搭建shellphish-fuzzer环境，用于python调用AFL
环境：Docker—ubuntu18.04
python版本：3.6.9

注：由于个人网络问题，github源使用的https://github.com.cnpmjs.org

apt-get update && \
    apt-get upgrade -y && \
    apt-get autoremove -y && \
    apt-get install -y \
        curl \
        gdb \
        wget \
        git \
        vim

换源：

vim /etc/apt/sources.list

deb http://mirrors.aliyun.com/ubuntu/ bionic main restricted universe multiverse
deb-src http://mirrors.aliyun.com/ubuntu/ bionic main restricted universe multiverse
deb http://mirrors.aliyun.com/ubuntu/ bionic-security main restricted universe multiverse
deb-src http://mirrors.aliyun.com/ubuntu/ bionic-security main restricted universe multiverse
deb http://mirrors.aliyun.com/ubuntu/ bionic-updates main restricted universe multiverse
deb-src http://mirrors.aliyun.com/ubuntu/ bionic-updates main restricted universe multiverse
deb http://mirrors.aliyun.com/ubuntu/ bionic-backports main restricted universe multiverse
deb-src http://mirrors.aliyun.com/ubuntu/ bionic-backports main restricted universe multiverse
deb http://mirrors.aliyun.com/ubuntu/ bionic-proposed main restricted universe multiverse
deb-src http://mirrors.aliyun.com/ubuntu/ bionic-proposed main restricted universe multiverse

shellphish-fuzzer的安装：

apt-get install build-essential gcc-multilib libtool automake autoconf bison debootstrap debian-archive-keyring libtool-bin

apt-get build-dep qemu

由于没有pip，先安装pip3：

apt-get install python3-pip

安装angr

pip3 install angr

安装driller

pip3 install git+https://github.com.cnpmjs.org/angr/tracer

pip3 install git+https://github.com.cnpmjs.org/shellphish/driller

安装afl（可选）

mkdir afl-latest
cd afl-latest
wget http://lcamtuf.coredump.cx/afl/releases/afl-latest.tgz
tar xf afl-latest.tgz
cd afl-2.52b
make
cd qemu_mode
wget -O patches/memfd.diff https://salsa.debian.org/qemu-team/qemu/raw/ubuntu-bionic-2.11/debian/patches/ubuntu/lp1753826-memfd-fix-configure-test.patch
sed -i '/syscall.diff/a patch -p1 <../patches/memfd.diff || exit 1' build_qemu_support.sh
./build_qemu_support.sh

安装shellphish-afl

pip3 install git+https://github.com.cnpmjs.org/shellphish/shellphish-afl

但我使用这种方法会报错

于是我选择clone下来，执行setup.py

git clone[https://github.com.cnpmjs.org/shellphish/shellphish-afl.git](https://github.com.cnpmjs.org/shellphish/shellphish-afl.git)

cd shellphish-afl/

python3 [setup.py](http://setup.py/) install

安装fuzzer

pip3 install git+https://github.com.cnpmjs.org/shellphish/fuzzer

测试：

shellphuzz --help

参考链接：

https://github.com/shellphish/fuzzer

https://github.com/shellphish/shellphish-afl

https://blog.grimm-co.com/2020/05/guided-fuzzing-with-driller.html

附Dockerfile：

Dockerfile