Jeremy Rauch: PDB: The Protocol DeBugger

Black Hat Briefings, Las Vegas 2006 [Video] Presentations from the security conference

English - June 04, 2006 23:10 - 1 hour - 201 KB Video - ★★★★ - 4 ratings
Technology News Tech News blackhat usa 2006 black hat vegas blackhat vegas hacking convention computer security speeches presentations spoken word video Homepage Download Apple Podcasts Google Podcasts Overcast Castro Pocket Casts RSS feed

It's late. You've been assigned the unenviable task of evaluating the security of this obtuse application suite. 2006! Why doesn't everything just use SSL as its transport? No time for excuses. Deadlines loom, and you need to figure this out. And when you do figure it out, write your own fuzzer client.

This sucks.

(pdb) module add MyAction pdb-ruby.so cifs-ruby.rb
(pdb) rule add MyRule dst port 445
(pdb) rule action MyRule MyAction
(pdb) rule list
MyRule: dst port 445
Action 0: debugger
Action 1: MyAction
(pdb) go
...
(pdb) print
00000000: 45 10 00 3c 70 86 40 00 E...p...
00000008: 40 06 00 00 c0 a8 02 06 ........
00000010: c0 a8 02 56 d8 a0 01 bd ...V....
00000018: 1e 76 1b 71 00 00 00 00 .v.q....
00000020: a0 02 ff ff 14 1b 00 00 ........
00000028: 02 04 05 b4 01 03 03 00 ........
00000030: 01 01 08 0a 20 4a 7c b1 .....J..
00000038: 00 00 00 00 ....
(pdb) x/b 0x8
40
(pdb) e/b 0x8 0x20
(pdb) print
00000000: 45 10 00 3c 70 86 40 00 E...p...
00000008: 20 06 00 00 c0 a8 02 06 ........
00000010: c0 a8 02 56 d8 a0 01 bd ...V....
00000018: 1e 76 1b 71 00 00 00 00 .v.q....
00000020: a0 02 ff ff 14 1b 00 00 ........
00000028: 02 04 05 b4 01 03 03 00 ........
00000030: 01 01 08 0a 20 4a 7c b1 .....J..
00000038: 00 00 00 00 ....
(pdb) continue
cifs-ruby.rb performing packet alteration...
...

But wait, whats this? A tool chain geared around dissecting protocols like a code debugger slices through code? A protocol generation and manipulation framework with a clean, consistent interface, thats scripted instead of compiled? And a fuzzing framework to go along with it? You're saved! Or at least, maybe you'll get to sleep before the sun comes up.

PDB is a Protocol DeBugger. GDB meets a transparent proxy. Conditionally break based on BPF filters. Modify protocol contents on the fly. Build custom actions that let you manipulate how you speak on the network. Or manually edit protocol fields and send the packets along.

Racket is a protocol generation and manipulation library, in Ruby. Why Ruby? Why not. Use it as a way of writing PDB actions, or on its own. We're flexible that way.

Ramble is a Ruby based fuzzing framework. Set it going, and it just goes on and on and on. We know people like that-but unlike them, Ramble is helpful. Automates the protocol testing you're going to have to do to get full coverage. Do the hard stuff by hand. Use Ramble to do the repetitive stuff."