Re: [Peach] Fuzzing RTMP

[Martin Žember]

Hi,

the Hotfuzz mailing-list group has been opened for posting from
anyone, even non-members, after the spam filter had turned out to work
well. I do not see your message in the spam queue (nor in the pending
messages queue). The address is:

hotfuzz...@googlegroups.com



Regarding your issues:

1. The "activating command" should not be executed when the "Restart
client" box is checked. It happens when permission problems on Window
Vista or 7 arise. I wonder why this happens to you.

But the client and fuzzing starts anyway (as far as I could reproduce
it), so the fatal problem is the next one.

2. Fuzzing a service.

The "net start ..." command finishes and leaves the service running in
the background. The debugger is not attached to it anymore, thus
HutFuzz thinks it has stopped. It is good that you post it here;
hopefully, people in this group can give you advice on how to fuzz a
service with Peach.

Martin


On Sat, Aug 25, 2012 at 2:31 AM, Sankaranarayanan Sundarapandian
<shank...@gmail.com> wrote:
> Hi,
>
> I was unable to post to the hotfuzz project group and could not understand
> why. So I am sending this post to the peach fuzz group. I am new to fuzzing,
> Peach and hence HotFuzz. Can HotFuzz fuzz RTMP streams? Since Wireshark
> supports RTMP (as RTMPT) and since it was mentioned in the tuorial that
> HotFuzz supports most of the protocols that Wireshark supports, I went ahead
> to test it. Assuming fuzzing RTMP strams is possible, here are the details.
> I am running HotFuzz on a VM running Win XP SP3 32-bit. I don't have
> Wireshark or any newer (than 2.5) version of Python installed. My set up is
> such that the Client, server and the proxy are all in the local host. The
> setup is:
>
> Client
> Proxy IP: 127.0.0.1 Port: 5150
> Program: C:\Program Files\Google\Chrome\Application\chrome.exe
> 127.0.0.1/test.html
> Symbols: C:\Symbols
>
> Server
> Proxy IP: 127.0.0.1 Port: 1935
> Program: C:\WINDOWS\system32\cmd.exe /C net start FMS
> Symbols: C:\Symbols
>
> Recording
> Iteration count 1 Proxy timeout:60
> Protocol port: 1935
> Protocol family: TCP
>
> Checked both Restart client and Disable Client debugger for now.
>
> Below are the outputs:
>
> For the client:
> ] HotFuzz 1.2.0
> ] Copyright (c) HotFuzz Team
>
> ] Product is built on Peach 2.3.5 DEV Runtime (Copyright (c) Michael
> Eddington)
>
> ] Peach Agent
>
>
> //-> Listening on [9001] with no password
>
>
> Agent: clientHello()
> Agent: Session ID: df8fa500-ee46-11e1-a765-000c29561404
> Agent: clientHello() all done
> Agent: startMonitor(Named_23)
> code: ppprocess.Process(msg.params)
> Agent: Sending Ack
>
> Agent: onTestStarting()
>
> Agent: onPublisherCall()
> FAILED TO RUN ACTIVATING COMMAND. Please check if the path is correct.
> Please use absolute path or path relative to hotfuzz main directory
>
> Agent: onShutdown()
>
> For the server:
> ] HotFuzz 1.2.0
> ] Copyright (c) HotFuzz Team
>
> ] Product is built on Peach 2.3.5 DEV Runtime (Copyright (c) Michael
> Eddington)
>
> ] Peach Agent
>
>
> //-> Listening on [9002] with no password
>
>
> Agent: clientHello()
> Agent: Session ID: df921600-ee46-11e1-b794-000c29561404
> Agent: clientHello() all done
> Agent: startMonitor(Named_28)
> code: ppmonitor.WindowsDebugEngine(msg.params)
> Agent: Sending Ack
> Agent: onTestStarting()
>
> Waiting for port to open...
>
> The Flash Media Server (FMS) service is starting.
>
> The Flash Media Server (FMS) service was started successfully.
>
>
> _DbgEventHandler.ExitProcess: Target application has exitted
> _DbgEventHandler.ExitProcess: Target application has exitted
> _DbgEventHandler.ExitProcess: Target application has exitted
>
> !!!Waiting for port took too long. Application probably has not started
> correctly or it requires more than 10 seconds to start!!!
>
> Agent: onShutdown()
> _StopDebugger()
>
>
> For the recordings tab:
> ] HotFuzz 1.2.0
> ] Copyright (c) HotFuzz Team
>
> ] Product is built on Peach 2.3.5 DEV Runtime (Copyright (c) Michael
> Eddington)
>
> [*] Starting run "DefaultRun"
> [-] Test: "HotTest" (None)
>
>
> [1] TestCase
>
> Writing recorded data to a configuration file...
>
> No data were recorded during recording faze. This might be caused by
> incorrect configuration or communication timeout. Please check if client
> application is configured to send requests directly to hotfuzz. If the
> initial load took more than 30 seconds, please try again
> [-] Test "HotTest" completed
>
> [*] Run "DefaultRun" completed
>
> And the status bar says Recording failed. Basically, I have embedded the
> rtmp request, rtmp://IP/vod/mp4:abc.mp4, inside of the test.html. Please let
> me know if I am doing anything wrong and wat possibly I could do to have
> this setup work. Thanks in advance. I would also greatly appreciate it if
> someone could tell me how I can get posting rights at HotFuzz Project group.
>
> -ssn
>
>
>
>
>
>
>
>
> --
> You received this message because you are subscribed to the Google Groups
> "peachfuzz" group.
> To post to this group, send email to peac...@googlegroups.com.
> To unsubscribe from this group, send email to
> peachfuzz+...@googlegroups.com.
> For more options, visit this group at
> http://groups.google.com/group/peachfuzz?hl=en.

[Martin Žember]

I would resolve the server side first. (The server commands exits
before anything happens.)

How to attach the debugger to a service? (But if the Flash Media
Server (FMS) could be run as a program, I would recommend this
instead.)

Martin

On Tue, Aug 28, 2012 at 10:16 AM, Michael Eddington
<meddi...@gmail.com> wrote:
> The client program must not exit until after it has caused the network
> traffic. My guess is chrome is exiting when u run that command.
>
> Mike
>
>
> On Aug 28, 2012, at 12:49 AM, Sankaranarayanan Sundarapandian
> <shank...@gmail.com> wrote:
>
> Client program is :
> C:\Program Files\Google\Chrome\Application\chrome.exe 127.0.0.1/test.html .
>
> However, I have no activation command. Also, the html basically has a rtmp
> request embedded in to to be able to stream a video from the webserver.
>
> On Tue, Aug 28, 2012 at 9:43 AM, Michael Eddington <meddi...@gmail.com>
> wrote:

>>
>> On 8/24/2012 5:31 PM, Sankaranarayanan Sundarapandian wrote:
>> > FAILED TO RUN ACTIVATING COMMAND. Please check if the path is correct.
>> > Please use absolute path or path relative to hotfuzz main directory
>> >
>>

>> That seems to be your issue. What command are you running as the client?

[jan muenther]

Sidenote, but since you asked, debugging services is an FAQ:
http://support.microsoft.com/kb/824344