[SYSTEM HACKING] Peach Fuzzer를 통해 Application 분석 1 - Install Peach Fuzzer

취약점을 찾기 위해서 Fuzzing 이라는 반복적이고 재미없는 작업을 해야하는데, 이를 도와는 Fuzzer 들로 인해 좀 더 쉽게 취약 포인트를 찾아나갈 수 있습니다.
여러 Fuzzer 중 이번엔는 약간 큰 Peach Fuzzer(Fuzzing Framework)에 대한 이야기를 할까 합니다.

Peach Fuzzer 다운로드(Download Peach Fuzzer) 

http://community.peachfuzzer.com/
 -> 각 OS에 맞는 peachfuzzer 다운로드 페이지 이동

다운로드 후 압축을 해제하면 여러 파일이 나타나고, linux 에서는 peach 파일이 Main 파일이 됩니다.

Peach Fuzzer 실행에 필요한 Package 설치(Install Package for Peach Fuzzer)

다운로드 후 바로 peach 파일 실행 시 mono 명령이 없다고 에러가 발생합니다.
제 pc에서 mono를 사용하지 않았기 때문에 에러가 발생한 것 같습니다. 일단 ./peach 파일의 코드를 확인해보면 아래와 같습니다.

#!/bin/bash

DIRNAME="`dirname ${0}`"
DEBUG=""
case "$*" in
  *--debug*)
    DEBUG="--debug"
    ;;
esac

mono --gc=sgen ${DEBUG} ${DIRNAME}/Peach.exe $@

mono를 통해 exe 를 실행하네요. 일단 mono가 필요하기 때문에 apt-get 을 통해 설치해줍니다.

# apt-get install mono-complete

설치하고 실행 시 정상적으로 작동합니다.

# ./peach 

[[ Peach v3.1.124.0
[[ Copyright (c) Michael Eddington
This is the Peach Runtime.  The Peach Runtime is one of the many ways
to use Peach XML files.  Currently this runtime is still in development
but already exposes several abilities to the end-user such as performing
simple fuzzer runs and performing parsing tests of Peach XML files.

Please submit any bugs to https://forums.peachfuzzer.com.

Syntax:

  peach -a channel
  peach -c peach_xml_file [test_name]
  peach [--skipto #] peach_xml_flie [test_name]
  peach -p 10,2 [--skipto #] peach_xml_file [test_name]
  peach --range 100,200 peach_xml_file [test_name]
  peach -t peach_xml_file

  -1                         Perform a single iteration
  -a,--agent                 Launch Peach Agent
  -c,--count                 Count test cases
  -t,--test xml_file         Validate a Peach XML file
  -p,--parallel M,N          Parallel fuzzing.  Total of M machines, this
                             is machine N.
  --debug                    Enable debug messages. Usefull when debugging
                             your Peach XML file.  Warning: Messages are very
                             cryptic sometimes.
  --trace                    Enable even more verbose debug messages.
  --seed N                   Sets the seed used by the random number generator
  --parseonly                Test parse a Peach XML file
  --makexsd                  Generate peach.xsd
  --showenv                  Print a list of all DataElements, Fixups, Monitors
                             Publishers and their associated parameters.
  --showdevices              Display the list of PCAP devices
  --analyzer                 Launch Peach Analyzer
  --skipto N                 Skip to a specific test #.  This replaced -r
                             for restarting a Peach run.
  --range N,M                Provide a range of test #'s to be run.
  -D/define=KEY=VALUE        Define a substitution value.  In your PIT you can
                             ##KEY## and it will be replaced for VALUE.
  --config=FILENAME          XML file containing defined values


Peach Agent

  Syntax: peach -a channel

  Starts up a Peach Agent instance on this current machine.  User must provide
  a channel/protocol name (e.g. tcp).

  Note: Local agents are started automatically.

Performing Fuzzing Run

  Syntax: peach peach_xml_flie [test_name]
  Syntax: peach --skipto 1234 peach_xml_flie [test_name]
  Syntax: peach --range 100,200 peach_xml_flie [test_name]

  A fuzzing run is started by by specifying the Peach XML file and the
  name of a test to perform.

  If a run is interupted for some reason it can be restarted using the
  --skipto parameter and providing the test # to start at.

  Additionally a range of test cases can be specified using --range.

Performing A Parellel Fuzzing Run

  Syntax: peach -p 10,2 peach_xml_flie [test_name]

  A parallel fuzzing run uses multiple machines to perform the same fuzzing
  which shortens the time required.  To run in parallel mode we will need
  to know the total number of machines and which machine we are.  This
  information is fed into Peach via the "-p" command line argument in the
  format "total_machines,our_machine".

Validate Peach XML File

  Syntax: peach -t peach_xml_file

  This will perform a parsing pass of the Peach XML file and display any
  errors that are found.

Debug Peach XML File

  Syntax: peach -1 --debug peach_xml_file

  This will perform a single iteration (-1) of your pit file while displaying
  alot of debugging information (--debug).  The debugging information was
  origionally intended just for the developers, but can be usefull in pit
  debugging as well.

[SYSTEM HACKING] Peach Fuzzer를 통해 Application 분석 1 - Install Peach Fuzzer
[SYSTEM HACKING] Peach Fuzzer를 통해 Application 분석 2 - Application Fuzzing for Exploit 
[SYSTEM HACKING] Peach Fuzzer의 GUI 모드 - Peach3 Fuzz Bang(Run Peach Fuzzer on GUI Interface) 

Reference

http://community.peachfuzzer.com

---

HAHWUL Security engineer, Gopher and H4cker!