From 5504e423fe28e8dd3bdc7e647b63c2e732a1c65f Mon Sep 17 00:00:00 2001
From: evilsocket <evilsocket@gmail.com>
Date: Mon, 28 Jan 2019 17:06:27 +0100
Subject: [PATCH] new: new net.fuzz network fuzzer module

---
 modules/net_sniff.go      |  39 ++++++++++++
 modules/net_sniff_fuzz.go | 121 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 160 insertions(+)
 create mode 100644 modules/net_sniff_fuzz.go

diff --git a/modules/net_sniff.go b/modules/net_sniff.go
index 25f59633..e77e2bef 100644
--- a/modules/net_sniff.go
+++ b/modules/net_sniff.go
@@ -15,6 +15,12 @@ type Sniffer struct {
 	Stats         *SnifferStats
 	Ctx           *SnifferContext
 	pktSourceChan chan gopacket.Packet
+
+	fuzzActive bool
+	fuzzSilent bool
+	fuzzLayers []string
+	fuzzRate   float64
+	fuzzRatio  float64
 }
 
 func NewSniffer(s *session.Session) *Sniffer {
@@ -75,6 +81,35 @@ func NewSniffer(s *session.Session) *Sniffer {
 			return sniff.Stop()
 		}))
 
+	sniff.AddHandler(session.NewModuleHandler("net.fuzz on", "",
+		"Enable fuzzing for every sniffed packet containing the sapecified layers.",
+		func(args []string) error {
+			return sniff.StartFuzzing()
+		}))
+
+	sniff.AddHandler(session.NewModuleHandler("net.fuzz off", "",
+		"Disable fuzzing",
+		func(args []string) error {
+			return sniff.StopFuzzing()
+		}))
+
+	sniff.AddParam(session.NewStringParameter("net.fuzz.layers",
+		"Payload",
+		"",
+		"Types of layer to fuzz."))
+
+	sniff.AddParam(session.NewDecimalParameter("net.fuzz.rate",
+		"1.0",
+		"Rate in the [0.0,1.0] interval of packets to fuzz."))
+
+	sniff.AddParam(session.NewDecimalParameter("net.fuzz.ratio",
+		"0.4",
+		"Rate in the [0.0,1.0] interval of bytes to fuzz for each packet."))
+
+	sniff.AddParam(session.NewBoolParameter("net.fuzz.silent",
+		"false",
+		"If true it will not report fuzzed packets."))
+
 	return sniff
 }
 
@@ -149,6 +184,10 @@ func (s *Sniffer) Start() error {
 				s.Stats.NumLocal++
 			}
 
+			if s.fuzzActive {
+				s.doFuzzing(packet)
+			}
+
 			if s.Ctx.DumpLocal || !isLocal {
 				data := packet.Data()
 				if s.Ctx.Compiled == nil || s.Ctx.Compiled.Match(data) {
diff --git a/modules/net_sniff_fuzz.go b/modules/net_sniff_fuzz.go
new file mode 100644
index 00000000..6ec1444b
--- /dev/null
+++ b/modules/net_sniff_fuzz.go
@@ -0,0 +1,121 @@
+package modules
+
+import (
+	"math/rand"
+	"strings"
+
+	"github.com/google/gopacket"
+
+	"github.com/bettercap/bettercap/log"
+
+	"github.com/evilsocket/islazy/str"
+	"github.com/evilsocket/islazy/tui"
+)
+
+var mutators = []func(byte) byte{
+	func(b byte) byte {
+		return byte(rand.Intn(256) & 0xff)
+	},
+	func(b byte) byte {
+		return byte(b << uint(rand.Intn(5)))
+	},
+	func(b byte) byte {
+		return byte(b >> uint(rand.Intn(5)))
+	},
+}
+
+func (s *Sniffer) fuzz(data []byte) int {
+	changes := 0
+	for off, b := range data {
+		if rand.Float64() > s.fuzzRatio {
+			continue
+		}
+
+		data[off] = mutators[rand.Intn(len(mutators))](b)
+		changes++
+	}
+	return changes
+}
+
+func (s *Sniffer) doFuzzing(pkt gopacket.Packet) {
+	if rand.Float64() > s.fuzzRate {
+		return
+	}
+
+	layersChanged := 0
+	bytesChanged := 0
+
+	for _, fuzzLayerType := range s.fuzzLayers {
+		for _, layer := range pkt.Layers() {
+			if layer.LayerType().String() == fuzzLayerType {
+				fuzzData := layer.LayerContents()
+				changes := s.fuzz(fuzzData)
+				if changes > 0 {
+					layersChanged++
+					bytesChanged += changes
+				}
+
+			}
+		}
+	}
+
+	if bytesChanged > 0 {
+		if s.fuzzSilent {
+			log.Debug("[%s] changed %d bytes in %d layers.", tui.Green("net.fuzz"), bytesChanged, layersChanged)
+		} else {
+			log.Info("[%s] changed %d bytes in %d layers.", tui.Green("net.fuzz"), bytesChanged, layersChanged)
+		}
+		if err := s.Session.Queue.Send(pkt.Data()); err != nil {
+			log.Error("error sending fuzzed packet: %s", err)
+		}
+	}
+}
+
+func (s *Sniffer) configureFuzzing() (err error) {
+	layers := ""
+
+	if err, layers = s.StringParam("net.fuzz.layers"); err != nil {
+		return
+	} else {
+		s.fuzzLayers = str.Comma(layers)
+	}
+
+	if err, s.fuzzRate = s.DecParam("net.fuzz.rate"); err != nil {
+		return
+	}
+
+	if err, s.fuzzRatio = s.DecParam("net.fuzz.ratio"); err != nil {
+		return
+	}
+
+	if err, s.fuzzSilent = s.BoolParam("net.fuzz.silent"); err != nil {
+		return
+	}
+
+	return
+}
+
+func (s *Sniffer) StartFuzzing() error {
+	if s.fuzzActive {
+		return nil
+	}
+
+	if err := s.configureFuzzing(); err != nil {
+		return err
+	} else if !s.Running() {
+		if err := s.Start(); err != nil {
+			return err
+		}
+	}
+
+	s.fuzzActive = true
+
+	log.Info("[%s] active on layer types %s (rate:%f ratio:%f)", tui.Green("net.fuzz"), strings.Join(s.fuzzLayers, ","), s.fuzzRate, s.fuzzRatio)
+
+	return nil
+}
+
+func (s *Sniffer) StopFuzzing() error {
+	s.fuzzActive = false
+	return nil
+}