Vulnserver exploit

The following repo contains some exploit scripts for the vulnserver application.

1. Atheris fuzzing (dumb fuzzer)

First attempt I used Atheris. See the atheris folder for the script and some crashes verified found by the fuzzer.

Requirements

• Install Atheris: pip install atheris==2.0.7

Notes

• I used atheris in the past, that's why I chose it.
• Atheris is a bit pointless here, since there is no instrumentation to guide the fuzzer. It's just a dumb fuzzer.
• It feels a bit time-consuming to setup the connection each time and send the payload.
• Ideally fuzzing with instrumentation would be better?

2. Boofuzz fuzzing (dumb fuzzer)

Mostly derived from the h0mbre's blog post.

Contains the boofuzz script to identify the memory access violation using the TRUN command. The folder contains multiple scripts / steps to come up with a final poc:

1. main.py: The main script to fuzz the target and identify the crash.
2. exploit.py: The script that trigger the crash using the string derived from the fuzzing.
3. identify_EIP.py: The script to identify the EIP offset it pass a unique string so we can get the offset of the EIP.
4. verify_EIP_overflow.py: The script to verify the EIP overflow using the sequence of repeated chars for identify all the offset.
5. identify_bad_chars.py: The script to identify the badchars so that we can exclude them from the payload.
6. poc.py: The proof of concept to exploit the target by running a notepad session on the local machine each time.

Requirements

• Install Boofuzz: pip install boofuzz.

Notes

• I didn't know Boofuzz before, I read about that in the h0mbre's blog post.
• Similar approach to the one above. Just setup a connection and send the payload.

3. libFuzzer fuzzing (smart fuzzer)

Requirements

• Compile using: clang++ -fsanitize=address,fuzzer -o vulnserver_fuzzer fuzzing_vulnserver.cpp
• Run using: vulnserver_fuzzer -fork=5 -ignore_crashes=1

Notes

• Testing only Function1, Function2 and Function3.
• Since we instrument the target then we can have a reliable coverage metric.

References

• Atheris fuzzer
• h0mbre - Boofuzz to EIP Overwrite
• captmeelo