mirror of
https://github.com/VoidSec/Exploit-Development
synced 2026-06-08 12:50:18 +00:00
Paolo 'VoidSec' Stagno
105 lines
4.6 KiB
Python
105 lines
4.6 KiB
Python
"""
|
|
Full title: Simple Command Fuzzer
|
|
Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
|
|
Usage: Provide this script with a target IP and port. It will start sending a raw buffer with length 50.
|
|
It will then increment the size at every cicle until the target software will crash.
|
|
"""
|
|
#/usr/bin/env python
|
|
import argparse, random, socket, string, sys
|
|
from termcolor import cprint
|
|
from time import sleep
|
|
|
|
|
|
def str_generator(size=100, chars=string.ascii_uppercase + string.ascii_lowercase + string.digits + string.punctuation):
|
|
"""
|
|
Pseudo-random string generator
|
|
:param size: size of the string to be generated (default = 100)
|
|
:param chars: charset to be used for the string generation (default: ASCII uppercase, lowercase, digits and punctuation)
|
|
:return: generated string
|
|
"""
|
|
return str("".join(random.choice(chars) for _ in range(size)))
|
|
|
|
parser = argparse.ArgumentParser(prog="SCF.py", description="Simple Command Fuzzer")
|
|
parser.add_argument("-t", "--target", dest="target", default=None, required=True, help="Remote target server")
|
|
parser.add_argument("-p", "--port", dest="port", default=None, required=True, type=int, help="Remote target port")
|
|
parser.add_argument("--treshold", dest="treshold", default=9000, type=int, help="Max bufer length. Once hit, it will switch to another command")
|
|
parser.add_argument("--timeout", dest="timeout", default=2, type=int, help="Socket timeout. Used to determine if theremote target has crashed")
|
|
parser.add_argument("--size", dest="size", default=100, type=int, help="buff incrementing size. Every cycle the buff will be incremented of the specified size")
|
|
args = parser.parse_args()
|
|
|
|
# Commands & PoC Config options
|
|
commands = ["STATS", "RTIME", "LTIME", "SRUN", "TRUN", "GMON", "GDOG", "KSTET", "GTER", "HTER", "LTER", "KSTAN"]
|
|
poc_file = open("SCF_PoC.txt", "w")
|
|
#-------------------------------------------
|
|
target = args.target
|
|
port = args.port
|
|
treshold = args.treshold
|
|
timeout = args.timeout
|
|
size = args.size
|
|
vulnerable = []
|
|
treshold_hit = []
|
|
|
|
cprint("Simple Command Fuzzer (SCF) by VoidSec","magenta")
|
|
try:
|
|
for command in commands:
|
|
buff = str_generator()
|
|
user_input = ""
|
|
cprint("\n[>] Testing {} command:".format(command),"blue")
|
|
while (len(buff)<=treshold):
|
|
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
|
|
s.settimeout(timeout)
|
|
try:
|
|
s.connect((target,port))
|
|
s.recv(1024)
|
|
#cprint("Sending {} buff with length: {}".format(command, len(buff)), "blue")
|
|
sys.stdout.write("\r[-] Sending buffer of {} bytes".format(len(buff)))
|
|
sys.stdout.flush()
|
|
s.send(command + " " + buff + "\r\n")
|
|
s.close()
|
|
except socket.timeout: # If we fail to send new command to the server, we'll assume it is crashed
|
|
vulnerable.append((command, len(buff)-size, buff))
|
|
cprint("\n[+] Crash occured with {} command and buffer length of {}".format(command, len(buff)-size), "green")
|
|
while (user_input != "C"):
|
|
cprint("[!] Restart the server, than press [C] to continue:","yellow")
|
|
user_input=raw_input().upper()
|
|
break
|
|
except socket.error as err:
|
|
cprint("\n{}".format(err),"red")
|
|
user_input=""
|
|
while ((user_input != "K") and (user_input != "C") and (user_input != "S")):
|
|
cprint("[!] Restart the server, than press [C] to continue fuzzing this command, [S] to skip this command or [K] to abort:","yellow")
|
|
user_input=raw_input().upper()
|
|
if (user_input.upper() == "K"):
|
|
sys.exit(1)
|
|
elif (user_input.upper() == "C"):
|
|
cprint("{} bytes buffer size was skipped".format(len(buff)-size),"red")
|
|
pass
|
|
elif (user_input.upper() == "S"):
|
|
user_input=""
|
|
cprint("Do you want to save this crash? [Y/N]","yellow")
|
|
user_input=raw_input().upper()
|
|
if(user_input=="Y"):
|
|
vulnerable.append((command, len(buff)-size, buff))
|
|
cprint("[+] Crash occured with {} command and buffer length of {}".format(command, len(buff)-size), "green")
|
|
cprint("{} command was skipped".format(command),"red")
|
|
break
|
|
sleep(1)
|
|
buff = buff + str_generator(size)
|
|
if(len(buff)>treshold):
|
|
treshold_hit.append(command)
|
|
cprint("\nVulnerable Commands:\n----------------------","green")
|
|
poc_file.write("Vulnerable Commands:\n----------------------\n")
|
|
for i in vulnerable:
|
|
cprint("- {} crashed with {} bytes".format(i[0], i[1]),"white")
|
|
cprint("PoC: {}\n".format(i[2]),"grey")
|
|
poc_file.write("- {} crashed with {} bytes\nPoC: {}\n\n".format(i[0], i[1], i[2]))
|
|
|
|
cprint("\nTreshold hit on:\n----------------------","white")
|
|
poc_file.write("\nTreshold hit on:\n----------------------\n")
|
|
for i in treshold_hit:
|
|
cprint("- {}".format(i),"grey")
|
|
poc_file.write("- {}\n".format(i))
|
|
poc_file.close()
|
|
except KeyboardInterrupt:
|
|
cprint("Exiting...","red")
|
|
sys.exit(0) |