本文主要是介绍alf-fuzz初试(一)，希望对大家解决编程问题提供一定的参考价值，需要的开发者们随着小编来一起学习吧！
0x00 搭建测试环境
1.docker
2.docker镜像
使用作者已经帮我们搭建好了测试的docker环境
step1：拉取docker镜像
➜ Desktop docker pull mykter/afl-trainingUsing default tag: latestlatest: Pulling from mykter/afl-training.....Status: Downloaded newer image for mykter/afl-training:latest
step2：启动镜像
➜ binder docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
mykter/afl-training latest 1c50ec5b1735 2 weeks ago 1.38GB➜ binder docker run --privileged -p 22000:22 -e PASSMETHOD=env -e PASS=yourpassword mykter/afl-training
Password set from environment variable
Spawning SSHd
step3：ssh连接镜像
➜ Desktop ssh fuzzer@localhost -p 22000
0x01 quickstart
配好llvm的环境
先cd到afl-2.52b来bulid alf
make
make -C llvm_mode
sudo make install
alf编译含有漏洞的文件：
$ cd quickstart
$ CC=afl-clang-fast AFL_HARDEN=1 make
查看程序的基本逻辑:
fuzzer@f48686888e7a:~/workshop/quickstart$ ./vulnerableUsage: ./vulnerable
Text utility - accepts commands and data on stdin and prints results to stdout.Input | Output------------------+-----------------------u <N> <string> | Uppercased version of the first <N> bytes of <string>.head <N> <string> | The first <N> bytes of <string>.
fuzzer@f48686888e7a:~/workshop/quickstart$ ./vulnerable < inputs/u
CAPSme
fuzzer@f48686888e7a:~/workshop/quickstart$ cat inputs/u
u 4 capsme
0x02 开始运行fuzz
quickstart里含有一个demo，里面包含三种漏洞。
fuzzer@f48686888e7a:~/workshop/quickstart$ afl-fuzz -i inputs -o out ./vulnerable
去crash目录查看崩溃的文件：
第一种崩溃为
head 111111111hee：
fuzzer@55a3030afc22:~/workshop/quickstart$ cat /home/fuzzer/workshop/quickstart/out/crashes/id:000001,sig:11,src:000009,op:ext_AO,pos:0
head 111111111hee
使用gdb调试，且通过display来查看一些变量的值：
(gdb) r (gdb) r </home/fuzzer/workshop/quickstart/out/crashes/id:000001,sig:11,src:000009,op:ext_AO,pos:0
Starting program: /home/fuzzer/workshop/quickstart/vulnerable </home/fuzzer/workshop/quickstart/out/crashes/id:000001,sig:11,src:000009,op:ext_AO,pos:0Breakpoint 1, process (input=0x7fffffffe3e0 "head 111111111hee\n") at vulnerable.c:13
13 if (strncmp(input, "u ", 2) == 0)
(gdb) n
38 else if (strncmp(input, "head ", 5) == 0)
(gdb)
40 if (strlen(input) > 6)
(gdb)
42 len = strtol(input + 4, &rest, 10);
(gdb) display rest
1: rest = 0x603120 <__afl_area_initial> ""
(gdb) display len
2: len = 0
(gdb) n
43 rest += 1; // skip the first char (should be a space)
1: rest = 0x7fffffffe3ee "hee\n"
2: len = 111111111
(gdb) n
44 rest[len] = '\0'; // truncate string at specified offset
1: rest = 0x7fffffffe3ef "ee\n"
2: len = 111111111
(gdb) nProgram received signal SIGSEGV, Segmentation fault.
0x000000000040115c in process (input=0x7fffffffe3e0 "head 111111111hee\n") at vulnerable.c:44
44 rest[len] = '\0'; // truncate string at specified offset
1: rest = 0x7fffffffe3ef "ee\n"
2: len = 111111111
最后的崩溃点在rest[len] = ‘\0’;：
(gdb)n
44 rest[len] = '\0'; // truncate string at specified offset
1: rest = 0x7fffffffe3ef "ee\n"
2: len = 111111111
(gdb) nProgram received signal SIGSEGV, Segmentation fault.
报错为SIGSEGV，因为rest[len]为rest[111111111]=’\0’; 修改了我们没有权限访问的地址。
如果改成head 1hee\n呢？
其中hee\n为rest的值
而加入\n表示rest的结尾。如果len大于rest的长度 就会出现崩溃。
崩溃id:000002,sig:06,src:000009+000001,op:splice,rep:16也符合该规律：
fuzzer@55a3030afc22:~/workshop/quickstart$ cat /home/fuzzer/workshop/quickstart/out/crashes/id:000002,sig:06,src:000009+000001,op:splice,rep:16
head 99
u -111
第二种崩溃分析：
cat /home/fuzzer/workshop/quickstart/out/crashes/id:000000,sig:11,src:000008,op:arith8,pos:6,val:+13
u -11\n
rest访问没有权限访问的地址：
0x7ffffffff000-0x7fffffffe3ea=3094
Program received signal SIGSEGV, Segmentation fault.
0x0000000000400f9d in process (input=0x7fffffffe3e0 "u -11\\n\n") at vulnerable.c:31
31 out[i] = rest[i] - 32; // only handles ASCII
1: input = 0x7fffffffe3e0 "u -11\\n\n"
2: rest = 0x7fffffffe3ea "n\n"
3: len = -11
4: out = 0x614260 "N\352", '\340' <repeats 93 times>, "k\017@淀\032", '\340' <repeats 16 times>, "\260\371 \340\340\340\340\340w;\200\327\337_\340\340\341\340\340\340\340\340\340\340(\305\337\337\337_\340\340\340`\340\340\341\340\340\340p\363 ", '\340' <repeats 13 times>, "\277\375\064\220\237\031\070h\360\354 \340\340\340\340\340 \305\337\337\337_\340\340\340", <incomplete sequence \340>...
5: i = 3094
6: rest[i] = <error: Cannot access memory at address 0x7ffffffff000>
7: out[i] = 0 '\000'
(gdb)
第三种崩溃如下：
fuzzer@55a3030afc22:~/workshop/quickstart$ ./vulnerable
surprise!
Segmentation fault
0x03 开始挑战
3.1 开始挑战一些真实的漏洞fuzz：
fuzzer@55a3030afc22:~/workshop/challenges/cyber-grand-challenge/CROMU_00007
编译：
CC=afl-clang-fast AFL_HARDEN=1 make
afl-fuzz -i input -o output ./CROMU_00007
3.2 fuzz jasper
jasper是一个开放源代码的主动提供的JPEG-2000编解码器的免费软件
前期准备：
git clone https://github.com/mdadams/jasper.git
sudo apt-get -y install cmake #安装依赖的cmake
执行编译命令：
mkdir BUILD &&
cd BUILD &&
//设定编译器，注意在编译前需要把编译器设定为AFL的的编译器
export CC=afl-clang
export CXX=afl-clang++
cmake -DCMAKE_INSTALL_PREFIX=/usr \-DCMAKE_BUILD_TYPE=Release \-DCMAKE_SKIP_INSTALL_RPATH=YES \-DJAS_ENABLE_DOC=NO \-DCMAKE_INSTALL_DOCDIR=/usr/share/doc/jasper-2.0.14 \.. &&
make
cd BUILD && make install
开始fuzz：
mkdir inFuzz output
afl-fuzz -i inFuzz -o outFuzz jasper --input @@ --output test.bmp --output-format bmp
跑出crash后，使用valgrind结合源码分析是否是漏洞
valgrind -v --tool=memcheck --leak-check=full jasper --input id:000035,sig:06,src:002011,op:havoc,rep:2
–output test.bmp --output-format bmp
AFL训练1~8：https://blog.csdn.net/qq_36711003/category_10146244.html
3.x测试fuzz kernrl
https://blog.cloudflare.com/a-gentle-introduction-to-linux-kernel-fuzzing/
https://github.com/cloudflare/cloudflare-blog/tree/master/2019-07-kernel-fuzzing
参考：
如何Fuzz ELF文件中的任意函数libfuzz
https://stfpeak.github.io/2017/06/12/AFL-Cautions/
https://paper.seebug.org/842/ AFL 漏洞挖掘技术漫谈（二）：Fuzz 结果分析和代码覆盖率
https://github.com/Battelle/afl-unicorn afl-unicorn lets you fuzz any piece of binary that can be emulated by Unicorn Engine.
• [Fuzzing] Fuzzing DNS zone parsers - Cambus.net:
https://www.cambus.net/fuzzing-dns-zone-parsers/
・ 利用 AFL Fuzz statzone DNS Zone Parsers – Jett
https://github.com/rk700/uniFuzzer
A fuzzing tool for closed-source binaries based on Unicorn and LibFuzzer
这篇关于alf-fuzz初试(一)的文章就介绍到这儿，希望我们推荐的文章对编程师们有所帮助！
