Fuzzing: Setting up the Target

In order to get useful results while from fuzzing our target application, we need to first set up the target machine to include a debugger and an agent to log crashes and restart the target application after a crash. For this we’ll be using the following applications:

• WinDbg
• !exploitable (WinDbg plugin)
• Peach Fuzzer

Installation

WinDbg

WinDbg is a debugging platform provided by Microsoft for debugging both user level programs and kernel level code. Attaching WinDbg to our target application will enable us to retrieve detailed information about it post-mortem.

WinDbg is freely available from Microsoft as a part of their SDK that is posted here. You don’t have to install the SDK itself or a number of the other tools that are packaged along with it.

!exploitable

!exploitable is a WinDbg plugin used to create automated crash reports and risk assessments. It can classify the likeliness of a crash being the result of an exploitable vulnerability. We will log the output from !exploitable and WinDbg.

!exploitable is freely available here. You can unzip the directory and copy the contents of msecextensions/<x86 or x64>/Release to C:/Program Files (x86)\Windows Kits\8.0\Debuggers\<x86 or x64>\.

Peach

Peach is not only our fuzzing platform but we will also use it’s agent on the target machine to facilitate restarting the target application and logging the information from WinDbg and !exploitable.

1. Install the Microsoft .NET V4 Framework.
2. If you didn’t install WinDbg before… do it
3. Download the binary release of Peach and unzip to a working directory

By running Peach on the target machine with a copy of the Peach pit file we are using for fuzzing, Peach will automatically restart the target application and store crash information from WinDbg when it finds a value that crashes the software.

Fuzzing: Use all the fuzzers!

My first project with SPQR is a vulnerability assessment of an anesthesia machine. Unfortunately we do not have 24/7 access to the machine and we are still trying to schedule our first meeting. In order to get the most out of the time we do have with it I’ve been working on compiling a list of tools, their uses, and tutorials I’ve been going through to get up to speed on them.

Right now this is taking the format of a dump of urls I’ve found useful, hopefully over the next few days I’ll be adding posts specific to tools describing their use.

Fuzzing Frameworks

Peach – Fuzzing framework that uses xml “peach-pits” to “intelligently” fuzz an application. Requires prior knowledge of a protocol in order to generate and mutate fuzzing inputs. Peach is one of the few free fuzzers that is still in active development. Most of the other fuzzers have fallen by the way side over the past few years. Another benefit of Peach is that it allows for running the tests automatically (rather than causing a crash and requiring human interaction to relaunch) as well as automatic logging of debug information.
http://peachfuzzer.com/
Example file format fuzzing:
http://www.flinkd.org/2011/07/fuzzing-with-peach-part-1/
Network fuzzing (more interesting):
http://peachfuzzer.com/v2/TutorialNetworkServer.html

SPIKE – A fuzz scripting framework. More hands on than peach, scripting out each event and using the SPIKE API to define the packet structure. Downside is it lacks a way to restart crashed applications, requiring a manual restart instead. It has also been out of development for a while, it seems to have been “replaced” by Sulley.
http://resources.infosecinstitute.com/fuzzer-automation-with-spike/

Sulley – Aimed to be more powerful than SPIKE while retaining ease of use. No longer in development. Need to investigate further…
http://resources.infosecinstitute.com/sulley-fuzzing/

Web App Specific Fuzzers

Burp – Web proxy scanner/fuzzer. Fancy user interface that couples with a proxy server to inspect packets being sent/received and identify potential vulnerabilities. Requires human intuition to find potentially exploitable fields but given the fields it will automate the fuzzing. (XSS, SQL inject, brute force login)
http://portswigger.net/burp/
http://resources.infosecinstitute.com/burpsuite-tutorial/

For a more detailed comparison of fuzzing tools:
http://www.blackhat.com/presentations/bh-usa-09/EDDINGTON/BHUSA09-Eddington-DemystFuzzers-PAPER.pdf

These are only a few of the fuzzing tools out there, for more tools use your google-fu to find stuff like this:
http://www.infosecinstitute.com/blog/2005/12/fuzzers-ultimate-list.html