Boofuzz Doesn't Restart Process After Crash
<p>I'm learning how to fuzz using boofuzz. I have everything setup on a Windows 7 VM. The target is the Vulnserver application. Since I know the <code>TRUN</code>, <code>GMON</code>, and <code>KSTET</code> commands are vulnerable, I put these commands in a <code>s_group</code> list. I expect the <code>vulnserver.exe</code> process to crash on the <code>TRUN</code> command, restart, and then continue testing the other commands. Below is the boofuzz script I used.</p>

<pre><code>#!/usr/bin/python

from boofuzz import *
from boofuzz import pedrpc

host = "172.16.37.201"
port = 9999

# Define request
s_initialize("Vulnserver")
s_group("verbs", values=["TRUN", "GMON", "KSTET"])

if s_block_start("test", group="verbs"):
    s_delim(" ")
    s_string("AAA")
    s_string("\r\n")

s_block_end("test")

# Define Session
logger = FuzzLogger(fuzz_loggers=[FuzzLoggerText()])
session = sessions.Session(log_level=10, sleep_time=0.03, fuzz_data_logger=logger)
connection = SocketConnection(host, port, proto="tcp")
target = sessions.Target(connection)
target.procmon = pedrpc.Client(host, 26002)
target.procmon_options = {
    "proc_name":"vulnserver.exe",
    "stop_commands":['wmic process where (name="vulnserver.exe") delete'],
    "start_commands":['C:\\Temp\\vulnserver.exe 9999'],
}
session.add_target(target)
session.connect(s_get("Vulnserver"))
session.fuzz()
</code></pre>

<p>After starting <code>vulnserver.exe</code>, I run my boofuzz script and get the following error:</p>

<pre><code>.....
                                +0c: 41414141 (1094795585) -&gt; N/A
                                +10: 41414141 (1094795585) -&gt; N/A
                                +14: 41414141 (1094795585) -&gt; N/A

                              disasm around:
                                0x41414141 Unable to disassemble

                              SEH unwind:
                                ffffffff -&gt; ntdll.dll:774d61a5 mov edi,edi

[2016-09-02 13:24:06,178] Test Case: 53
[2016-09-02 13:24:06,178]     Info: primitive name: None, type: String, default value: AAA
[2016-09-02 13:24:06,178]     Info: Test case 53 of 8352 for this node. 53 of 8352 overall.
Traceback (most recent call last):
  File "auto.py", line 34, in &lt;module&gt;
    session.fuzz()
  File "C:\Python27\lib\site-packages\boofuzz\sessions.py", line 414, in fuzz
    self._fuzz_current_case(*fuzz_args)
  File "C:\Python27\lib\site-packages\boofuzz\sessions.py", line 846, in _fuzz_current_case
    target.open()
  File "C:\Python27\lib\site-packages\boofuzz\sessions.py", line 71, in open
    self._target_connection.open()
  File "C:\Python27\lib\site-packages\boofuzz\socket_connection.py", line 118, in open
    self._sock.connect((self.host, self.port))
  File "C:\Python27\lib\socket.py", line 228, in meth
    return getattr(self._sock,name)(*args)
socket.error: [Errno 10061] No connection could be made because the target machine actively refused it
</code></pre>

<p>The error indicates that boofuzz did not restart the <code>vulnserver.exe</code> process. Below is the output from <code>process_monitor.py</code> if that helps.</p>

<pre><code>C:\Tools\boofuzz&gt;python process_monitor.py --crash_bin "crash.bin" --proc_name "vulnserver.exe" --port 26002
[01:23.48] Process Monitor PED-RPC server initialized:
[01:23.48]       crash file:  C:\Tools\boofuzz\crash.bin
[01:23.48]       # records:   0
[01:23.48]       proc name:   None
[01:23.48]       log level:   1
[01:23.48] awaiting requests...
[01:24.01] updating target process name to 'vulnserver.exe'
[01:24.01] updating stop commands to: ['wmic process where (name="vulnserver.exe") delete']
[01:24.01] updating start commands to: ['C:\\Temp\\vulnserver.exe 9999']
[01:24.01] debugger thread-1472837041 looking for process name: vulnserver.exe
[01:24.01] debugger thread-1472837041 found match on pid 1060
[01:24.06] debugger thread-1472837041 caught access violation: '[INVALID]:41414141 Unable to disassemble at 41414141 from thread 1904 caused access violation'
[01:24.06] debugger thread-1472837041 exiting
[01:24.06] debugger thread-1472837046 looking for process name: vulnserver.exe
</code></pre>

<p>Thanks!</p>

<h2>TL;DR</h2>

<p>The failure to restart is a result of a series of bugs. Run <code>pip install --upgrade boofuzz</code> to get <a href="https://pypi.python.org/pypi/boofuzz/0.0.5" rel="nofollow">v0.0.5</a> or later, or pull down the latest code from <a href="https://github.com/jtpereyda/boofuzz/" rel="nofollow">Github</a>.</p>

<h2>process_monitor bug</h2>

<p>The key issue is that failures detected by procmon were being logged as info, not failures, meaning that a restart was not triggered. <a href="https://github.com/jtpereyda/boofuzz/pull/83" rel="nofollow">Fix PR</a>.</p>

<h2>boofuzz bug</h2>

<p>This line:</p>

<pre><code>socket.error: [Errno 10061] No connection could be made because the target machine actively refused it
</code></pre>

<p>hints that the application under test most likely crashed. Boofuzz should handle this instead of crashing. This issue has been <a href="https://github.com/jtpereyda/boofuzz/issues/78" rel="nofollow">reported</a> and <a href="https://github.com/jtpereyda/boofuzz/pull/82" rel="nofollow">fixed</a>.</p>

<h2>Other process_monitor bug</h2>

<p>Notice in your <code>process_monitor.py</code> output the line:</p>

<pre><code>[01:23.48]       proc name:   None
</code></pre>

<p>Proc name is not getting set! The error is in <code>process_monitor.py</code> line 368:</p>

<pre><code>if opt in ("-p", "--proc_Name"): #oops!
</code></pre>

<p>It should be <code>--proc_name</code> not <code>--proc_Name</code>!</p>

<p>This issue has been <a href="https://github.com/jtpereyda/boofuzz/pull/80" rel="nofollow">fixed</a> in the latest code. But a workaround would be to use the shortname <code>-p</code> instead of <code>--proc_name</code>.</p>

python fuzzing