diff --git a/hw5/hw5.md b/hw5/hw5.md index 668b1a6..d9db12f 100644 --- a/hw5/hw5.md +++ b/hw5/hw5.md @@ -1,7 +1,48 @@ # Homework 5: Fuzzing +## Prelude +The first step I took for this asignment was setting up the docker container. This was straightforward with the provided instructions + +![docker](./step0/docker.png) + +## Step-0 + +Here, I have followed the instructions the run the sample RTSP client and server + +The server running is shown here + +![step0-a](./step0/server.png) + +In another terminal, we run the sample client + +![step0-b](./step0/client.png) + ## Step-1. Prepare message sequences as seed inputs -First, I start the test server -![start server](./step1/start-server.png) \ No newline at end of file +At this point, we have the server and client running. The next step is to install TCP dump, and open it up on a 3rd terminal window. We can now restart the client and capture some traffic + +As we can see, with this approach we have captured 24 packets + +![step1/capture](./step1/capture.png) + +Using `docker cp` I have copied that file `rtsp.pcap` to my local machine, and also have included it at [./rtsp.pcap](./rtsp.pcap) + +Lets take a look at this file with `wireshark rtsp.pcap` + +![wireshark](./step1/wireshark.png) + +Following the instruction, we can save the raw TCP stream of the request messages to [rtsp_requests_wav.raw](./step1/rtsp_requests_wav.raw) + +## Step-3 Fuzzing + +We begin the fuzzing process running the supplied command +``` +afl-fuzz -d -i $AFLNET/tutorials/live555/in-rtsp -o out-live555 -N tcp://127.0.0.1/8554 -x $AFLNET/tutorials/live555/rtsp.dict -P RTSP -D 10000 -q 3 -s 3 -E -K -R ./testOnDemandRTSPServer 8554 +``` + +It seems off to a good start, and I will let this run for some time and check back later. In this case, I will use the provided seed corpus. + +![begin-fuzz](./step3/begin-fuzz.png) + +![afl](./step3/afl.png) \ No newline at end of file diff --git a/hw5/rtsp.pcap b/hw5/rtsp.pcap index e69de29..0a51a45 100644 Binary files a/hw5/rtsp.pcap and b/hw5/rtsp.pcap differ diff --git a/hw5/step0/client.png b/hw5/step0/client.png new file mode 100644 index 0000000..fe3ca89 Binary files /dev/null and b/hw5/step0/client.png differ diff --git a/hw5/step0/docker.png b/hw5/step0/docker.png new file mode 100644 index 0000000..9868f6c Binary files /dev/null and b/hw5/step0/docker.png differ diff --git a/hw5/step0/server.png b/hw5/step0/server.png new file mode 100644 index 0000000..7fca2d5 Binary files /dev/null and b/hw5/step0/server.png differ diff --git a/hw5/step1/capture.png b/hw5/step1/capture.png new file mode 100644 index 0000000..f0d5ada Binary files /dev/null and b/hw5/step1/capture.png differ diff --git a/hw5/step1/rtsp_requests_wav.raw b/hw5/step1/rtsp_requests_wav.raw new file mode 100644 index 0000000..7d489a6 --- /dev/null +++ b/hw5/step1/rtsp_requests_wav.raw @@ -0,0 +1,10 @@ +DESCRIBE rtsp://127.0.0.1:8554/wavAudioTest RTSP/1.0 +CSeq: 2 +User-Agent: ./testRTSPClient (LIVE555 Streaming Media v2018.08.28) +Accept: application/sdp + +SETUP rtsp://127.0.0.1:8554/wavAudioTest/track1 RTSP/1.0 +CSeq: 3 +User-Agent: ./testRTSPClient (LIVE555 Streaming Media v2018.08.28) +Transport: RTP/AVP;unicast;client_port=34668-34669 + diff --git a/hw5/step1/start-server.png b/hw5/step1/start-server.png deleted file mode 100644 index 7e1a681..0000000 Binary files a/hw5/step1/start-server.png and /dev/null differ diff --git a/hw5/step1/tcp-raw.png b/hw5/step1/tcp-raw.png new file mode 100644 index 0000000..5c3d977 Binary files /dev/null and b/hw5/step1/tcp-raw.png differ diff --git a/hw5/step1/wireshark.png b/hw5/step1/wireshark.png new file mode 100644 index 0000000..732d594 Binary files /dev/null and b/hw5/step1/wireshark.png differ diff --git a/hw5/step3/afl.png b/hw5/step3/afl.png new file mode 100644 index 0000000..b211a28 Binary files /dev/null and b/hw5/step3/afl.png differ diff --git a/hw5/step3/begin-fuzz.png b/hw5/step3/begin-fuzz.png new file mode 100644 index 0000000..51b0777 Binary files /dev/null and b/hw5/step3/begin-fuzz.png differ