Guess how likely is it that the bug causing the crash can be leveraged into an exploitable vulnerability. @note: Don't take this as an equivalent of a real exploitability analysis, that can only be done by a human being! This is only a guideline, use
(self)
| 710 | # add the name and version of the binary where the crash happened? |
| 711 | |
| 712 | def isExploitable(self): |
| 713 | """ |
| 714 | Guess how likely is it that the bug causing the crash can be leveraged |
| 715 | into an exploitable vulnerability. |
| 716 | |
| 717 | @note: Don't take this as an equivalent of a real exploitability |
| 718 | analysis, that can only be done by a human being! This is only |
| 719 | a guideline, useful for example to sort crashes - placing the most |
| 720 | interesting ones at the top. |
| 721 | |
| 722 | @see: The heuristics are similar to those of the B{!exploitable} |
| 723 | extension for I{WinDBG}, which can be downloaded from here: |
| 724 | |
| 725 | U{http://www.codeplex.com/msecdbg} |
| 726 | |
| 727 | @rtype: tuple( str, str, str ) |
| 728 | @return: The first element of the tuple is the result of the analysis, |
| 729 | being one of the following: |
| 730 | |
| 731 | - Not an exception |
| 732 | - Not exploitable |
| 733 | - Not likely exploitable |
| 734 | - Unknown |
| 735 | - Probably exploitable |
| 736 | - Exploitable |
| 737 | |
| 738 | The second element of the tuple is a code to identify the matched |
| 739 | heuristic rule. |
| 740 | |
| 741 | The third element of the tuple is a description string of the |
| 742 | reason behind the result. |
| 743 | """ |
| 744 | |
| 745 | # Terminal rules |
| 746 | |
| 747 | if self.eventCode != win32.EXCEPTION_DEBUG_EVENT: |
| 748 | return ("Not an exception", "NotAnException", "The event is not an exception.") |
| 749 | |
| 750 | if self.stackRange and self.pc is not None and self.stackRange[0] <= self.pc < self.stackRange[1]: |
| 751 | return ("Exploitable", "StackCodeExecution", "Code execution from the stack is considered exploitable.") |
| 752 | |
| 753 | # This rule is NOT from !exploitable |
| 754 | if self.stackRange and self.sp is not None and not (self.stackRange[0] <= self.sp < self.stackRange[1]): |
| 755 | return ("Exploitable", "StackPointerCorruption", "Stack pointer corruption is considered exploitable.") |
| 756 | |
| 757 | if self.exceptionCode == win32.EXCEPTION_ILLEGAL_INSTRUCTION: |
| 758 | return ( |
| 759 | "Exploitable", |
| 760 | "IllegalInstruction", |
| 761 | "An illegal instruction exception indicates that the attacker controls execution flow.", |
| 762 | ) |
| 763 | |
| 764 | if self.exceptionCode == win32.EXCEPTION_PRIV_INSTRUCTION: |
| 765 | return ( |
| 766 | "Exploitable", |
| 767 | "PrivilegedInstruction", |
| 768 | "A privileged instruction exception indicates that the attacker controls execution flow.", |
| 769 | ) |
no test coverage detected