LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 10-23-2016, 12:50 AM   #1
watchintv
Member
 
Registered: Oct 2016
Posts: 57

Rep: Reputation: Disabled
Trying to write a simple fuzzer with Peach to detect a buffer overflow


I'm trying to write a simple fuzzer that detects a buffer overflow. The code I want to fuzz is below:

Code:
#include <stdio.h>

int main(int argc, char *argv[])
{
char buf[256];
memcpy(buf, argv[1],strlen(argv[1]));
printf(buf);
}
And my current Peach Pit is the following:

Code:
<?xml version="1.0" encoding="utf-8"?>
<Peach xmlns="http://peachfuzzer.com/2012/Peach" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://peachfuzzer.com/2012/Peach /peach/peach.xsd">

    <!-- Fuzzing the Extract program with a malformed parameter -->
    <DataModel name="program">
        <String value="./test " />
    </DataModel>


    <DataModel name="parameter">
        <String value="" >
            <Analyzer class="StringToken"/>
        </String>
    </DataModel>


    <StateModel name="TheState" initialState="Initial">
        <State name="Initial">
            <!-- we write a batch file which Peach calls -->
            <!-- for example, a test run would have the contents "Extract.exe C:\output_dir" in the batch file -->
            <!-- subsequent runs will have the contents "Extract.exe [fuzzed data goes here]" -->
            <Action type="output">
                <DataModel ref="program"/>
            </Action>

            <Action type="output">
                <DataModel ref="parameter"/>
            </Action>

            <Action type="close" />

            <Action type="call" method="Runprogram" publisher="Peach.Agent"/>
        </State>
    </StateModel>

<Agent name="LinAgent">

                <Monitor class="LinuxDebugger">
       <!-- This is the program we're going to run inside of the debugger -->
<Param name="Executable" value="./call_program.bat"/>

		</Monitor>

</Agent>

    <Test name="Default">
        <!-- We only want to fuzz the Extract program's parameter, hence the following line -->
        <Exclude xpath="//program" />

        <StateModel ref="TheState"/>

        <Strategy class="Sequential"/>

        <Publisher class="File">
            <Param name="FileName" value="call_program.bat" />
        </Publisher>

           <Logger class="File">
                        <!-- save crash information in the Logs directory -->
                        <Param name="Path" value="Logs"/>
                </Logger>


    </Test>

</Peach>
<!-- end -->
ow can I make this work? Any help would be greatly appreciated. Thank you. I've found a few references to this exact thing but I can't get the files to work correctly.

Last edited by watchintv; 10-23-2016 at 12:53 AM.
 
Old 10-24-2016, 07:22 AM   #2
watchintv
Member
 
Registered: Oct 2016
Posts: 57

Original Poster
Rep: Reputation: Disabled
Doesn't anyone know? Any advice where I can get help with this. The Peach Community forum is moderated and none of my posts go through.
 
Old 10-25-2016, 11:05 AM   #3
ondoho
LQ Addict
 
Registered: Dec 2013
Posts: 19,872
Blog Entries: 12

Rep: Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053
now you brought your post out of zero reply status, which is not a desirable thing to do on LQ, if you really need help, because now it won't float up to the top anymore. duh.
i cannot help with your problem at all.
all i see is some very specialized verbiage ("fuzzer" "peach pit") and no links to anything that might shed more light at the whole problem.
well ok, i can clearly see "peachfuzzer.com" there at the top, so i went to have a look: "Peach’s revolutionary fuzzing engine outperforms its competitors, discovering unknown system vulnerabilities like no other testing method can." - i have no idea how that would relate to those few lines of C code.
sorry.
maybe by keeping the rant going, someone knowledgeable will eventually see this, or you provide more info.
 
Old 10-29-2016, 11:10 AM   #4
ntubski
Senior Member
 
Registered: Nov 2005
Distribution: Debian, Arch
Posts: 3,780

Rep: Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081
Quote:
Originally Posted by ondoho View Post
well ok, i can clearly see "peachfuzzer.com" there at the top, so i went to have a look: "Peach’s revolutionary fuzzing engine outperforms its competitors, discovering unknown system vulnerabilities like no other testing method can." - i have no idea how that would relate to those few lines of C code.
There's a bit more info here: http://community.peachfuzzer.com/v3/...uickStart.html, but the docs aren't exactly friendly; maybe, if you'll forgive my cynicism, because they want to sell more training sessions.
 
Old 10-29-2016, 01:22 PM   #5
watchintv
Member
 
Registered: Oct 2016
Posts: 57

Original Poster
Rep: Reputation: Disabled
I actually solved this by writing a custom Monitor. Wasn't too hard. So this is solved.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
buffer overflow problem djgerbavore Programming 1 05-17-2005 03:59 AM
What is a buffer overflow Joey.Dale Linux - Security 4 07-12-2004 05:12 PM
Buffer Overflow pymehta Linux - Security 7 02-24-2004 01:19 PM
buffer overflow cxel91a Programming 3 08-14-2003 05:23 PM
Q. What is a buffer overflow? auslew Linux - Security 2 11-08-2002 05:36 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 04:28 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration