IoTAEG: Automatic Exploit Generation of IoT Devices

Automatic exploit generation (AEG) refers to the process of automatically finding the path in the program that can trigger vulnerabilities and generate exploits. Generally speaking, the process of finding vulnerabilities needs to apply fuzzing and symbolic execution techniques. Existing AEG generally targets executables for regular Linux and Windows platforms, but no AEG for vulnerable Internet of Things (IoT) devices. In response to this situation, we propose the exploit generation system IoTAEG, which automatically detects stack overflow vulnerabilities in the firmware of IoT devices, and automatically generates and exploits the generation system based on the stack overflow vulnerabilities. IoTAEG uses the mature fuzzing software AFL++ to detect vulnerabilities in IoT devices, uses the crashed input found by AFL++ to construct a symbolic state through symbolic execution, dynamically analyzes the constructed symbolic state, and detects whether there are exploitable vulnerabilities. If the above vulnerabilities exist, different exploit generation strategies will be adopted for different protection mechanisms, and some protection mechanisms such as Address space layout randomization (ASLR) and Non-eXecute (NX) will be bypassed. For some difficult-to-exploit cases, IoTAEG uses advanced stack overflow exploitation methods to generate exploits. Experiments show that IoTAEG can complete 20 MIPS/ARM binary files and 8 IoT devices' firmware vulnerability detection and exploit generation. IoTAEG is the first publicly available vulnerability mining and exploit generation system for IoT devices.