Module: Msf::Auxiliary::Fuzzer

Defined in:
lib/msf/core/auxiliary/fuzzer.rb

Overview

This module provides methods useful for developing fuzzers

Instance Method Summary collapse

Instance Method Details

#fuzz_numbersObject

Self-reflective iterators


26
27
28
29
30
31
32
33
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 26

def fuzz_numbers
  res = []
  self.methods.sort.grep(/^fuzzer_number/).each do |m|
    @last_fuzzer_input = m
    block_given? ? self.send(m) {|x| yield(x) } : (res << self.send(m))
  end
  res
end

#fuzz_string_corrupt_byte(str, max = nil) ⇒ Object

Modify each byte of the string moving forward


49
50
51
52
53
54
55
56
57
58
59
60
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 49

def fuzz_string_corrupt_byte(str,max=nil)
  res = []
  0.upto(max ? [max,str.length-1].min : (str.length - 1)) do |offset|
    0.upto(255) do |val|
      @last_fuzzer_input = "fuzz_string_corrupt_byte offset:#{offset}/#{str.length} byte:#{val}"
      buf = str.dup
      buf[offset,1] = [val].pack('C')
      block_given? ? yield(buf) : (res << buf)
    end
  end
  res
end

#fuzz_string_corrupt_byte_reverse(str, max = nil) ⇒ Object

Modify each byte of the string moving backward


63
64
65
66
67
68
69
70
71
72
73
74
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 63

def fuzz_string_corrupt_byte_reverse(str,max=nil)
  res = []
  (max ? [max,str.length-1].min : (str.length - 1)).downto(0) do |offset|
    0.upto(255) do |val|
      @last_fuzzer_input = "fuzz_string_corrupt_byte_reverse offset:#{offset}/#{str.length} byte:#{val}"
      buf = str.dup
      buf[offset,1] = [val].pack('C')
      block_given? ? yield(buf) : (res << buf)
    end
  end
  res
end

#fuzz_stringsObject


35
36
37
38
39
40
41
42
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 35

def fuzz_strings
  res = []
  self.methods.sort.grep(/^fuzzer_string/).each do |m|
    @last_fuzzer_input = m
    block_given? ? self.send(m) {|x| yield(x) } : (res << self.send(m))
  end
  res
end

#fuzzer_gen_string(len) ⇒ Object


122
123
124
125
126
127
128
129
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 122

def fuzzer_gen_string(len)
  @gen_string_block ||= datastore['FuzzChar'][0,1] * (1024 * 512)
  res = ''
  while (res.length < len)
    res += @gen_string_block
  end
  res[0,len]
end

#fuzzer_number_power2Object


90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 90

def fuzzer_number_power2
  res = [
    0x100000000,
    0x80000000,
    0x40000000,
    0x20000000,
    0x10000000,
    0x01000000,
    0x00100000,
    0x00010000,
    0x00001000,
    0x00000100,
    0x00000010,
    0x00000001
  ]
  block_given? ? res.each { |n| yield(n) } : res
end

#fuzzer_number_power2_plusObject


108
109
110
111
112
113
114
115
116
117
118
119
120
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 108

def fuzzer_number_power2_plus
  res = []
  fuzzer_number_power2 do |num|
    res << num + 1
    res << num + 2
    res << num - 1
    res << num - 2
    res << num * -1
    res << (num  + 1) * -1
    res << (num  + 2) * -1
  end
  block_given? ? res.each { |n| yield(n) } : res
end

#fuzzer_string_filepath_dosObject


85
86
87
88
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 85

def fuzzer_string_filepath_dos
  res = %W{ aux con nul com1 com2 com3 com4 lpt1 lpt2 lp3 lpt4 prn }
  block_given? ? res.each { |n| yield(n) } : res
end

#fuzzer_string_formatObject

Useful generators (many derived from AxMan)


80
81
82
83
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 80

def fuzzer_string_format
  res = %W{ %s %p %n %x %@ %.257d %.65537d %.2147483648d %.257f %.65537f %.2147483648f}
  block_given? ? res.each { |n| yield(n) } : res
end

#fuzzer_string_giantObject


150
151
152
153
154
155
156
157
158
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 150

def fuzzer_string_giant
  res = []
  512.step(65532 * 2, 512) do |len|
    buf = fuzzer_gen_string(len)
    buf[len / 2, datastore['FuzzTracer'].length] = datastore['FuzzTracer']
    block_given? ? yield(buf) : (res << buf)
  end
  res
end

#fuzzer_string_longObject


140
141
142
143
144
145
146
147
148
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 140

def fuzzer_string_long
  res = []
  64.step(8192,64) do |len|
    buf = fuzzer_gen_string(len)
    buf[len / 2, datastore['FuzzTracer'].length] = datastore['FuzzTracer']
    block_given? ? yield(buf) : (res << buf)
  end
  res
end

#fuzzer_string_path_prefixesObject


182
183
184
185
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 182

def fuzzer_string_path_prefixes
  res = %W{ C:\\ \\\\localhost\\ / }
  block_given? ? res.each { |n| yield(n) } : res
end

#fuzzer_string_paths_dosObject


296
297
298
299
300
301
302
303
304
305
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 296

def fuzzer_string_paths_dos
  res = []
  fuzzer_string_path_prefixes do |pre|
    fuzzer_string_filepath_dos do |str|
      buf = pre + str
      block_given? ? yield(buf) : (res << buf)
    end
  end
  res
end

#fuzzer_string_paths_formatObject


285
286
287
288
289
290
291
292
293
294
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 285

def fuzzer_string_paths_format
  res = []
  fuzzer_string_path_prefixes do |pre|
    fuzzer_string_format do |str|
      buf = pre + str
      block_given? ? yield(buf) : (res << buf)
    end
  end
  res
end

#fuzzer_string_paths_giantObject


274
275
276
277
278
279
280
281
282
283
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 274

def fuzzer_string_paths_giant
  res = []
  fuzzer_string_path_prefixes do |pre|
    fuzzer_string_giant do |str|
      buf = pre + str
      block_given? ? yield(buf) : (res << buf)
    end
  end
  res
end

#fuzzer_string_paths_longObject


263
264
265
266
267
268
269
270
271
272
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 263

def fuzzer_string_paths_long
  res = []
  fuzzer_string_path_prefixes do |pre|
    fuzzer_string_long do |str|
      buf = pre + str
      block_given? ? yield(buf) : (res << buf)
    end
  end
  res
end

#fuzzer_string_paths_smallObject


252
253
254
255
256
257
258
259
260
261
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 252

def fuzzer_string_paths_small
  res = []
  fuzzer_string_path_prefixes do |pre|
    fuzzer_string_small do |str|
      buf = pre + str
      block_given? ? yield(buf) : (res << buf)
    end
  end
  res
end

#fuzzer_string_smallObject


131
132
133
134
135
136
137
138
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 131

def fuzzer_string_small
  res = []
  16.step(512,16) do |len|
    buf = fuzzer_gen_string(len)
    block_given? ? yield(buf) : (res << buf)
  end
  res
end

#fuzzer_string_uri_dividersObject


177
178
179
180
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 177

def fuzzer_string_uri_dividers
  res = %W{ : :// }
  block_given? ? res.each { |n| yield(n) } : res
end

#fuzzer_string_uri_typesObject


160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 160

def fuzzer_string_uri_types
  res = %W{
    aaa  aaas  about  acap  adiumxtra  afp  aim  apt  aw  bolo  callto  cap  chrome  cid
    content  crid  cvs  data  dav  designates  dict  disk  dns  doi  ed2k  example  examples
    fax  feed  file  finger  fish  ftp  gg  gizmoproject  go  gopher  h323  hcp  http  https
    iax2  icap  im  imap  info  ipp  irc  ircs  iris  iris.beep  iris.lws  iris.xpc  iris.xpcs
    itms  jar  javascript  keyparc  lastfm  ldap  ldaps  lsid  magnet  mailto  mid  mms  modem
    ms-help  msnim  msrp  msrps  mtqp  mupdate  mvn  news  nfs  nntp  notes  opaquelocktoken
    over  pop  pres  prospero  psyc  res  rlogin  rmi  rsync  rtsp  secondlife  service  sftp
    sgn  shell  shttp  sip  sips  skype  smb  sms  snews  snmp  soap.beep  soap.beeps  soldat
    ssh  steam  svn  tag  teamspeak  tel  telephone  telnet  tftp  thismessage  tip  tv  unreal
    urn  ut2004  vbscript  vemmi  ventrilo  view-source  wais  webcal  worldwind  wtai  wyciwyg
    wysiwyg  xfire  xmlrpc.beep  xmpp  xri  ymsgr  z39.50r  z39.50s
  }
  block_given? ? res.each { |n| yield(n) } : res
end

#fuzzer_string_uris_dosObject


239
240
241
242
243
244
245
246
247
248
249
250
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 239

def fuzzer_string_uris_dos
  res = []
  fuzzer_string_uri_types do |proto|
    fuzzer_string_uri_dividers do |div|
      fuzzer_string_filepath_dos do |str|
        buf = proto + div + str
        block_given? ? yield(buf) : (res << buf)
      end
    end
  end
  res
end

#fuzzer_string_uris_formatObject


226
227
228
229
230
231
232
233
234
235
236
237
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 226

def fuzzer_string_uris_format
  res = []
  fuzzer_string_uri_types do |proto|
    fuzzer_string_uri_dividers do |div|
      fuzzer_string_format do |str|
        buf = proto + div + str
        block_given? ? yield(buf) : (res << buf)
      end
    end
  end
  res
end

#fuzzer_string_uris_giantObject


213
214
215
216
217
218
219
220
221
222
223
224
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 213

def fuzzer_string_uris_giant
  res = []
  fuzzer_string_uri_types do |proto|
    fuzzer_string_uri_dividers do |div|
      fuzzer_string_giant do |str|
        buf = proto + div + str
        block_given? ? yield(buf) : (res << buf)
      end
    end
  end
  res
end

#fuzzer_string_uris_longObject


200
201
202
203
204
205
206
207
208
209
210
211
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 200

def fuzzer_string_uris_long
  res = []
  fuzzer_string_uri_types do |proto|
    fuzzer_string_uri_dividers do |div|
      fuzzer_string_long do |str|
        buf = proto + div + str
        block_given? ? yield(buf) : (res << buf)
      end
    end
  end
  res
end

#fuzzer_string_uris_smallObject


187
188
189
190
191
192
193
194
195
196
197
198
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 187

def fuzzer_string_uris_small
  res = []
  fuzzer_string_uri_types do |proto|
    fuzzer_string_uri_dividers do |div|
      fuzzer_string_small do |str|
        buf = proto + div + str
        block_given? ? yield(buf) : (res << buf)
      end
    end
  end
  res
end

#initialize(info = {}) ⇒ Object

Creates an instance of a fuzzer module


14
15
16
17
18
19
20
# File 'lib/msf/core/auxiliary/fuzzer.rb', line 14

def initialize(info = {})
  super
  register_advanced_options([
    OptString.new('FuzzTracer',   [ true, 'Sets the magic string to embed into fuzzer string inputs', 'MSFROCKS']),
    OptString.new('FuzzChar',     [ true, 'Sets the character to use for generating long strings', 'X'])
  ], Msf::Auxiliary::Fuzzer)
end