CVEX: eXecutable CVEs

What is CVEX?

CVEX is a framework for the reproducible exploitation of CVE vulnerabilities:

• Provides blueprints of pre-made exploitation setups, pre-configured with metadata collection facilities (raw traffic, HTTP/S requests, system calls/API calls).
• Uses virtualization to instantiate the blueprint and automatically execute the attack, supporting live analysis of exploitation.
• Separates infrastructure from CVE-related configuration allowing for reuse of blueprints.
• Incentivizes contributors to share reproducible exploits.

Tech stack:

• Virtualization: Vagrant
• Installation and configuration: Ansible
• Network traffic collection: tcpdump
• HTTPS collection: mitmproxy
• Linux syscall collection: strace
• Windows API collection: Process Monitor

Installation

CVEX has been tested on Ubuntu 24.04, 22.04, and 20.04.

Create virtual environment (optional):

python3 -m venv venv
source venv/bin/activate

Install CVEX:

~/CVEX$ sudo apt update
~/CVEX$ pip install -e .

Install Vagrant 2.4.1:

wget https://releases.hashicorp.com/vagrant/2.4.1/vagrant-2.4.1-1.x86_64.rpm
sudo apt install alien
sudo alien -i vagrant-2.4.1-1.x86_64.rpm

Install VirtualBox 7.0.20 (Ubuntu 22.04):

wget https://download.virtualbox.org/virtualbox/7.0.20/virtualbox-7.0_7.0.20-163906~Ubuntu~jammy_amd64.deb
sudo dpkg -i virtualbox-7.0_7.0.20-163906~Ubuntu~jammy_amd64.deb
wget https://download.virtualbox.org/virtualbox/7.0.20/Oracle_VM_VirtualBox_Extension_Pack-7.0.20.vbox-extpack
sudo vboxmanage extpack install Oracle_VM_VirtualBox_Extension_Pack-7.0.20.vbox-extpack

Refer to the VirtualBox download page to find the appropriate package of VirtualBox that suits your OS. If dpkg shows errors during installation, run this command to fix them:

sudo apt --fix-broken install

While in theory Vagrant should work with any VM provider, CVEX was tested only with VirtualBox.

Run

Execute CVE by providing the CVEX record folder to the cvex command:

~/CVEX$ cvex records/CVE-0000-00001

CVEX comes with a set of PoCs:

• CVE-0000-00000: curl, executed on Windows, downloads a web-page from ngix, running on Ubuntu

• CVE-0000-00001: curl, executed on Ubuntu, downloads a web-page from ngix, running on another Ubuntu
• CVE-0000-00002: curl, executed on Ubuntu, downloads a web-page from ngix, running on Windows
• CVE-0000-00003: curl, executed on Windows, downloads a web-page from ngix, running on another Windows
• CVE-2021-44228: Log4j vulnerability with backconnect to remote shell

Debug

1. Re-start CVEX.
2. Restart CVEX with the -v parameter (verbose logging).
3. Connect to the VM via SSH with the help of vagrant ssh command
   How to use "vagrant ssh"

$ cd ~/.cvex/bento_ubuntu-22.04/202404.23.0/1/

~/.cvex/bento_ubuntu-22.04/202404.23.0/1$ vagrant snapshot restore CVE-2021-44228/ubuntu1
==> default: Restoring the snapshot 'CVE-2021-44228/ubuntu1'...
==> default: Checking if box 'bento/ubuntu-22.04' version '202404.23.0' is up to date...
==> default: Resuming suspended VM...
==> default: Booting VM...
==> default: Waiting for machine to boot. This may take a few minutes...
    default: SSH address: 127.0.0.1:2201
    default: SSH username: vagrant
    default: SSH auth method: private key
==> default: Machine booted and ready!
==> default: Machine already provisioned. Run `vagrant provision` or use the `--provision`
==> default: flag to force provisioning. Provisioners marked to run always will still run.

~/.cvex/bento_ubuntu-22.04/202404.23.0/1$ vagrant ssh
Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 5.15.0-102-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

  System information as of Thu Oct 10 06:33:32 AM UTC 2024

  System load:  1.0625             Users logged in:          0
  Usage of /:   15.2% of 30.34GB   IPv4 address for docker0: 172.17.0.1
  Memory usage: 22%                IPv4 address for eth0:    10.0.2.15
  Swap usage:   0%                 IPv4 address for eth1:    192.168.56.4
  Processes:    155

This system is built by the Bento project by Chef Software
More information can be found at https://github.com/chef/bento
Last login: Wed Oct  9 13:29:41 2024 from 10.0.2.2

vagrant@ubuntu:~$ 

Use VirtualBox GUI to manage VMs and snapshots.

Managing VMs

CVEX executed with -l parameter shows the list of cached VMs:

$ cvex -l
2024-09-19 10:41:45,410 - INFO - [main] Cached VMs:
2024-09-19 10:41:45,410 - INFO - [main] router
2024-09-19 10:41:45,410 - INFO - [main] gusztavvargadr_windows-10/2202.0.2404/1
2024-09-19 10:41:45,411 - INFO - [main] bento_ubuntu-22.04/202404.23.0/1

CVEX executed with -d parameter destroys the specific VM and deletes all corresponding files in the ~/.cvex folder:

$ cvex -d gusztavvargadr_windows-10/2202.0.2404/1
2024-09-19 10:45:57,769 - INFO - [stub] Destroying VM stub...

However, even though the VM disappears from the VirtialBox GUI, some remnants may remain in the ~/VirtualBox VMs folder. Delete them manually.

cvex -d all destroys all VMs.