试运行32位应用程序。如果process_monitor.py尝试附加到64位进程，我会得到相同的错误。看起来你的目标有32位和64位选项。

32位清单是：

运行procmon的Python安装应该是32位。
Procmon只能附加到32位进程。

如果目标应用程序是64位并且它过早死亡，我会看到＆＃34;访问被拒绝。＆＃34;而不是＆＃34;不支持请求。＆＃34;

我创建了this pull request来改进错误处理和消息。

boofuzz / process_monitor.py - pdx：[50] DebugActiveProcess（X）：不支持请求

1 个答案: