This commit is contained in:
David Westgate 2024-06-07 23:15:28 -07:00
parent 116ed8d523
commit 67d3a154dd
5 changed files with 20 additions and 2 deletions

View File

@ -160,11 +160,18 @@ Now, we've run the commands to send the print job and cancle it, along with taki
## Step-1. Prepare message sequences as seed inputs ## Step-1. Prepare message sequences as seed inputs
We have prepared a seed corpus to fuzz ippserver. If you want to create your own seed corpus, please follow the tutorial for fuzzing Live555 RTSP server included in the main AFLNet README.md. I'll follow the same steps as the live555 example to generate seed inputs from this capture. This involves opening the capture in wireshark and looking at the tcp stream. Then I export one side of the raw stream.
In this case we have 2 seed inputs, one for the print request and one for the cancel job.
![wireshark](./part2/step1/wireshark.png)
I've saved this to [`ipstream_raw`](./part2/step1/ipp_stream.raw)
## Step-2. Fuzzing ## Step-2. Fuzzing
Now on to fuzzing. Likewise for this exercise, I will use the supplied corpus input rather than my own gathered in step 1 to avoid the likelyhood of a mistake since this is a long running process
The following commands from the readme will help
```bash ```bash
cd $WORKDIR/ippsample/server cd $WORKDIR/ippsample/server
cp $AFLNET/tutorials/ippsample/ippcleanup.sh ./ cp $AFLNET/tutorials/ippsample/ippcleanup.sh ./
@ -174,5 +181,16 @@ chmod +x ippcleanup.sh
afl-fuzz -d -i $AFLNET/tutorials/ippsample/in-ipp/ -o out-ipp/ -N tcp://127.0.0.1/631 -x $AFLNET/tutorials/ippsample/ipp.dict -P IPP -D 100000 -t 2000 -q 3 -s 3 -E -K -R -m 150 -c ippcleanup.sh ./ippserver -p 631 -f text/plain -d /tmp/afl-ramdisk/spool printerName afl-fuzz -d -i $AFLNET/tutorials/ippsample/in-ipp/ -o out-ipp/ -N tcp://127.0.0.1/631 -x $AFLNET/tutorials/ippsample/ipp.dict -P IPP -D 100000 -t 2000 -q 3 -s 3 -E -K -R -m 150 -c ippcleanup.sh ./ippserver -p 631 -f text/plain -d /tmp/afl-ramdisk/spool printerName
``` ```
Some setup comes first
![setup](./part2/step2/setup.png)
Now we start fuzzing
![afl-start](./part2/step2/afl-start.png)
TODO: end of fuzzing
## Step-4 Reproducing

Binary file not shown.

Binary file not shown.

After

Width:  |  Height:  |  Size: 252 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 102 KiB

BIN
hw5/part2/step2/setup.png Normal file

Binary file not shown.

After

Width:  |  Height:  |  Size: 14 KiB