boofuzz / process_monitor.py - pdx：[50] DebugActiveProcess(X)：不支持请求

Question

我最近问了一个问题，得到了一个答案，解决了我当时的问题，可查看的这里，为我的毛茸茸的同行。不幸的是，我现在收到了另一个错误：pdx: [50] DebugActiveProcess(X): The request is not supported. (注意，X值是PID值，它在输出中有变化)，因为前面的错误已经解决了。我在64位Windows 7的Service 1机器上运行Python2.7.9.

下面是我的boofuzz脚本的相关部分：

def fuzz(dst, dport):
    # Create session, specify high-arbitrary crash_threshold, low restart_sleep_time, check_data_received_each_request=False
    session = sessions.Session(
        crash_threshold="10000", 
        check_data_received_each_request=0,
        restart_sleep_time=0.1, 
        sleep_time=0.1,
    )
    # Define target
    target = sessions.Target(
        connection = SocketConnection(dst, dport, proto='tcp')
    )
    # Define procmon options
    target.procmon = pedrpc.Client(dst, 26002)
    target.procmon_options = {
        "proc_name" : "disksvs.exe",
        "stop_commands" : ['net stop "Disk Savvy Enterprise"'],
        "start_commands" : ['net start "Disk Savvy Enterprise"']        
    }

连接后，我在我的机器上出了个错误。以下是运行时的输出：

引信机：

root@kali:~/scripts/exploits/diskSaavy# ./boofuzz-diskSaavy.py 192.168.138.142 9124
[2018-04-12 18:41:16,385]     Info: current fuzz path:  -> packet
[2018-04-12 18:41:16,385] Test Case: 1
[2018-04-12 18:41:16,385]     Info: primitive name: "SC 1", type: String, default value: SERVER_GET_INFO
[2018-04-12 18:41:16,385]     Info: Test case 1 of 6380 for this node. 1 of 6380 overall.
[2018-04-12 18:41:23,456]   Test Step: Fuzzing Node 'packet'
[2018-04-12 18:41:23,456]     Transmitting 37 bytes: 75 19 ba ab 03 00 00 00 00 00 00 00 1a 00 00 cc 20 00 00 00 02 32 01 44 41 54 41 01 30 01 00 00 00 60 c0 f1 02 b'u\x19\xba\xab\x03\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\xcc \x00\x00\x00\x022\x01DATA\x010\x01\x00\x00\x00`\xc0\xf1\x02'
[2018-04-12 18:41:23,456]     Info: 37 bytes sent
[2018-04-12 18:41:23,456]   Test Step: Calling post_send function:
[2018-04-12 18:41:23,456]     Info: No post_send callback registered.
[2018-04-12 18:41:23,456]   Test Step: Sleep between tests.
[2018-04-12 18:41:23,457]     Info: sleeping for 0.100000 seconds
[2018-04-12 18:41:23,557]   Test Step: Contact process monitor
[2018-04-12 18:41:23,557]     Check: procmon.post_send()
^C[2018-04-12 18:41:23,696]     Error!!!! SIGINT received ... exiting

Procmon机器：

C:\Python27\Lib\site-packages\boofuzz>python process_monitor.py
Couldn't import dot_parser, loading of dot files will not be possible.
[06:31.24] Process Monitor PED-RPC server initialized:
[06:31.24]       crash file:  C:\Python27\Lib\site-packages\boofuzz\crash-bin
[06:31.24]       # records:   0
[06:31.24]       proc name:   None
[06:31.24]       log level:   1
[06:31.24] awaiting requests...
[06:31.56] updating target process name to 'disksvs.exe'
[06:31.56] updating stop commands to: ['net stop "Disk Savvy Enterprise"']
[06:31.57] updating start commands to: ['net start "Disk Savvy Enterprise"']
[06:31.57] starting target process
[06:31.57] done. target up and running, giving it 5 seconds to settle in.
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.

[06:32.02] debugger thread-1523572322 attaching to pid: 3436
Exception in thread 1523572322:
Traceback (most recent call last):
  File "C:\Python27\lib\threading.py", line 530, in __bootstrap_inner
    self.run()
  File "process_monitor.py", line 100, in run
    self.dbg.attach(self.pid)
  File "C:\Python27\lib\site-packages\pydbg\pydbg.py", line 226, in attach
    self.debug_active_process(pid)
  File "C:\Python27\lib\site-packages\pydbg\pydbg.py", line 839, in debug_active_process
    raise pdx("DebugActiveProcess(%d)" % pid, True)
pdx: [50] DebugActiveProcess(3436): The request is not supported.


[06:32.04] starting target process
[06:32.04] done. target up and running, giving it 5 seconds to settle in.
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.

[06:32.09] debugger thread-1523572329 attaching to pid: 1460
Exception in thread 1523572329:
Traceback (most recent call last):
  File "C:\Python27\lib\threading.py", line 530, in __bootstrap_inner
    self.run()
  File "process_monitor.py", line 100, in run
    self.dbg.attach(self.pid)
  File "C:\Python27\lib\site-packages\pydbg\pydbg.py", line 226, in attach
    self.debug_active_process(pid)
  File "C:\Python27\lib\site-packages\pydbg\pydbg.py", line 839, in debug_active_process
    raise pdx("DebugActiveProcess(%d)" % pid, True)
pdx: [50] DebugActiveProcess(1460): The request is not supported.

因此，在我看来，我似乎正在正确地连接，procmon接收我的开始、停止命令和进程名称(所有这些都是准确的)。然而，有趣的是，进程似乎没有被重新启动，但是PID随每次迭代而改变(在procmon中)。这显然会导致问题，因为disksvs.exe的PID与procmon试图附加的PID不匹配。我有点不知所措，因为我已经看过源文件，但不清楚为什么procmon要抓取一个不正确的PID。

如果服务在模糊启动时未启动，则Procmon将正确启动该服务，这是很好的，但不会过得太远。我还尝试删除proc_name参数，只是为了看看会发生什么，但没有运气-相同的错误。

我非常乐意提供更多的信息，让我知道你需要什么。

谢谢!

Answer 1

这可能是因为你试图运行一个32位的应用程序。如果process_monitor.py试图附加到64位进程，我会得到同样的错误。看起来你的目标有32位和64位的选项。

32位清单是：

1. 运行procmon的Python安装应该是32位。
2. Procmon只能附加到32位进程。

如果目标应用程序是64位，并且过早死亡，我看到“访问被拒绝”。而不是“不支持请求”。

我创建此拉请求是为了改进错误处理和消息。