pwn.college Fuzz Dojo 实战（一）：Introduction to Fuzzing 挑战 1-4

1
hacker@training~locate-harnesses:/challenge$ ./training
2
###
3
### Locate Harnesses - minizip
4
###
5

6
Fuzzing is a software testing method designed to detect bugs. Streams of
7
random input are sent to an application to cause crashes, resource links, or
8
simply unexpected behavior. The key implementation to reach sections of code
9
with this random input is the fuzz driver. A fuzz driver, alternately called
10
a fuzzer, fuzzing harness, or test driver is simply a test case generator
11
that directs input from the fuzzer into the target program in a targeted
12
way. Small projects may only require a single fuzz driver, but for large
13
codebases, there could be hundreds of locations in the code that could
14
benefit from testing harnesses.
15

16
Writing efficient fuzz drivers is a time-consuming task that requires deep
17
knowledge of the target codebase, in particular the interface of the target
18
program, how the program functions, and what type of crashes are useful to
19
generate. The effectiveness of fuzz drivers is usually measured in code
20
coverage achieved, but there are alternative methods such as the code
21
complexity of the tested code, and the number of bugs discovered. These
22
training exercises will show you how existing OSS-FUZZ fuzz drivers work,
23
teach you techniques to improve existing drivers and how to write new ones
24
to best augment the drivers already running for a project.
25

26
Every challenge is associated with exactly one open source project.
27

28
Commands:
29
_________________________
30
/challenge/build - compiles this project and places fuzz drivers in /out
31

32
/challenge/rebuild - quick re-compile of only the 'new' fuzz driver
33

34
/challenge/loc - compiles the project, runs the fuzz driver for 30  seconds,
35
and then generates a coverage report and coverage summary.  Type 'report' to
36
start a Web server to view the coverage reports generated by this command.
37

38
/challenge/fuzz-introspector - generates a detailed, web-based coverage
39
report that can be viewed in a web browser under Desktop.
40
_________________________
41

42
Additional commands are listed in the slides under 'Fuzz Dojo Only: Building
43
and Running Reports'
44

45
In addition, when any of these commands are run, fuzz drivers will be placed
46
within persistent folders in your home directory under ~/fuzz-dojo. You can
47
also try 'find-drv' to locate fuzz drivers in the source folder.
48

49
Run ./training <filename> when you have located a file containing a fuzz driver.
50

51
Syntax: ./training filename

1
hacker@training~locate-harnesses:/challenge$ ./build
2
patching file /src/minizip/CMakeLists.txt
3
Hunk #1 succeeded at 994 (offset 41 lines).
4

5
Please wait, creating /src-orig
6
Please wait, creating /src-none
7
  adding: home/hacker/fuzz-dojo/training-locate/ (stored 0%)
8
  adding: home/hacker/fuzz-dojo/training-locate/new_fuzzer.c (deflated 68%)
9
  adding: home/hacker/fuzz-dojo/training-locate/standalone.c (deflated 64%)
10
  adding: home/hacker/fuzz-dojo/training-locate/unzip_fuzzer.c (deflated 68%)
11
  adding: home/hacker/fuzz-dojo/training-locate/zip_fuzzer.c (deflated 73%)
12
  adding: home/hacker/fuzz-dojo/training-locate/build.sh (deflated 51%)
13
---------------------------------------------------------------
14
Compiling libFuzzer to /usr/lib/libFuzzingEngine.a...  done.
15
---------------------------------------------------------------
16
CC=clang
17
CXX=clang++
18
CFLAGS=-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION  -fsanitize=fuzzer-no-link
19
CXXFLAGS=-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION  -fsanitize=fuzzer-no-link -stdlib=libc++
20
RUSTFLAGS=--cfg fuzzing -Cdebuginfo=1 -Cforce-frame-pointers
21
---------------------------------------------------------------
22
+ '[' x86_64 = i386 ']'
23
+ cmake . '-DCMAKE_C_FLAGS=-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION  -fsanitize=fuzzer-no-link' '-DCMAKE_CXX_FLAGS=-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION  -fsanitize=fuzzer-no-link -stdlib=libc++' -DMZ_BUILD_FUZZ_TESTS=ON
24
-- The C compiler identification is Clang 18.1.8
25
-- Detecting C compiler ABI info - done
26
-- Check for working C compiler: /usr/local/bin/clang - skipped
27
-- Detecting C compile features
28
-- Detecting C compile features - done
29
-- Using CMake version 3.29.2
30
-- Looking for stdint.h - found
31
-- Looking for inttypes.h - found
32
-- Check size of off64_t - failed
33
-- Looking for fseeko - found
34
-- Using ZLIB 1.2.11
35
-- Checking for module 'liblzma'
36
--   Found liblzma, version 5.2.4
37
-- Using LZMA 5.2.4
38
-- Checking for module 'libzstd'
39
--   Found libzstd, version 1.4.4
40
-- Using ZSTD 1.4.4
41
-- Found PkgConfig: /usr/bin/pkg-config (found version "0.29.1")
42
-- Checking for module 'openssl'
43
--   Found openssl, version 1.1.1f
44
-- Using OpenSSL 1.1.1f
45
-- Performing Test Iconv_IS_BUILT_IN
46
-- Performing Test Iconv_IS_BUILT_IN - Success
47
-- The CXX compiler identification is Clang 18.1.8
48
-- Detecting CXX compile features
49
-- Detecting CXX compile features - done
50
-- The following features have been enabled:
51

52
 * MZ_COMPAT, Enables compatibility layer
53
 * MZ_ZLIB, Enables ZLIB compression
54
 * MZ_BZIP2, Enables BZIP2 compression
55
 * MZ_LZMA, Enables LZMA & XZ compression
56
 * MZ_ZSTD, Enables ZSTD compression
57
 * MZ_PKCRYPT, Enables PKWARE traditional encryption
58
 * MZ_WZAES, Enables WinZIP AES encryption
59
 * MZ_OPENSSL, Enables OpenSSL for encryption
60
 * MZ_LIBBSD, Builds with libbsd crypto random
61
 * MZ_ICONV, Enables iconv string encoding conversion library
62
 * MZ_BUILD_FUZZ_TESTS, Builds minizip fuzzer executables
63

64
-- The following features have been disabled:
65

66
 * MZ_LIBCOMP, Enables Apple compression
67
 * MZ_FETCH_LIBS, Enables fetching third-party libraries if not found
68
 * MZ_FORCE_FETCH_LIBS, Enables fetching third-party libraries always
69
 * MZ_COMPRESS_ONLY, Only support compression
70
 * MZ_DECOMPRESS_ONLY, Only support decompression
71
 * MZ_FILE32_API, Builds using posix 32-bit file api
72
 * MZ_BUILD_TESTS, Builds minizip test executable
73
 * MZ_BUILD_UNIT_TESTS, Builds minizip unit test project
74
 * MZ_CODE_COVERAGE, Builds with code coverage flags
75

76
-- Configuring done (4.0s)
77
-- Generating done (0.0s)
78
-- Build files have been written to: /src/minizip
79
+ make clean
80
++ nproc
81
+ make -j40
82
[  3%] Building C object CMakeFiles/minizip.dir/mz_crypt.c.o
83
[ 14%] Building C object CMakeFiles/minizip.dir/mz_strm_buf.c.o
84
[ 14%] Building C object CMakeFiles/minizip.dir/mz_strm_mem.c.o
85
[ 22%] Building C object CMakeFiles/minizip.dir/mz_strm.c.o
86
[ 22%] Building C object CMakeFiles/minizip.dir/mz_os.c.o
87
[ 25%] Building C object CMakeFiles/minizip.dir/mz_zip_rw.c.o
88
[ 33%] Building C object CMakeFiles/minizip.dir/mz_zip.c.o
89
[ 37%] Building C object CMakeFiles/minizip.dir/mz_strm_bzip.c.o
90
[ 44%] Building C object CMakeFiles/minizip.dir/mz_strm_zlib.c.o
91
[ 44%] Building C object CMakeFiles/minizip.dir/mz_strm_lzma.c.o
92
[ 48%] Building C object CMakeFiles/minizip.dir/mz_strm_zstd.c.o
93
[ 48%] Building C object CMakeFiles/minizip.dir/mz_crypt_openssl.c.o
94
[ 59%] Building C object CMakeFiles/minizip.dir/mz_strm_os_posix.c.o
95
[ 59%] Building C object CMakeFiles/minizip.dir/mz_strm_pkcrypt.c.o
96
[ 66%] Building C object CMakeFiles/minizip.dir/compat/ioapi.c.o
97
[ 66%] Building C object CMakeFiles/minizip.dir/mz_os_posix.c.o
98
[ 74%] Building C object CMakeFiles/minizip.dir/mz_strm_wzaes.c.o
99
[ 74%] Building C object CMakeFiles/minizip.dir/compat/zip.c.o
100
[ 74%] Building C object CMakeFiles/minizip.dir/compat/unzip.c.o
101
[ 77%] Linking C static library libminizip.a
102
[ 77%] Built target minizip
103
[ 81%] Building C object CMakeFiles/zip_fuzzer.dir/test/fuzz/zip_fuzzer.c.o
104
[ 85%] Building C object CMakeFiles/unzip_fuzzer.dir/test/fuzz/unzip_fuzzer.c.o
105
[ 88%] Building C object CMakeFiles/new_fuzzer.dir/test/fuzz/new_fuzzer.c.o
106
[ 96%] Linking CXX executable unzip_fuzzer
107
[ 96%] Linking CXX executable new_fuzzer
108
[100%] Linking CXX executable zip_fuzzer
109
[100%] Built target new_fuzzer
110
[100%] Built target zip_fuzzer
111
[100%] Built target unzip_fuzzer
112
+ zip -j /out/unzip_fuzzer_seed_corpus.zip test/fuzz/unzip_fuzzer_seed_corpus/as.zip test/fuzz/unzip_fuzzer_seed_corpus/bzip2.zip test/fuzz/unzip_fuzzer_seed_corpus/comments.zip test/fuzz/unzip_fuzzer_seed_corpus/corpus.zip test/fuzz/unzip_fuzzer_seed_corpus/dot_dot_backslash_name.zip test/fuzz/unzip_fuzzer_seed_corpus/encrypted_pkcrypt.zip test/fuzz/unzip_fuzzer_seed_corpus/encrypted_wzaes.zip test/fuzz/unzip_fuzzer_seed_corpus/gh.zip test/fuzz/unzip_fuzzer_seed_corpus/gh_739.zip test/fuzz/unzip_fuzzer_seed_corpus/gh_740.zip test/fuzz/unzip_fuzzer_seed_corpus/incorrect_number_entries.zip test/fuzz/unzip_fuzzer_seed_corpus/infozip_symlinks.zip test/fuzz/unzip_fuzzer_seed_corpus/large_cd_comment.zip test/fuzz/unzip_fuzzer_seed_corpus/license_zstd.zip test/fuzz/unzip_fuzzer_seed_corpus/lzma.zip test/fuzz/unzip_fuzzer_seed_corpus/permissions.zip test/fuzz/unzip_fuzzer_seed_corpus/signed.zip test/fuzz/unzip_fuzzer_seed_corpus/storeonly.zip test/fuzz/unzip_fuzzer_seed_corpus/tiny.zip test/fuzz/unzip_fuzzer_seed_corpus/unsupported_permissions.zip test/fuzz/unzip_fuzzer_seed_corpus/xz.zip test/fuzz/unzip_fuzzer_seed_corpus/zip64.zip
113
  adding: as.zip (stored 0%)
114
  adding: bzip2.zip (stored 0%)
115
  adding: comments.zip (stored 0%)
116
  adding: corpus.zip (stored 0%)
117
  adding: dot_dot_backslash_name.zip (stored 0%)
118
  adding: encrypted_pkcrypt.zip (stored 0%)
119
  adding: encrypted_wzaes.zip (stored 0%)
120
  adding: gh.zip (stored 0%)
121
  adding: gh_739.zip (stored 0%)
122
  adding: gh_740.zip (stored 0%)
123
  adding: incorrect_number_entries.zip (stored 0%)
124
  adding: infozip_symlinks.zip (stored 0%)
125
  adding: large_cd_comment.zip (stored 0%)
126
  adding: license_zstd.zip (stored 0%)
127
  adding: lzma.zip (stored 0%)
128
  adding: permissions.zip (stored 0%)
129
  adding: signed.zip (stored 0%)
130
  adding: storeonly.zip (stored 0%)
131
  adding: tiny.zip (stored 0%)
132
  adding: unsupported_permissions.zip (stored 0%)
133
  adding: xz.zip (stored 0%)
134
  adding: zip64.zip (stored 0%)
135
+ find . -name '*_fuzzer' -exec cp -v '{}' /out ';'
136
'./zip_fuzzer' -> '/out/zip_fuzzer'
137
'./unzip_fuzzer' -> '/out/unzip_fuzzer'
138
'./new_fuzzer' -> '/out/new_fuzzer'
139
+ find . -name '*_fuzzer.dict' -exec cp -v '{}' /out ';'
140
'./test/fuzz/unzip_fuzzer.dict' -> '/out/unzip_fuzzer.dict'
141
+ find . -name '*_fuzzer_seed_corpus.zip' -exec cp -v '{}' /out ';'
142

143
First set environment with . e
144
Test with: /out/<driver>
145

146
new_fuzzer unzip_fuzzer zip_fuzzer
147

148
hacker@training~locate-harnesses:/challenge$

1
LibFuzzer
2
   │
3
   │ 生成/变异一段 data[]
4
   ▼
5
LLVMFuzzerTestOneInput(data, size)
6
   │
7
   ▼
8
创建内存输入流 fuzz_stream
9
   │
10
   │ 前几个字节
11
   ├── flag
12
   ├── compression_method
13
   ├── zip64
14
   └── compress_level
15
   │
16
   ▼
17
剩余 data
18
   │
19
   ▼
20
mz_zip_entry_write()
21
   │
22
   ▼
23
minizip ZIP 创建/压缩代码
24
   │
25
   ▼
26
大量内部函数
27
   │
28
   └── ← 这里就是 Fuzzer 真正想覆盖的代码

1
hacker@training~modify-a-fuzzing-harness:/challenge$ ./training
2
###
3
### Erase the contents of a sample function - minizip
4
###
5

6
Every time you build a project on this platform, the fuzz drivers will be
7
copied to a folder in your home directory, but only if that folder does not
8
exist. If you wish to rebuild this folder from scratch, simply delete the
9
folder and compile the project again. In addition, one of the fuzz drivers
10
will be duplicated and renamed to 'new_fuzzer'. This allows you to
11
contribute a new fuzz driver while maintaining the existing fuzz drivers in
12
the project. The source code for the single current top-performing fuzz
13
driver will be duplicated and provided as sample code for 'new_fuzzer'.
14

15
In this challenge, you will practice editing a fuzz driver. You will need to
16
build the project and modify the fuzz driver 'new_fuzzer'.
17

18
To beat this challenge:  Erase the contents of the sample function provided
19
in this code and then check to verify that the code coverage for the new
20
function is 0. You will need to run /challenge/build and /challenge/loc in
21
the challenge directory to first copy the source code into your home
22
directory and then check code coverage.
23

24
Current code coverage:
25

26
Missing /out/report_target/new_fuzzer/linux/summary.json
27

28
Please compile a project first
29

30

31
No fuzz driver modifications detected.

1
###
2
### Fix Broken Fuzzing Harnesses - example
3
###
4

5
Existing OSS-FUZZ projects may have subtle flaws that limit a fuzz driver's
6
operation. It is very unlikely that you will run into code with compile
7
errors since all submitted code is checked for obvious flaws, but this does
8
not mean that fuzz drivers written by others are operating correctly. In
9
this challenge, you have a very simple C++ fuzz driver that has code
10
coverage limited by a simple bug.  Search through the fuzz driver code to
11
find and fix that bug.
12

13
You will need to build the project and modify the project code to fix this
14
bug to obtain greater code coverage. To help you understand what lines of
15
code are not being executed, you may find it useful to run fuzz introspector
16
and then pull up the results in a web browser under the virtual desktop.
17
Spend your time familiarizing yourself with a fuzz introspector report and
18
the many tools and suggestions it provides for increasing code coverage.
19
You may want to view the 'Per-fuzzer coverage' report for new-fuzzer.
20

21
Run the fuzz introspector report in one terminal, load the virtual desktop
22
and load 'http://0.0.0.0:8008/fuzz_report.html' in a Firefox web browser
23
window.
24

25
/challenge/loc will provide you the flag once code coverage is increased.

1
Current LOC report:
2

3
do_stuff_fuzzer
4
loc count: 20
5
loc_covered: 20
6
loc_percent: 100.00 %
7
functions count: 3
8
functions_covered: 3
9
functions_percent: 100.00 %
10

11
Total
12
loc count: 20
13
loc_covered: 20
14
loc_percent: 100.00 %
15
functions count: 3
16
functions_covered: 3
17
functions_percent: 100.00 %
18

19
        Initial:  76 %
20
        Current:  100 %
21
Needed for flag:  95 %
22

23
'report' to start web server to view the coverage report
24
_________________________________________________________

1
###
2
### Parameter Repair - avahi
3
###
4

5
LibFuzzer is an in-process, coverage-guided, evolutionary fuzzing engine
6
used for the majority of OSS-FUZZ projects.  Google provides a tutorial for
7
libFuzzer here:
8

9
https://github.com/google/fuzzing/blob/master/tutorial/libFuzzerTutorial.md
10

11
Understanding the 'Hello World' fuzzer is essential for completing this
12
level  Notice the structure of this simplified fuzz driver:
13

14
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
15
  DoSomethingWithData(Data, Size);
16
  return 0;
17
}
18

19
Examine the source code of fuzz-newfuzzer.c. The purpose of this fuzz driver
20
is to fuzz the function 'avahi_dns_packet_append_name' however the arguments
21
sent to the function have a major flaw.  Every fuzz driver must do
22
'something interesting' with its arguments, and this fuzz driver currently
23
does nothing useful.  Check the fuzz introspector report and review the
24
guide above to determine why code coverage is not being tested.
25

26
/challenge/loc will provide you the flag when fuzz-newfuzzer sees an
27
increase in code coverage.