./c0de/perl/syslog-fuzzer.txt

0.
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.
36.
37.
38.
39.
40.
41.
42.
43.
44.
45.
46.
47.
48.
49.
50.
51.
52.
53.
54.
55.
56.
57.
58.
59.
60.
61.
62.
63.
64.
65.
66.
67.
68.
69.
70.
71.
72.
73.
74.
75.
76.
77.
78.
79.
80.
81.
82.
83.
84.
85.
86.
87.
88.
89.
90.
91.
92.
93.
94.
95.
96.
97.
98.
99.
100.
101.
102.
103.
104.
105.
106.
107.
108.
109.
110.
111.
112.
113.
114.
115.
116.
117.
118.
119.
120.
121.
122.
123.
124.
125.
126.
127.
128.
129.
130.
131.
132.
133.
134.
135.
136.
137.
138.
139.
140.
141.
142.
143.
144.
145.
146.
147.
148.
149.
150.
151.
152.
153.
154.
155.
156.
157.
158.
159.
160.
161.
162.
163.
164.
165.
166.
167.
168.
169.
170.
171.
172.
173.
174.
175.
176.
177.
178.
179.
180.
181.
182.
183.
184.
185.
186.
187.
188.
189.
190.
191.
192.
193.
194.
195.
196.
197.
198.
199.
200.
201.
202.
#!/usr/bin/perl
#syslog Fuzzer v0.1 
#[email protected]
#www.aitsec.com
 
use IO::Socket::INET;
use Getopt::Std;
use POSIX qw(strftime);
 
getopt('hp', \ my %opts );
 
$SIG{INT}=\&exitz;
print "
\t  Syslog Fuzzer v0.1 by Jaime Blasco (c) 2008
\t        www.aitsec.com
";
if(!defined($opts{h}) or !defined($opts{p})){
	print "
		-h   : Host\n
		-p   : Port Number
	";
exit
}
 
$port = $opts{p};
$host = $opts{h};
 
@bfo = ('A'x10, 'A'x20, 'A'x40, 'A'x80, 'A'x160, 'A'x320, 'A'x640, 'A'x1280, 'A'x3000, 'A'x5000, 'A'x8000, 'A'x12000, 'A'x15000);
@fse = ("%s%p%x%d", ".1024d", "%.2049d", "%p%p%p%p", "%x%x%x%x", "%d%d%d%d", "%s%s%s%s", "%99999999999s",
	    "%08x", "%%20d", "%%20n", "%%20x", "%%20s", "%s%s%s%s%s%s%s%s%s%s", "%p%p%p%p%p%p%p%p%p%p",
	    "%#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%", "%s"x150, "%x"x300);
@int = ("-1", "0", "0x100", "0x1000", "0x3fffffff", "0x7ffffffe", "0x7fffffff", "0x80000000", "0xfffffffe", "0xffffffff", "0x10000", "0x100000");
 
print "Using host: ".$host."\n";
print "Using port: ".$port."\n";
 
$con=new IO::Socket::INET->new(PeerPort=>$port,
        Proto=>'udp',
        PeerAddr=>$host);
 
#http://www.ietf.org/rfc/rfc3164.txt
#udp SYSLOG PACKET looks like:
#<Priority>Header Message text
# Header = Date Hostname PID
 
$npriority = '<0>';
$ndate = strftime "%b%e %H:%M:%S", localtime;
$nhostname = "10.0.0.2";
$npid = 'fuzzer[10]';
$nmsg = "Syslog Fuzzer v0.1 by Jaime Blasco (c) 2008";
 
#fuzzing PRI
 
#Buffer Overflow
foreach (@bfo) {
	$header = $ndate.' '.$nhostname.' '.$npid;
	$packet = '<'.$_.'>'.$header.': '.$nmsg;
	$con->send($packet);
 
	#print $packet;
}
sleep 1;
 
#Format Strings
foreach (@fse) {
	$header = $ndate.' '.$nhostname.' '.$npid;
	$packet = '<'.$_.'>'.$header.': '.$nmsg;
	$con->send($packet);
	#print $packet;
}
sleep 1;
 
#Integer Overflows
foreach (@int) {
	$header = $ndate.' '.$nhostname.' '.$npid;
	$packet = '<'.$_.'>'.$header.': '.$nmsg;
	$con->send($packet);
	#print $packet;
}
sleep 1;
 
#fuzzing header
 
	#fuzzing Date
 
#Buffer Overflow
foreach (@bfo) {
	$header = $_.' '.$nhostname.' '.$npid;
	$packet = $npriority.$header.': '.$nmsg;
	$con->send($packet);
	#print $packet;
}
sleep 1;
 
#Format Strings
foreach (@fse) {
	$header = $_.' '.$nhostname.' '.$npid;
	$packet = $npriority.$header.': '.$nmsg;
	$con->send($packet);
	#print $packet;
}
sleep 1;
 
#Integer Overflows
foreach (@int) {
	$header = $_.' '.$nhostname.' '.$npid;
	$packet = $npriority.$header.': '.$nmsg;
	$con->send($packet);
	#print $packet;
}
sleep 1;
 
	#fuzzing hostname
 
#Buffer Overflow
foreach (@bfo) {
	$header = $ndate.' '.$_.' '.$npid;
	$packet = $npriority.$header.': '.$nmsg;
	$con->send($packet);
	#print $packet;
}
sleep 1;
 
#Format Strings
foreach (@fse) {
	$header = $ndate.' '.$_.' '.$npid;
	$packet = $npriority.$header.': '.$nmsg;
	$con->send($packet);
	#print $packet;
}
sleep 1;
 
#Integer Overflows
foreach (@int) {
	$header = $ndate.' '.$_.' '.$npid;
	$packet = $npriority.$header.': '.$nmsg;
	$con->send($packet);
	#print $packet;
}
sleep 1;
 
	#fuzzing PID
 
#Buffer Overflow
foreach (@bfo) {
	$header = $ndate.' '.$nhostname.' '.$_;
	$packet = $npriority.$header.': '.$nmsg;
	$con->send($packet);
	#print $packet;
}
sleep 1;
 
#Format Strings
foreach (@fse) {
	$header = $ndate.' '.$nhostname.' '.$_;
	$packet = $npriority.$header.': '.$nmsg;
	$con->send($packet);
	#print $packet;
}
sleep 1;
 
#Integer Overflows
foreach (@int) {
	$header = $ndate.' '.$nhostname.' '.$_;
	$packet = $npriority.$header.': '.$nmsg;
	$con->send($packet);
	#print $packet;
}
sleep 1;
 
#fuzzing msg
 
#Buffer Overflow
foreach (@bfo) {
	$header = $ndate.' '.$nhostname.' '.$npid;
	$packet = $npriority.$header.': '.$_;
	$con->send($packet);
	#print $packet;
}
sleep 1;
 
#Format Strings
foreach (@fse) {
	$header = $ndate.' '.$nhostname.' '.$npid;
	$packet = $npriority.$header.': '.$_;
	$con->send($packet);
	#print $packet;
}
sleep 1;
 
#Integer Overflows
foreach (@int) {
	$header = $ndate.' '.$nhostname.' '.$npid;
	$packet = $npriority.$header.': '.$_;
	$con->send($packet);
	#print $packet;
}
 
 
 
 
 
 

Back