uniofuzz.py

#!/usr/bin/env python
# -*- coding: latin-1 -*- # ###################################################
#                                                                             #
#         ~    .__ °.__   0       o                    ^   .__ °__  `´        #
#  °____) __ __|  | | °|   ______°____ 0 ____  __ _________|__|/  |_ ___.__.  #
#  /    \|  | °\  |°|  | °/  ___// __ \_/ ___\|  | °\_  __ \ o\   __<   |  |  #
# | o°|  \  |  /  |_|  |__\___ \\  ___/\ °\___| o|  /|  | \/  ||  |° \___ O|  #
# |___|  /____/|____/____/____ °>\___  >\___  >____/ |__|° |__||__|  / ____|  #
# `´´`´\/´`nullsecurity team`´\/`´´`´\/`´``´\/  ``´```´```´´´´`´``0_o\/´´`´´  #
#                                                                             #
# uniofuzz.py - UniOFuzz                                                      #
#                                                                             #
# DATE                                                                        #
# 01/16/2012                                                                  #
#                                                                             #
# DESCRIPTION                                                                 #
# UniOFuzz - the universal fuzzing tool for browsers, web services, files,    #
# programs and network services/ports                                         #
#                                                                             #
# FOUND BY UNIOFUZZ                                                           #
# http://www.exploit-db.com/exploits/18019                                    #
# http://www.exploit-db.com/exploits/18008                                    #
# http://www.exploit-db.com/exploits/18006                                    #
#                                                                             #
# DEMONSTRATION                                                               #
# http://www.youtube.com/watch?v=oYzc_vEidBQ                                  #
#                                                                             #
# AUTHOR                                                                      #
# pigtail23 - http://www.nullsecurity.net/                                    #
#                                                                             #
###############################################################################


import argparse
import sys
import random
import socket
import time
import os

NAME    = 'UniOFuzz - the universal fuzzing tool for browsers, web services, files , programs and network services/ports.'
VERSION = '0.1.2-beta'
AUTHOR  = ("pigtail23 | http://www.nullsecurity.net/ | pigtail23-(at)-nullsecurity.net")

def parh():

    global args

    parser = argparse.ArgumentParser(
    usage='%(prog)s -h/--help',
    formatter_class=argparse.RawDescriptionHelpFormatter,
    description='%s #v%s\nby: %s\n' % (NAME, VERSION, AUTHOR),
    epilog='''
    Examples:
    Browser Fuzzing:
    usage: ./%(prog)s -b template.html -m 1000 -e html/php/aspx -o /var/www [-c A] [-s 10000]

    Web Service Fuzzing:
    usage: ./%(prog)s -w -i 0.01 -ip 127.0.0.1 -port 80 [-c A] [-s 10000]

    File Fuzzing:
    usage: ./%(prog)s -f -m 1000 -e m3u/ini/pdf -o ~/files [-c A] [-s 10000]
    usage: ./%(prog)s -ft template.m3u -m 1000 -e m3u/ini/pdf -o ~/files [-c A] [-s 10000]

    Piping String to Program:
    usage: ./%(prog)s -p -m 1000 -i 1.5 -d '/bin/ls -n' [-c A] [-s 10000]

    Network Service/Port Fuzzing:
    usage: ./%(prog)s -n -i 0.01 -ip 127.0.0.1 -port 25 [-c A] [-s 10000]

    ''')

    if len(sys.argv)==1:
        parser.print_help()
        sys.exit(1)

    parser.add_argument('-b', default=True, metavar='templatefile.*', help='browser fuzz')
    parser.add_argument('-f', metavar='', help='filefuzz', const=True , action='store_const')
    parser.add_argument('-ft', default=True, metavar='templatefile.*', help='fuzz files with template file')
    parser.add_argument('-p', metavar='', help='pipes strings to a program', const=True , action='store_const')
    parser.add_argument('-d', default=True, metavar='\'/bin/ls -n\'', help='program to execute')
    parser.add_argument('-w', metavar='', help='web daemon fuzz', const=True , action='store_const')
    parser.add_argument('-n',metavar='', help='network service fuzz', const=True , action='store_const')
    parser.add_argument('-i', default=True, metavar='0.01', help='intervall')
    parser.add_argument('-o', default=True, metavar='/var/www', help='outputfolder')
    parser.add_argument('-s', default=True, metavar='10000', help='max string length (default: 30000)')
    parser.add_argument('-m', default=True, metavar='10000', help='how many files/pipes')
    parser.add_argument('-c', default=True, metavar='A', help='const character (default: random)')
    parser.add_argument('-ip', default=True, metavar='127.0.0.1', help='host ip')
    parser.add_argument('-port', default=True, metavar='80', help='host port')
    parser.add_argument('-e', default=True, metavar='html,m3u,pdf,...', help='file extension')

    args = parser.parse_args()

#random number
def rand():

    if args.s == True:
        ra = random.randrange(1,30000)
    else:
        ra = random.randrange(1,int(args.s))

    return ra

#generates simple random strings
def ran():

    rstr = ''
    for v in range(0,rand()):
        ra = random.randrange(1,256)
        rstr += "%c"%(ra)

    return rstr

#Generate Random Strings
def genstr(i):

    if args.c != True:
        rd = 4
    else:
        rd = random.randrange(0,i)

    #String with a char from ASCII 1-255
    if rd == 0:
        randomstr = ''
        ra = random.randrange(1,256)
        for v in range(0,rand()):
            randomstr += "%c"%(ra)

    #String with chars from ASCII 1-255
    elif rd == 1:
        randomstr = ran()

    #String like %%%AAAAAAAAA... or !"§!"§!"§!"§...
    elif rd == 2:
        randomstr = ''
        newstr = ''
        ra = random.randrange(0,6)
        for y in range(0,ra):

            rb = random.randrange(0,4)

            if rb == 0:
                newchar = random.randrange(33,48)
            elif rb == 1:
                newchar = random.randrange(58,65)
            elif rb == 2:
                newchar = random.randrange(91,97)
            elif rb == 3:
                newchar = random.randrange(123,127)

            newstr += "%c"%(newchar)

        rc = random.randrange(0,2)
        if rc == 0:
            for y in range(0,rand()/2):
                randomstr += newstr
        else:
            randomstr += newstr + 'A' * rand()

    #String with chars from ASCII 1-255 (HTML encoded) like &#65;&#122;&#23;...
    elif rd == 3:
        newstr = ''
        randomstr = ''
        ra = random.randrange(0,20)
        for y in range(0,ra):
            rb = random.randrange(1,256)
            newstr += '&#' + str(rb) + ';'

        for y in range(0,rand()/2):
            randomstr += newstr

    #String with const char -c
    elif rd == 4:
        ra = rand()
        randomstr = args.c * ra

    return randomstr

#File Fuzz -f , -ft *
def filefuzz():

    for y in range(0,int(args.m)):

        filename = 'fuzz' + str(y) + '.' + args.e
        if args.ft != True:
            try:
                content = open(args.ft, 'r').read()
            except:
                print "Found no " + args.ft
                sys.exit(1)

            ra = random.randrange(0,len(content))
            content2 = content[:ra] + genstr(3) + content[ra:]
        else:
            content2 = genstr(3)

        FILE = open(args.o + '/' + filename,"w")
        FILE.write(content2)
        FILE.close()

        sys.stdout.flush()
        sys.stdout.write(("\rfuzz{0}." + args.e + " generated!").format(y))

#Browser Fuzzing -b *
def brow():

    for y in range(0,int(args.m)):
        try:
            content = open(args.b, 'r').read()
        except:
            print "Found no " + args.b
            sys.exit(1)

        #First File is fuzz0.html
        filename = 'fuzz' + str(y) + '.' + args.e
        fix = '<meta http-equiv="refresh" content="0.2; URL=fuzz' + str(y+1) + '.html">\n\n'

        ra = random.randrange(0,len(content))
        content2 = content[:ra] + genstr(4) + content[ra:]

        FILE = open(args.o + '/' + filename,"w")
        FILE.write(fix + content2)
        FILE.close()


        sys.stdout.flush()
        sys.stdout.write(("\rfuzz{0}." + args.e + " generated!").format(y))

#Connect to Target
def conn(sbuf, ind):

    vuln = (range(30))
    try:
        sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        connect=sock.connect((args.ip, int(args.port)))
        sock.send(sbuf)
        #print sock.recv(10000)
        sock.close()
        time.sleep(float(args.i))
        vuln[ind] = sbuf

    except socket.error:
        for i in range(0,30):
            FILE = open('crashlogs/crashlog' + str(i) +'.txt',"w") #Create Crashlogs
            FILE.write(str(vuln[i]))
            FILE.close()

        print '\n\nHas it crashed? If not, your intervall may be to low! 30 last request saved to crashlogs/\n'
        sys.exit(1)

#TCP Network Service/Port Fuzzing -n
def netf():

    j = 0
    l = 1
    o = 0
    while True:
        if j == 10:
            j = 0
        buffer = genstr(3)

        u = (['\\','|','/','-'])
        sys.stdout.flush()
        sys.stdout.write("\r[{1}] Sending request: {0}".format(l,u[o]))
        o += 1
        if o == 4:
            o = 0
        l += 1

        conn(buffer, j)

#Web Daemon Fuzzing -w
def httpf():

    #Config
    getfile = 'index.html'
    #####

    l = 1
    j = 0
    o = 0
    while True:

        if j == 10:
            j = 0

        #HTTP Methods
        method = (["GET /","POST /","TRACE /","PUT /","OPTION /","HEAD /"])

        #random string
        randomstr = genstr(4)

        #HTTP Version
        ver = ([" HTTP/0.9\r\n"," HTTP/1.0\r\n"," HTTP/1.1\r\n"," HTTP/2.0\r\n"])

        #Header
        header = (['Host: ' + str(args.ip) + ':' + str(args.port),'User-Agent: Mozilla','Accept: */*'])

        ra = random.randrange(0,6)
        rb = random.randrange(0,4)
        rc = random.randrange(0,4)

        if rc == 3:
            buffer = method[ra] + str(randomstr) + ver[rb]
        else:
            buffer = method[ra] + getfile + ver[rb]

        for v in range(0,3):
            if v != rc:
                buffer += header[v] + '\n'
            else:
                buffer += header[rc] + randomstr + '\n'

        buffer += '\r\n\r\n'

        u = (['\\','|','/','-'])
        sys.stdout.flush()
        sys.stdout.write("\r[{1}] Sending request: {0}".format(l,u[o]))
        o += 1
        if o == 4:
            o = 0
        l += 1

        conn(buffer, j)

#Piping to a Program -p
def printc():

    PROG = args.d
    for i in range(0,int(args.m)):
        randomstr = genstr(3)

        try:
            FILE = open('pipes/pipe' + str(i) + '.txt',"w")
            FILE.write(randomstr)
            FILE.close()
        except IOError:
            print "\nPlease create the folder pipes/\n"
            sys.exit(1)

        PFILE = "pipes/pipe" + str(i) + ".txt"
        cmd = "%s < %s" % (PROG , PFILE)
        print '\n' + cmd + '\n'
        os.system(cmd)
        time.sleep(float(args.i))

def main():

    parh()
    if(args.o != True):
        try:
            FILE = open(args.o + '/test.txt',"w")
            FILE.write("1")
            FILE.close()
        except IOError:
            print "\nPlease create the folder " + args.o + "\n"
            sys.exit(1)

    if(args.n == True or args.w == True):
        try:
            FILE = open('crashlogs/test.txt',"w")
            FILE.write("1")
            FILE.close()
        except IOError:
            print "\nPlease create the folder crashlogs/\n"
            sys.exit(1)

    try:
        if (args.m != True) and (args.o != True) and (args.b != True) and (args.e != True):
            print '\nBrowser fuzz!\n'
            brow()
            print '\n\nReady to fuzz!\n'

        elif (args.n == True) and (args.ip != True) and (args.port != True) and (args.i != True):
            print '\nNetwork fuzz running!\n\nFuzzing: ' + args.ip + ':' + args.port + '\n'
            netf()
            print '\n'

        elif ((args.f == True) or (args.ft != True)) and (args.m != True) and (args.e != True) and (args.o != True):
            print 'File fuzz!\n'
            filefuzz()
            print '\n\nReady to fuzz!\n'

        elif (args.ip != True) and (args.port != True) and (args.w == True) and (args.i != True):
            print '\nWeb daemon fuzz running!\n\nFuzzing: http://' + args.ip + ':' + args.port + '/\n'
            httpf()
            print '\n'

        elif (args.p == True) and (args.i != True) and (args.m != True) and (args.d != True):
            print "Piping it baby!\n"
            printc()
            print '\n'

        else:
            print 'Fail!'

    except KeyboardInterrupt:
        print '\n\nWTF? Why did you stop me?\n'

if __name__ == "__main__":
    main()