Printable View
Wrote a command line fuzzer (originally forfuzzing *nix setuid binaries),
running it on windows gave astonishing results almost every third
commandline application crashed for example expand.exe,extrac32.exe,fontview.exe,evetvwr.exe.
(only one of them poses a real threat can you guess ?)
I wonder what microsoft is upto.
The fuzzer is at
http://warl0ck.cjb.net/clfuzz.py
Fontview.exe probably a virus created by another hacker try to impersonate and windows exe?W32.OPASERV.T Virus
Not anymore it seems...Quote:
you could rename to text (or zip it up) and attach here..
I dont understand...
You wrote something for *nix...and it doesnt work with MS :rolleyes:
Why is that MSes fault\bug.
Sounds like its "your" bug.
MLF
Fontview is not a virus and morganlefay i think you misunderstood something.
Sorry form the broken link (should have checked it)
here it is
Ok then
Explain it to me :cool:
sounds like the "fuzzer" is not letting go of a process...
"Crashed"
What crashed? the os? the program?
MLF
Hi
"Fuzzing" or "Fuzz testing" is one among several software testing methods,
for an example see Soda's Tutorial[1]. Looks like warl0ck7 used
a "fuzzer" of his own making to test various programs (console applications,
hence "command line"). As an effect, quite a few of them crashed.
He argues that this implies bad software development, and might
allow for possible privilege escalation.
Software testing itself is a process used to help identify the correctness,
completeness and quality of developed computer software[2]. With that in
mind, testing can never completely establish the correctness of computer
software. Only the process of formal verification can prove that there are no
defects.
Reminds me of physics :) We are building theoretical models and
theories and test them via verification by experiment. However,
even if all experiments we can think of agree with the predictions,
we never can be sure to have the correct theory.
Cheers
[1] http://www.antionline.com/showthread...hreadid=269650
[2] http://en.wikipedia.org/wiki/Software_testing
The programs that were bieng fuzzed crashed (only one program has a real vulnerability
to sensitive to be listed here).
C:\>clfuzz.py extrac32 STR
here's the output screenshot
I am on windows 2000+SP4+SP4UpdateRollUp1
google fontview.exe or just http://www.processlibrary.com/directory/files/FONTVIEW/
Does anyone else have a correct fuzzer we can compare it to?
Whats wrong with mine ? :confused:Quote:
Does anyone else have a correct fuzzer we can compare it to?
Total victims till now : 23
Will lead to privilege escalation : 2 :D
Nothing would just like a different one to compare it to so to see if they get different results...
puff, clearly you dont understand what a fuzzer does. The results are: when the command line program is fed a bunch of randomly permutated **** as parameters, they crash, if you wanted, you could fuzz by hand if you have a few hundred years. They dont fail gracefully, and theres possibly an exploitable overflow is occuring. Once you find a binary that does not fail gracefully, you then see if the error is exploitable.
-Maestr0
EDT: Good work Warl0ck7, and if you havent seen it already there was a web service fuzzer in python called SMUDGE that was pretty cool and easy to work on, wasnt really complete when I last looked at it, but easy enough to modify to work.
Thanks Maestr0, SMUDGE is essentially SPIKE in python and its development
has stopped i recommend peach.
http://freshmeat.net/projects/peachfuzz/
Nope just was debating if differently coded fuzzers get diffrent results?