blob: 5af9a16d0cee426bbcaa9cd38c0e71cdae65c219 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
|
#!/bin/sh
set -e
# RUNTYPE=1
SCRIPTPATH="$(dirname $(readlink -f "$0"))"
cd "$SCRIPTPATH"
export RESULTDIR="../data/scans"
export ECHO_INPUT=1
announce() {
count=$(echo "$1" | wc -c)
python3 -c "
import math
s = '$1'
c = 80
print()
print('#'*c)
print('#' + ' '*math.floor((c - len(s))/2-1) + s + ' '*math.ceil((c - len(s))/2-1) + '#')
print('#'*c)
print()
"
}
checkleaks() {
valgrind --leak-check=full ./stldoctor 2>&1 | tee /tmp/testlog
if [ -z "$(grep "no leaks are possible" /tmp/testlog)" ]; then
echo "Valgrind exited with errors!"
exit 1
fi
}
connect() {
if [ "$RUNTYPE" == "remote" ]; then
nc localhost 9000
elif [ "$RUNTYPE" == "debug" ]; then
checkleaks
else
./stldoctor
fi
}
if [ "$1" == "stl" ]; then
announce "Testing ASCII STL Parsing"
(
echo "submit"
cat tests/sample-ascii.stl | wc -c
cat tests/sample-ascii.stl
) | checkleaks
announce "Testing BIN STL Parsing"
(
echo "submit"
cat tests/sample-binary.stl | wc -c
cat tests/sample-binary.stl
echo "testname"
) | checkleaks
elif [ "$1" == "poc" ]; then
announce "Testing Proof-Of-Concept"
[ ! -z "$RESULTDIR" ] && rm -rf "$RESULTDIR"/*
echo -e "\n--- Uploading target STL ---\n" 1>&2
(
echo "echo"
echo "submit"
cat tests/flag1.stl | wc -c
cat tests/flag1.stl
echo "N0TaFL4G"
echo "exit"
) | connect
echo -e "\n--- Uploading evil STL ---\n" 1>&2
(
echo "echo"
echo "submit"
cat tests/evil1.stl | wc -c
cat tests/evil1.stl
echo "EV1L"
echo "exit"
) | connect
echo -e "\n--- Testing Exploit ---\n" 1>&2
(
echo "echo"
# try index 0
echo "query"
echo "EV1L"
echo "0"
echo "n"
echo "query last"
echo "0"
echo "n"
# try index 1
echo "query"
echo -e "EV1L"
echo "0"
echo "n"
echo "query last"
echo "1"
echo "n"
echo "exit"
) | connect
else
connect
fi
|
