diff --git a/hw5/hw5.md b/hw5/hw5.md index a58cd10..91d1e95 100644 --- a/hw5/hw5.md +++ b/hw5/hw5.md @@ -160,11 +160,18 @@ Now, we've run the commands to send the print job and cancle it, along with taki ## Step-1. Prepare message sequences as seed inputs -We have prepared a seed corpus to fuzz ippserver. If you want to create your own seed corpus, please follow the tutorial for fuzzing Live555 RTSP server included in the main AFLNet README.md. -In this case we have 2 seed inputs, one for the print request and one for the cancel job. +I'll follow the same steps as the live555 example to generate seed inputs from this capture. This involves opening the capture in wireshark and looking at the tcp stream. Then I export one side of the raw stream. + +![wireshark](./part2/step1/wireshark.png) + +I've saved this to [`ipstream_raw`](./part2/step1/ipp_stream.raw) + + ## Step-2. Fuzzing +Now on to fuzzing. Likewise for this exercise, I will use the supplied corpus input rather than my own gathered in step 1 to avoid the likelyhood of a mistake since this is a long running process +The following commands from the readme will help ```bash cd $WORKDIR/ippsample/server cp $AFLNET/tutorials/ippsample/ippcleanup.sh ./ @@ -174,5 +181,16 @@ chmod +x ippcleanup.sh afl-fuzz -d -i $AFLNET/tutorials/ippsample/in-ipp/ -o out-ipp/ -N tcp://127.0.0.1/631 -x $AFLNET/tutorials/ippsample/ipp.dict -P IPP -D 100000 -t 2000 -q 3 -s 3 -E -K -R -m 150 -c ippcleanup.sh ./ippserver -p 631 -f text/plain -d /tmp/afl-ramdisk/spool printerName ``` +Some setup comes first + +![setup](./part2/step2/setup.png) + +Now we start fuzzing + +![afl-start](./part2/step2/afl-start.png) + +TODO: end of fuzzing + +## Step-4 Reproducing diff --git a/hw5/part2/step1/ipp_stream.raw b/hw5/part2/step1/ipp_stream.raw new file mode 100644 index 0000000..7bf4c36 Binary files /dev/null and b/hw5/part2/step1/ipp_stream.raw differ diff --git a/hw5/part2/step1/wireshark.png b/hw5/part2/step1/wireshark.png new file mode 100644 index 0000000..0f2f38c Binary files /dev/null and b/hw5/part2/step1/wireshark.png differ diff --git a/hw5/part2/step2/afl-start.png b/hw5/part2/step2/afl-start.png new file mode 100644 index 0000000..a931782 Binary files /dev/null and b/hw5/part2/step2/afl-start.png differ diff --git a/hw5/part2/step2/setup.png b/hw5/part2/step2/setup.png new file mode 100644 index 0000000..1ae893f Binary files /dev/null and b/hw5/part2/step2/setup.png differ