基于电网系统的远程代码执行漏洞自动化分析与重现技术

Automatic Analysis and Reproduction Technology of Remote Code Execution Vulnerability Based on Grid System

远程代码执行漏洞是工业界的网络安全攻防中危害最大的漏洞种类之一,能够直接控制目标电网系统.在遭受攻击后,对内存破坏类型的漏洞进行分析十分困难,由于在此类漏洞利用过程中,攻击者可能会随机化地绕过地址空间.针对二进制远程代码执行类漏洞中对地址空间随机化的绕过手段,设计并实现了基于流量的自动化分析与利用工具,能够分析并且重现执行漏洞.提出影子服务技术,在完全可控的环境下建立与目标服务环境相同的影子服务;在此基础上提出同步处理技术,处理已记录攻击流量.实验结果表明,防御者可以使用该工具快速针对原生服务的远程代码执行漏洞调查,从而防止利用同类漏洞再次攻击.

Remote code execution vulnerability is one of the most harmful vulnerabilities in industrial network security attacks and defense,which can directly control the target power grid system.After an attack,it is difficult to analyze the memory corruption type vulnerability,because the attacker may use address space randomization bypass during such vulnerability exploitation.Aiming at the circumvention of address space randomization in binary remote code execution vulnerability,this paper designs and implements an automatic analysis and utilization tool based on traffic,which can analyze and reproduce execution vulnerability.The shadow service technology is proposed to establish the same shadow service as the target service environment in a completely controllable environment.On this basis,a synchronous processing technique is proposed to deal with the recorded attack traffic.The results show that defenders can use this tool to quickly perform vulnerability investigations against remote code targeting native services,thus preventing similar exploits from being used again.