search

mxmssh / manul

Manul is a coverage-guided parallel fuzzer for open-source and blackbox binaries on Windows, Linux and MacOS
Apache License 2.0
337 stars 66 forks source link

Stding fuzzing #40

Closed Techno-Fox closed 4 years ago

Techno-Fox commented 5 years ago

Hello. I like the idea of your manul fuzzier. However I notice a lack of stdin fuzzing. As the program keeps saying how i forgot the @@ for the string. This means that I can't fuzz my stdin because the program takes no arguments. This actually leads to an error (put in another topic).

P.S. Thank you for taking the time to read and hopefully fix this issue.

mxmssh commented 5 years ago

Hi, thanks for you interest in Manul. There is experimental support for stdin fuzzing. check it out here: https://github.com/mxmssh/manul/blob/8dd10a1ee33e78c73a5ea082045a6e72bb99297e/manul.config#L86

Techno-Fox commented 5 years ago

Hey is that for stdin or passing commands ?

In other news I tried that but it still wants the @@ and I get an error.

This error only occures when I uncomment cmd_fuzzing = True

Traceback (most recent call last): File "/usr/lib/python3.7/multiprocessing/process.py", line 297, in _bootstrap self.run() File "/usr/lib/python3.7/multiprocessing/process.py", line 99, in run self._target(*self._args, **self._kwargs) File "./manul.py", line 993, in run_fuzzer_instance fuzzer_instance.run() # never return File "./manul.py", line 851, in run self.dry_run() File "./manul.py", line 594, in dry_run cmd = self.prepare_cmd_to_run(full_input_file_path, False) File "./manul.py", line 482, in prepare_cmd_to_run final_string = final_string.replace("@@", target_file_path) TypeError: replace() argument 2 must be str, not bytearray

The file I'm trying to fuzz is just a little test code to check the fuzzer.

Techno-Fox commented 5 years ago

Test code as in a simple buffer overflow to test the stdin

mxmssh commented 5 years ago

Well, that's a bug if it doesn't work :)

Techno-Fox commented 5 years ago

That's why I'm reporting it. I uncommented cmd_fuzzing and this happens. I actually might not be able to do a PR in this case, because I don't know the issue. You could try a str(target_file_path), but what do I know. You programmed this, you're obviously more quilified than me.

Techno-Fox commented 5 years ago

Am supposed to uncomment it are leave it commented?

Techno-Fox commented 4 years ago

Do you need help fixing the bug? Can't say I can help much. I know python, but I don't know how you programmed this. I would have to study your codying style. Not to mention study how manul identifies input as a "crash".

huornlmj commented 4 years ago

I'm also keen on using Manul if it can provide stdin like afl does with an afl-like "--" option. In my scenario I have a simple that when run, prompts for a user name and password but that has a deliberate buffer overflow issue. afl finds it when executed like this: afl-fuzz -i in/ -o out/ <binary>

I tried the Manul command line option as the closest fit (i.e. not actually stdin) and got the same crash as @KittyTechnoProgrammer . Python 3.6 on Ubuntu 18.04 LTS using a clean purpose made virtual environment for Manul testing.