Heartbleed in 5 minutes

If you haven't set up your account yet, we recommend you check out the Find your first bug tutorials - they're really quick, and they'll help you get started!
Step 1: Get the code
First, clone the tutorial code to your machine:
1
git clone https://github.com/fuzzbuzz/heartbleed-tutorial.git
Copied!
Step 2: Code Review
The repository contains a fuzzbuzz.yaml file, which is how Fuzzbuzz is configured, along with a C++ file, the OpenSSL source, and a build.sh file. This section will quickly walk you through all of these files.
target.cc
This file contains FuzzerEntrypoint, the method that Fuzzbuzz will run repeatedly with the tests it generates. This method attempts to make the OpenSSL handshake with the Data provided.
target.cc
1
#include <openssl/ssl.h>
2
#include <openssl/err.h>
3
#include <assert.h>
4
#include <stdint.h>
5
#include <stddef.h>
6
​
7
SSL_CTX *Init() {
8
  SSL_library_init();
9
  SSL_load_error_strings();
10
  ERR_load_BIO_strings();
11
  OpenSSL_add_all_algorithms();
12
  SSL_CTX *sctx;
13
  assert (sctx = SSL_CTX_new(TLSv1_method()));
14
  /* These two file were created with this command:
15
      openssl req -x509 -newkey rsa:512 -keyout server.key \
16
     -out server.pem -days 9999 -nodes -subj /CN=a/
17
  */
18
  assert(SSL_CTX_use_certificate_file(sctx, "runtime/server.pem",
19
                                      SSL_FILETYPE_PEM));
20
  assert(SSL_CTX_use_PrivateKey_file(sctx, "runtime/server.key",
21
                                     SSL_FILETYPE_PEM));
22
  return sctx;
23
}
24
​
25
extern "C" int FuzzerEntrypoint(const uint8_t *Data, size_t Size) {
26
  static SSL_CTX *sctx = Init();
27
  SSL *server = SSL_new(sctx);
28
  BIO *sinbio = BIO_new(BIO_s_mem());
29
  BIO *soutbio = BIO_new(BIO_s_mem());
30
  SSL_set_bio(server, sinbio, soutbio);
31
  SSL_set_accept_state(server);
32
  BIO_write(sinbio, Data, Size);
33
  SSL_do_handshake(server);
34
  SSL_free(server);
35
  return 0;
36
}
Copied!
build.sh
This file contains the build steps for the target, and is an example of how to test a library. The first step builds OpenSSL for fuzzing by injecting the compiler (FUZZ_CC) and CFLAGS that Fuzzbuzz provides. Then, it links target.cc to the OpenSSL libraries we just built, and to the FUZZ_ENGINE Fuzzbuzz provides.
harness.cpp
1
#!/bin/bash
2
# Copyright 2016 Google Inc. All Rights Reserved.
3
# Licensed under the Apache License, Version 2.0 (the "License");
4
​
5
set -x
6
set -e
7
set -o pipefail
8
​
9
cd openssl_src && CC="$FUZZ_CC $CFLAGS" ./config && make clean && make
10
cd ..
11
$FUZZ_CXX $CXXFLAGS ./target.cc -DCERT_PATH=\"$PWD/runtime\"  openssl_src/libssl.a openssl_src/libcrypto.a $FUZZ_ENGINE -I openssl_src/include -o ./target
Copied!
fuzzbuzz.yaml
This is how you provide your configuration to Fuzzbuzz. It allows you to install any dependencies, tells Fuzzbuzz what parts of your code to test, and allows you to configure more advanced constraints to make your code more efficient.
fuzzbuzz.yaml
1
base: ubuntu:16.04
2
language: c++
3
setup:
4
  - sudo chmod 775 ./build.sh
5
  - sudo apt-get -y install git make
6
  - ./build.sh
7
targets:
8
  - name: heartbleed
9
    harness:
10
      binary: ./target
11
    sanitizers:
12
      address: detect_stack_use_after_return=1
Copied!
This fuzzbuzz.yaml is very basic. It defines the base operating system to build and fuzz code in, and has configuration for a target named heartbleed. Every target has a corresponding method or binary that it represents.
The target configuration defines the language and version to use, as well as the method to test, where to find and import it, and the initial test corpus. You can learn more about other configuration options by reading the Target Documentation page.
Step 3: Set up your project
Before moving on, make sure that you've set up your project and CLI as described here.
We'll use the Fuzzbuzz CLI to deploy code directly, rather than pulling from a GitHub repository.
To make sure everything is working, run this command from the tutorial directory:
1
fuzzbuzz validate
Copied!
You should see that Fuzzbuzz reads the fuzzbuzz.yaml and detects the one target we have, called "heartbleed". Finally, you can run:
1
fuzzbuzz project create
Copied!
Choose Zip File, give your project a Name and Description, and then wait as the tutorial project is bundled up and deployed to Fuzzbuzz. If you head to https://app.fuzzbuzz.io, you should see your new project waiting for you in the sidebar.After creating your project, your dashboard should look something like this.
Step 4: Fuzz OpenSSL & find Heartbleed!
Give the heartbleed target 1 CPU to fuzz on, and press "Save Changes".
A few minutes after the target begins fuzzing, you should see an entry pop up in the list of bugs. Congratulations - you've just found Heartbleed with Fuzzbuzz!

Fixing Bugs

Next - Developer Documentation

Basics

Last modified 2yr ago

Copy link

Contents

Step 3: Set up your project

Step 4: Fuzz OpenSSL & find Heartbleed!