面向VMware的漏洞检测模型的设计与实现

发布时间：2018-04-11 00:15

本文选题：VMware + 漏洞检测　；参考：《北京交通大学》2016年硕士论文

【摘要】：虚拟化技术凭借充分利用宿主机资源、快速部署、高可用性等优势在企业中得到了广泛应用。近几年,随着企业信息化规模的不断扩大,虚拟服务器的部署规模也在不断扩大,相对于传统的企业IT解决方案,云计算将应用软件和数据库迁移至大型数据中心的服务器中,引发诸多安全挑战。自云计算提出以来,安全问题就一直困扰着云服务提供者和使用者,因此,关注云计算安全,增强云计算的安全性己经成为人们日益关注的问题。软硬件技术发展以及网络应用的普及推动了虚拟化软件发展,比较有代表性的是VNware、Xen、KVM、Hyper-V。以市场占有率来说,目前VMware所占的市场比例较大。作为系统虚拟化软件的代表,VMware平台,其漏洞多种多样,包括目录遍历漏洞、弱口令漏洞、格式化字符串漏洞、权限提升漏洞等多种漏洞。这些漏洞可能造成未授权的信息泄露、未授权的信息修改、管理员访问权限获取等威胁。VMware代码不开源,给其漏洞检测带来各种困难。本文提出了VMware漏洞检测模型,阐述了模型的总体结构、业务流程及架构设计,并以VMware的目录遍历漏洞、弱口令漏洞、格式化字符串漏洞、权限提升漏洞为例阐述了模型的具体设计与实现。首先,本文介绍了漏洞相关背景知识,包括漏洞原理以及漏洞触发条件等,并给出了漏洞检测模型的设计原理及实现；在VMware方面,本文介绍了该平台及其工作特征。同时,论文介绍了虚拟化技术的分类以及虚拟化环境下的安全威胁以及应对方式等背景知识,并分析了已有的漏洞检测工具及其利弊,给出了用现有工具检测VMware漏洞的结果。本文搭建相应版本的服务器作为实验环境,首先扫描服务器开放的端口和服务,然后构造相应攻击方式对目录遍历等相关漏洞进行验证。本文实验针对目录遍历漏洞,通过构造一些特殊的攻击模型,成功获取到了虚拟机相关配置文件,并在本地还原出虚拟机,获取用户敏感信息。另外,本文也针对VMware弱口令漏洞、格式化字符串漏洞、权限提升漏洞的检测模型进行了分析与研究。测试实验取得了理想的效果,成功再现了VMware相关漏洞。实验表明VMware中的这些漏洞确实给服务器带来很大的安全隐患,需要提高重视并加以修复。本文最后讨论了VMware相关漏洞防范措施。
[Abstract]:Virtualization technology has been widely used in enterprises by making full use of host resources, rapid deployment, high availability and other advantages.In recent years, with the continuous expansion of enterprise informatization, the deployment of virtual servers is also expanding. Compared with traditional enterprise IT solutions, cloud computing migrates applications and databases to servers in large data centers.Raises many security challenges.Since cloud computing has been put forward, security issues have been puzzling cloud service providers and consumers. Therefore, paying attention to cloud computing security and enhancing cloud computing security has become a growing concern.The development of software and hardware technology and the popularization of network application promote the development of virtualization software.In terms of market share, VMware accounts for a large proportion of the market.As the representative of system virtualization software, VMware platform has a variety of vulnerabilities, including directory traversal vulnerability, weak password vulnerability, format string vulnerability, privilege promotion vulnerability and so on.These vulnerabilities may cause unauthorized information disclosure, unauthorized information modification, administrator access rights acquisition and other threats. VMware code is not open source, which brings various difficulties to its vulnerability detection.In this paper, the VMware vulnerability detection model is proposed, and the overall structure, business process and architecture design of the model are described. The VMware directory traversal vulnerability, weak password vulnerability, format string vulnerability are used.The specific design and implementation of the model are described as an example.Firstly, this paper introduces the background knowledge of vulnerability, including vulnerability principle and vulnerability trigger condition, and gives the design principle and implementation of vulnerability detection model. In VMware, this paper introduces the platform and its working characteristics.At the same time, this paper introduces the classification of virtualization technology, the security threats and coping methods in virtualized environment, analyzes the existing vulnerability detection tools and their advantages and disadvantages, and gives the results of using existing tools to detect VMware vulnerabilities.This paper builds the corresponding version of the server as the experimental environment, first scanning the server open ports and services, and then construct the corresponding attack to verify the directory traversal and other related vulnerabilities.Aiming at the directory traversal vulnerability, this paper constructs some special attack models, obtains the virtual machine related configuration file successfully, and restores the virtual machine locally to obtain the sensitive information of the user.In addition, this paper also analyzes and studies the detection model of VMware weak password vulnerability, format string vulnerability and privilege enhancement vulnerability.The test results are satisfactory, and the VMware loophole is reproduced successfully.Experimental results show that these vulnerabilities in VMware do bring great security risks to the server, which need to be paid more attention to and fixed.At the end of this paper, the preventive measures of VMware vulnerabilities are discussed.
【学位授予单位】：北京交通大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP309

【相似文献】