{"id":23419442,"url":"https://github.com/bannsec/autopwn","last_synced_at":"2025-04-12T12:44:34.837Z","repository":{"id":63958172,"uuid":"57429674","full_name":"bannsec/autoPwn","owner":"bannsec","description":"Automate repetitive tasks for fuzzing","archived":false,"fork":false,"pushed_at":"2021-07-26T18:30:43.000Z","size":2475,"stargazers_count":125,"open_issues_count":29,"forks_count":31,"subscribers_count":10,"default_branch":"master","last_synced_at":"2025-03-26T07:22:57.641Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/bannsec.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2016-04-30T06:11:13.000Z","updated_at":"2025-02-13T00:28:32.000Z","dependencies_parsed_at":"2022-11-30T04:01:11.263Z","dependency_job_id":null,"html_url":"https://github.com/bannsec/autoPwn","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bannsec%2FautoPwn","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bannsec%2FautoPwn/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bannsec%2FautoPwn/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bannsec%2FautoPwn/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/bannsec","download_url":"https://codeload.github.com/bannsec/autoPwn/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248570218,"owners_count":21126380,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-23T01:18:00.763Z","updated_at":"2025-04-12T12:44:34.816Z","avatar_url":"https://github.com/bannsec.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"![Daily Build Trigger](https://github.com/bannsec/autoPwn/workflows/Daily%20Build%20Trigger/badge.svg)\n\n# Warning\nCompletely re-writing this right now. Focus will be on interactive Linux apps that only take input from stdin for starters. Attempting to use Shellphish's Driller and Fuzzer functionality.\n\nautoPwn in it's current state will do this in limited form. Simply run `autoPwn ./binary` then select the Start option.\n\n# Installing\nGiven all the dependency issues here, the easiest way to get autoPwn up and running is to use the Docker build. Note, you can remove the --security-opt and --cap-add statement, but some fuzzing aspects might not work.\n\n```bash\n$ sudo docker pull bannsec/autoPwn\n$ sudo docker run -it -v $PWD:/mount --security-opt=\"apparmor=unconfined\" --cap-add=SYS_PTRACE -e DISPLAY=$DISPLAY -v /tmp/.X11-unix/:/tmp/.X11-unix/ bannsec/autopwn\n```\n\nIn the Docker build, everything should be ready to go. You can simply start up the tool with:\n\n```bash\n$ autoPwn ./file\n```\n\n# Compiling source for fuzzing\nautoPwn attempts to make compiling source for fuzzing a project easier. To help with this, `autoPwnCompile` was created. Just point it at your source code, and give it options and it will output an executable ready to be fuzzed.\n\n```\nusage: autoPwnCompile [-h] [--file FILE] [--ASAN | --MSAN] [--UBSAN]\n                      [--fuzzer FUZZER]\n\nCompile source to binaries for use in autoPwn.\n\noptional arguments:\n  -h, --help       show this help message and exit\n  --file FILE      Single file to compile.\n  --ASAN           Enable ASAN (default off)\n  --MSAN           Enable MSAN (default off)\n  --UBSAN          Enable UBSAN (default off)\n  --fuzzer FUZZER  (optional) What fuzzer to compile for. Options are:\n                   ['AFL']. Default is AFL.\n```\n\nThe below is from the OLD version of autoPwn..\n\n# Overview\nautoPwn is a lofty name for a simple script. When working with fuzzing and afl-fuzz, I noticed that I would do the same tasks over and over. With this in mind, I wanted to create a script that would accomplish the following:\n\n\n1. Automate and simplify the task of starting the fuzzer through smart prompts\n2. Automate and simplify the task of restarting the fuzzer through a config file\n3. Fully automate the process of afl queue minimizations\n4. Fully automate the process of extracting and minimizing all possible exploitable paths\n5. Fully automate the process of extracting and minimizing all possible paths in general.\n6. Fully or partially automate the generation of initial path values.\n\n\nSo far, the script is able to the first 5. Part 6 is speculative and attempting development right now. It would leverage the angr symbolic execution engine to create possible initial paths. At that point, the script could theoretically fully automate *simple* fuzzing tasks.\n\n# Example\nLet's take a look at a recent TUCTF challenge called \"WoO2\". While it doesn't necessarily find the needed exploit, it does show how autoPwn can be used to simplify path discovery.\n\nHere's a basic run through the program:\n\n```text\n$ ./e67eb287f23011a40ef5bd5c2ad2f48ca97834cf \nWelcome! I don't think we're in Kansas anymore.\nWe're about to head off on an adventure!\nSelect some animals you want to bring along.\n\nMenu Options:\n1: Bring a lion\n2: Bring a tiger\n3: Bring a bear\n4: Delete Animal\n5: Exit\n\nEnter your choice:\n1\nChoose the type of lion you want:\n1: Congo Lion\n2: Barbary Lion\n1\nEnter name of lion:\nTest\nMenu Options:\n1: Bring a lion\n2: Bring a tiger\n3: Bring a bear\n4: Delete Animal\n5: Exit\n\nEnter your choice:\n5\n```\n\nLet's create a simple input test case:\n\n```text\n$ cat in/1 \n1\n1\nTest\n5\n```\n\nNow we can easily start up the fuzzer:\n\n```text\n$ autoPwn \nSetting up fuzz configuration\nTarget Binary (full or relative path): e67eb287f23011a40ef5bd5c2ad2f48ca97834cf\nCommand line args: \nNumber of cores (default: 8): \nTest Case Dir (default: 'in/'): \nTest Case Dir (default: 'out/'): \nMax memory (default: 200): 4096\nStarting fuzz\nautoPwn\u003e s\nstatus check tool for afl-fuzz by \u003clcamtuf@google.com\u003e\n\nIndividual fuzzers\n==================\n\n\u003e\u003e\u003e SESSION007 (0 days, 0 hrs) \u003c\u003c\u003c\n\n  cycle 1, lifetime speed 1 execs/sec, path 0/1 (0%)\n  pending 1/1, coverage 0.15%, no crashes yet\n\n\u003e\u003e\u003e SESSION000 (0 days, 0 hrs) \u003c\u003c\u003c\n\n  cycle 1, lifetime speed 1 execs/sec, path 0/1 (0%)\n  pending 1/1, coverage 0.15%, no crashes yet\n\n\u003e\u003e\u003e SESSION002 (0 days, 0 hrs) \u003c\u003c\u003c\n\n  cycle 1, lifetime speed 1 execs/sec, path 0/1 (0%)\n  pending 1/1, coverage 0.15%, no crashes yet\n\n\u003e\u003e\u003e SESSION006 (0 days, 0 hrs) \u003c\u003c\u003c\n\n  cycle 1, lifetime speed 1 execs/sec, path 0/1 (0%)\n  pending 1/1, coverage 0.15%, no crashes yet\n\n\u003e\u003e\u003e SESSION004 (0 days, 0 hrs) \u003c\u003c\u003c\n\n  cycle 1, lifetime speed 1 execs/sec, path 0/1 (0%)\n  pending 1/1, coverage 0.15%, no crashes yet\n\n\u003e\u003e\u003e SESSION001 (0 days, 0 hrs) \u003c\u003c\u003c\n\n  cycle 1, lifetime speed 1 execs/sec, path 0/1 (0%)\n  pending 1/1, coverage 0.15%, no crashes yet\n\n\u003e\u003e\u003e SESSION005 (0 days, 0 hrs) \u003c\u003c\u003c\n\n  cycle 1, lifetime speed 1 execs/sec, path 0/1 (0%)\n  pending 1/1, coverage 0.15%, no crashes yet\n\n\u003e\u003e\u003e SESSION003 (0 days, 0 hrs) \u003c\u003c\u003c\n\n  cycle 1, lifetime speed 1 execs/sec, path 0/1 (0%)\n  pending 1/1, coverage 0.15%, no crashes yet\n\nSummary stats\n=============\n\n       Fuzzers alive : 8\n      Total run time : 0 days, 0 hours\n         Total execs : 0 million\n    Cumulative speed : 8 execs/sec\n       Pending paths : 8 faves, 8 total\n  Pending per fuzzer : 1 faves, 1 total (on average)\n       Crashes found : 0 locally unique\n\n\nautoPwn\u003e h\nautoPwn\n     s == fuzzer (s)tatus\n     e == collect (e)xploits\n     a == collect (a)ll paths\n     m == (m)inimize corpus\n     q == (q)uit\n```\n\nSo what happened here was that the script created some default values (including determining the number of cores available). We changed one default value due to needing extra memory to run this in QEMU. autoPwn created a config file that it then gave to afl-utils (https://github.com/rc0r/afl-utils). In the config file, it also set up CPU affinities, so the fuzzing would be default optimal.\n\nAt this point, your computer is chucking away at fuzzing. However, one key aspect of fuzzing is minimizing the corpus. With this in mind, autoPwn is watching the afl-fuzz instance to monitor for when a series of the mutations are completed. When this happens, it will stop fuzzing (non-optimal, but fine for now), minimize the corpus, then re-start fuzzing. It does this without any human intervention so you can fire and forget.\n\nAt some point you might want to take a look at what paths afl has found. By executing the \"a\" command, autoPwn will copy all the known paths, minimize the corpus and then minimize the cases themselves and provide them in an output directory.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbannsec%2Fautopwn","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbannsec%2Fautopwn","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbannsec%2Fautopwn/lists"}