在渗透测试中使用fuzz技术(附windows安装指南)

#!/usr/bin/env python
# Fuzzing the initial 4-byte packet from client to CheckPoint V** server.
import time
import sys
from sulley import *
# Time to wait between mutations
SLEEP_TIME=0.5
# Time to wait before claiming a host is unresponsive
TIMEOUT=3
# number of crashes to observe before skipping the remainder of a group
CRASH_THRESHOLD=3
# Initialize the Sulley mutation descriptor
s_initialize("SecuRemote-Initial-Packet")
s_byte("\x51",full_range=True)
s_static("\x00\x00\x00")
print "Total mutations: " + str(s_num_mutations()) + "\n"
print "Minimum time for execution: " + str(round(((s_num_mutations() * (SLEEP_TIME))/3600),2)) + " hours."
print "Press CTRL/C to cancel in ",
for i in range(5):
print str(5 - i) + " ",
sys.stdout.flush()
time.sleep(1)
# For debugging purposes, uncomment these lines to see Sulley's mutations
# in hex dump format
#print "Hex dump mutation output:"
#while s_mutate():
# print s_hex_dump(s_render())
sess = sessions.session(session_filename="SecuRemote-Initial-Packet.sess", sleep_time=SLEEP_TIME, timeout=TIMEOUT, crash_threshold=CRASH_THRESHOLD)
# Tie this session to the SecuRemote-Simple-String fuzzing cases
sess.connect(s_get("SecuRemote-Initial-Packet"))
# Change this IP address to the target system
target = sessions.target("127.0.0.1", 264)
# Add the target to the session (can be repeated for multiple targets)
sess.add_target(target)
# Kick off the fuzzer, monitoring with WebUI on localhost:26000
sess.fuzz()

#!/usr/bin/env python
from sulley import *
SLEEP_TIME=0.5TIMEOUT=3CRASH_THRESHOLD=3# The function Sulley will run prior to sending each mutation.  We leverage
# it to setup the target system with the initial packets and response in the
# protocol exchange prior to our target packet.
def preconn(sock):
    sock.send("\x51\x00\x00\x00")    time.sleep(0.5)
    sock.send("\x00\x00\x00\x21")


    # Set a socket timeout on the recv so we aren't waiting indefinitely if
    # the server crashed from a previous test case.
    sock.settimeout(5)    response = sock.recv(4)
    print "Setup response: ",    for i in response:
        print "%02x" % ord(i),
    print


s_initialize("SecuRemote-Simple-String")


# Create a size field, which is based on the content of the named block
# Sulley uses ">" to indicate big-endian values, "<" is little-endian
s_size("client-name-string", length=4, endian=">")


# This is the block of data used for filling in the s_sizeif s_block_start("client-name-string"):
    # "securemote" is the default string
    s_string("securemote")
    # constant null terminator
    s_byte("\x00")
s_block_end()


sess = sessions.session(session_filename="Securemote-Simple-string.sess", sleep_time=SLEEP_TIME, timeout=TIMEOUT, crash_threshold=CRASH_THRESHOLD)


# Call preconn() before each mutation is sent to setup the target
sess.pre_send = preconn


sess.connect(s_get("SecuRemote-Simple-String"))
target = sessions.target("127.0.0.1", 264)
sess.add_target(target)
sess.fuzz()

git clone https://Fitblip@github.com/Fitblip/pydbg.git

C:\sulley_build>git clone https://Fitblip@github.com/Fitblip/pydbg.git
Cloning into 'pydbg'...
remote: Counting objects: 17, done.
remote: Compressing objects: 100% (12/12), done.
remote: Total 17 (delta 4), reused 17 (delta 4)
Unpacking objects: 100% (17/17), done.


C:\sulley_build\pydbg>python setup.py install
running install
running build
running build_py
creating build
creating build\lib
creating build\lib\pydbg
...snip...
running install_egg_info
Removing C:\python27\Lib\site-packages\pydbg-0.0.0-py2.7.egg-info
Writing C:\python27\Lib\site-packages\pydbg-0.0.0-py2.7.egg-info

C:\sulley_build\libdisasm\pydasm>python setup.py build_ext -c mingw32
running build_ext
building 'pydasm' extension
...snip...
C:\sulley_build\libdisasm\pydasm>python setup.py install
running install
running build
running build_ext
running install_lib
copying build\lib.win32-2.7\pydasm.pyd -> C:\python27\Lib\site-packages
running install_egg_info
Writing C:\python27\Lib\site-packages\pydasm-1.5-py2.7.egg-info

C:\sulley_build>git clone https://github.com/OpenRCE/sulley.git
Cloning into 'sulley'...
remote: Counting objects: 148, done.
remote: Compressing objects: 100% (91/91), done.
remote: Total 148 (delta 53), reused 146 (delta 51)
Receiving objects: 100% (148/148), 267.03 KiB, done.
Resolving deltas: 100% (53/53), done.

 C:\sulley_build\sulley>python process_monitor.py
 ERR> USAGE: process_monitor.py
     <-c|--crash_bin FILENAME> filename to serialize crash bin class to
     [-p|--proc_name NAME]     process name to search for and attach to
     [-i|--ignore_pid PID]     ignore this PID when searching for the target process
     [-l|--log_level LEVEL]    log level (default 1), increase for more verbosity
     [--port PORT]             TCP port to bind this agent to

C:\sulley_build\pcapy-0.10.5>python setup.py build_ext -c mingw32 -I "C:\sulley_build\WpdPack\Include" -L "C:\sulley_build\WpdPack\Lib"
running build_ext
building 'pcapy' extension
creating build
creating build\temp.win32-2.7
creating build\temp.win32-2.7\Release
creating build\temp.win32-2.7\Release\win32
...snip...
C:\sulley_build\pcapy-0.10.5>python setup.py install
running install
running build
running build_ext
running install_lib
copying build\lib.win32-2.7\pcapy.pyd -> C:\python27\Lib\site-packages
running install_data
creating C:\python27\share
creating C:\python27\share\doc
creating C:\python27\share\doc\pcapy
copying README -> C:\python27\share\doc\pcapy
copying LICENSE -> C:\python27\share\doc\pcapy
copying pcapy.html -> C:\python27\share\doc\pcapy
running install_egg_info
Writing C:\python27\Lib\site-packages\pcapy-0.10.5-py2.7.egg-info

C:\sulley_build\Impacket-0.9.6.0>python setup.py install
running install
running build
running build_py
creating build
creating build\lib
creating build\lib\impacket
copying impacket\ImpactDecoder.py -> build\lib\impacket
copying impacket\ImpactPacket.py -> build\lib\impacket
copying impacket\nmb.py -> build\lib\impacket
copying impacket\ntlm.py -> build\lib\impacket
copying impacket\smb.py -> build\lib\impacket
copying impacket\structure.py -> build\lib\impacket
copying impacket\uuid.py -> build\lib\impacket
copying impacket\__init__.py -> build\lib\impacket
creating build\lib\impacket\dcerpc
...snip...

C:\sulley_build\sulley>python network_monitor.py
ERR> USAGE: network_monitor.py
    <-d|--device DEVICE #>    device to sniff on (see list below)
    [-f|--filter PCAP FILTER] BPF filter string
    [-P|--log_path PATH]      log directory to store pcaps to
    [-l|--log_level LEVEL]    log level (default 1), increase for more verbosity

    [--port PORT]             TCP port to bind this agent to

Network Device List:
    [0] \Device\NPF_GenericDialupAdapter
    [1] {CF0B388B-8DF5-4BC4-8ECF-404F2A1B489C}  10.0.2.64

if self.ssl:

try:
ssl = socket.ssl(sock)
sock = httplib.FakeSocket(sock, ssl)
except Exception, e:
...

if self.ssl:
try:
import ssl
sock = ssl.wrap_socket(sock)

except Exception, e: