mqtt,aflnet实验，环境ubuntu

前面如此多问题时因为clone错了仓库而导致的，还有刚开始使用，许多东西不熟。

1

 git clone https://github.com/SuhithaG/MQTT-fuzzing-using-AFLNET.git aflnet_mqtt
Cloning into 'aflnet_mqtt'...
remote: Enumerating objects: 4591, done.
remote: Counting objects: 100% (4591/4591), done.
remote: Compressing objects: 100% (2647/2647), done.
remote: Total 4591 (delta 1473), reused 4543 (delta 1454), pack-reused 0 (from 0)
Receiving objects: 100% (4591/4591), 8.09 MiB | 8.61 MiB/s, done.
Resolving deltas: 100% (1473/1473), done.

2

root@09bc6312e440:~/aflnet_mqtt# cd aflnet-master_mqtt/
root@09bc6312e440:~/aflnet_mqtt/aflnet-master_mqtt# ls
CONTRIBUTING.md  afl-analyze.c  afl-gcc.c      afl-tmin.c       alloc-inl.h       docs          libdislocator  test-libfuzzer-target.c
LICENSE          afl-as.c       afl-gotcpu.c   afl-whatsup      android-ashmem.h  experimental  libtokencap    testcases
Makefile         afl-as.h       afl-plot       aflnet-replay.c  config.h          hash.h        llvm_mode      tutorials

3.

make clean all

4

cd llvm_mode

5        make

6

root@09bc6312e440:~/aflnet_mqtt/aflnet-master_mqtt/llvm_mode# cd ../..
root@09bc6312e440:~/aflnet_mqtt# ls
CSE543_project3_m2_report.pdf  README.md  Results  aflnet-master_mqtt  buggy_mosquitto  mosquitto-1.5.5
root@09bc6312e440:~/aflnet_mqtt# cd ..
root@09bc6312e440:~# ls
aflnet_mqtt  live555
root@09bc6312e440:~# cd ..
root@09bc6312e440:/# ls
bin  boot  dev  etc  home  lib  lib32  lib64  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var
root@09bc6312e440:/# cd opt
root@09bc6312e440:/opt# ls
aflnet
root@09bc6312e440:/opt# cd aflnet
root@09bc6312e440:/opt/aflnet# ls
CONTRIBUTING.md  afl-as.c          afl-g++           afl-replay       aflnet.c          docs           test-instr.c
Dockerfile       afl-as.h          afl-gcc           afl-replay.c     aflnet.h          experimental   test-libfuzzer-target.c
LICENSE          afl-clang         afl-gcc.c         afl-showmap      aflnet.o          hash.h         testcases
Makefile         afl-clang++       afl-gotcpu        afl-showmap.c    alloc-inl.h       khash.h        tutorials
README-AFL.md    afl-clang-fast    afl-gotcpu.c      afl-tmin         android-ashmem.h  klist.h        types.h
README.md        afl-clang-fast++  afl-llvm-pass.so  afl-tmin.c       as                libdislocator
afl-analyze      afl-cmin          afl-llvm-rt-64.o  afl-whatsup      config.h          libtokencap
afl-analyze.c    afl-fuzz          afl-llvm-rt.o     aflnet-replay    debug.h           llvm_mode
afl-as           afl-fuzz.c        afl-plot          aflnet-replay.c  dictionaries      qemu_mode
root@09bc6312e440:/opt/aflnet# cd ..
root@09bc6312e440:/opt# export AFLNET=$(pwd)/aflnet
root@09bc6312e440:/opt# cd AFLNET
bash: cd: AFLNET: No such file or directory
root@09bc6312e440:/opt# cd $AFLNET
root@09bc6312e440:/opt/aflnet# cd ..
root@09bc6312e440:/opt# export WORKDIR=$(pwd)
root@09bc6312e440:/opt# export PATH=$PATH:$AFLNET
root@09bc6312e440:/opt# export AFL_PATH=$AFLNET
root@09bc6312e440:/opt#

7时间久

root@09bc6312e440:~/aflnet_mqtt# git clone https://github.com/eclipse/mosquitto/tree/v1.5.5 mqtt_broker
Cloning into 'mqtt_broker'...
fatal: repository 'https://github.com/eclipse/mosquitto/tree/v1.5.5/' not found
root@09bc6312e440:~/aflnet_mqtt# git clone https://github.com/eclipse/mosquitto.git mqtt_broker
Cloning into 'mqtt_broker'...
remote: Enumerating objects: 37842, done.
remote: Counting objects: 100% (3818/3818), done.
remote: Compressing objects: 100% (1162/1162), done.
remote: Total 37842 (delta 2825), reused 3460 (delta 2652), pack-reused 34024 (from 1)
Receiving objects: 100% (37842/37842), 14.54 MiB | 13.79 MiB/s, done.
Resolving deltas: 100% (29391/29391), done.

8

root@09bc6312e440:~/aflnet_mqtt# git clone https://github.com/SuhithaG/CSE543-Project3/tree/main/buggy_mosquitto buggy_mosquitto
fatal: destination path 'buggy_mosquitto' already exists and is not an empty directory.
root@09bc6312e440:~/aflnet_mqtt# git clone https://github.com/SuhithaG/MQTT-fuzzing-using-AFLNET.git buggy_mosquitto
fatal: destination path 'buggy_mosquitto' already exists and is not an empty directory.
root@09bc6312e440:~/aflnet_mqtt# ls
CSE543_project3_m2_report.pdf  README.md  Results  aflnet-master_mqtt  buggy_mosquitto  mosquitto-1.5.5  mqtt_broker
root@09bc6312e440:~/aflnet_mqtt#

9

sudo apt-get update
sudo apt-get install libssl-dev

root@09bc6312e440:~/aflnet_mqtt/mqtt_broker# sudo apt-get install dialog
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
  dialog
0 upgraded, 1 newly installed, 0 to remove and 1 not upgraded.
Need to get 217 kB of archives.
After this operation, 1149 kB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu bionic/universe amd64 dialog amd64 1.3-20171209-1 [217 kB]
Fetched 217 kB in 2s (143 kB/s)
debconf: unable to initialize frontend: Dialog
debconf: (No usable dialog-like program is installed, so the dialog based frontend cannot be used. at /usr/share/perl5/Debconf/FrontEnd/Dialog.pm line 76, <> line 1.)
debconf: falling back to frontend: Readline
Selecting previously unselected package dialog.
(Reading database ... 33873 files and directories currently installed.)
Preparing to unpack .../dialog_1.3-20171209-1_amd64.deb ...
Unpacking dialog (1.3-20171209-1) ...
Setting up dialog (1.3-20171209-1) ...
root@09bc6312e440:~/aflnet_mqtt/mqtt_broker# dpkg -l | grep libssl-dev
ii  libssl-dev:amd64           1.1.1-1ubuntu2.1~18.04.23           amd64        Secure Sockets Layer toolkit - development files
root@09bc6312e440:~/aflnet_mqtt/mqtt_broker# apt-get install libssl-dev
Reading package lists... Done
Building dependency tree
Reading state information... Done
libssl-dev is already the newest version (1.1.1-1ubuntu2.1~18.04.23).
0 upgraded, 0 newly installed, 0 to remove and 1 not upgraded.

10

你可以通过以下命令查找相关的开发包：

apt-cache search cjson

sudo apt-get update
sudo apt-get install libcjson-dev

root@09bc6312e440:~/aflnet_mqtt/mqtt_broker# apt-cache search cjson
lua-cjson - JSON parser/encoder for Lua
lua-cjson-dev - JSON parser/encoder for Lua, development files
lua-trink-cjson - JSON parser/encoder for Luasandbox
lua-trink-cjson-dev - JSON parser/encoder for Luasandbox, development files
node-cjson - commented JavaScript Object Notation
python-cjson - Very fast JSON encoder/decoder for Python
python-cjson-dbg - Very fast JSON encoder/decoder for Python (debug extension)
root@09bc6312e440:~/aflnet_mqtt/mqtt_broker# sudo apt-get install libcjson-dev
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Unable to locate package libcjson-dev
root@09bc6312e440:~/aflnet_mqtt/mqtt_broker# apt install lua-cjson
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:

解决

# 下载 cJSON 源代码
git clone https://github.com/DaveGamble/cJSON.git
cd cJSON

# 创建构建目录并编译
mkdir build
cd build
cmake ..
make
sudo make install

问题

sudo apt-get update

sudo apt-get install libcunit1-dev

find / -name CUnit.h
 

CFLAGS = -I/usr/include/CUnit

问题

sudo apt update

sudo apt install python3

which python3

问题...

问题

sudo apt-get remove --purge mosquitto

sudo apt-get install mosquitto

如果系统提示 systemctl: command not found，可能是因为你使用的是不支持 systemctl 的系统，比如某些较旧的 Ubuntu 版本或其他 Linux 发行版。你可以尝试使用 service 命令来启动 Mosquitto：

sudo service mosquitto start

切到b目录问题：

解决

sudo apt-get update
sudo apt-get install libwebsockets-dev

find / -name libwebsockets.h

假设你找到的头文件路径是 /usr/include/libwebsockets.h，通常这是因为库文件在 /usr/include 下。你需要将包含路径添加到编译器的命令行中。

如果你有权限修改 Makefile，可以直接在其中添加包含路径。在 Makefile 中，找到编译器的命令行部分，并添加 -I/usr/include 选项。例如：

CFLAGS += -I/usr/include

问题

解决：

sudo apt-get update
sudo apt-get install uuid-dev

类似上次问题

问题

解决；

sudo apt-get update
sudo apt-get install xsltproc

问题：

解决

sudo apt-get install docbook-xsl

再次插桩

root@09bc6312e440:~/aflnet_mqtt/buggy_mosquitto# make CC=afl-gcc CXX=afl-g++
set -e; for d in lib client src; do make -C ${d}; done
make[1]: Entering directory '/root/aflnet_mqtt/buggy_mosquitto/lib'
make -C cpp
make[2]: Entering directory '/root/aflnet_mqtt/buggy_mosquitto/lib/cpp'
make[2]: Nothing to be done for 'all'.
make[2]: Leaving directory '/root/aflnet_mqtt/buggy_mosquitto/lib/cpp'
make[1]: Leaving directory '/root/aflnet_mqtt/buggy_mosquitto/lib'
make[1]: Entering directory '/root/aflnet_mqtt/buggy_mosquitto/client'
make[1]: Nothing to be done for 'all'.
make[1]: Leaving directory '/root/aflnet_mqtt/buggy_mosquitto/client'
make[1]: Entering directory '/root/aflnet_mqtt/buggy_mosquitto/src'
make[1]: Nothing to be done for 'all'.
make[1]: Leaving directory '/root/aflnet_mqtt/buggy_mosquitto/src'
set -e; for d in man; do make -C ${d}; done
make[1]: Entering directory '/root/aflnet_mqtt/buggy_mosquitto/man'
xsltproc mosquitto.8.xml
xsltproc mosquitto-tls.7.xml
xsltproc mosquitto.conf.5.xml
xsltproc mosquitto_passwd.1.xml
xsltproc mosquitto_pub.1.xml
xsltproc mosquitto_sub.1.xml
xsltproc mqtt.7.xml
xsltproc libmosquitto.3.xml
make[1]: Leaving directory '/root/aflnet_mqtt/buggy_mosquitto/man'

从make 输出看，构建过程顺利完成，并且没有出现错误消息

a)

看起来你的系统中找不到 libcjson1 和 libcjson-dev 包。这个问题可能是因为这些包名不正确或在你的发行版仓库中不可用。cJSON 库通常在大多数 Linux 发行版的官方仓库中不提供，而是需要从源代码编译或使用其他方法安装。

解决方案

1. 从源代码安装 cJSON

你可以从 cJSON 的 GitHub 仓库下载源代码并进行编译和安装。以下是具体步骤：

# 克隆 cJSON 仓库

git clone https://github.com/DaveGamble/cJSON.git

# 进入 cJSON 目录

cd cJSON

# 创建构建目录并进入

mkdir build cd build

# 运行 CMake 配置

cmake ..

# 编译

make

# 安装

sudo make install

2. 安装其他依赖

你可以继续使用 apt 安装其他依赖包：

sudo apt update sudo apt install libssl-dev docbook-xsl docbook xsltproc

确保 cJSON 正确安装

安装完成后，更新库缓存：

sudo ldconfig

然后，你可以在你的 Makefile 或项目中指定 cJSON 库的路径。例如，添加以下选项来链接 cJSON 库：

CFLAGS += -I/usr/local/include LDFLAGS += -L/usr/local/lib -lcjson

b）命令，

dpkg -l | grep mosquitto
ii  libmosquitto1:amd64        1.4.15-2ubuntu0.18.04.3             amd64        MQTT version 3.1/3.1.1 client library
ii  mosquitto-clients          1.4.15-2ubuntu0.18.04.3             amd64        Mosquitto command line MQTT clients

c)启动并查看状态

root@22ce9139edc3:/opt# sudo service mosquitto start
 * Starting network daemon: mosquitto                                                                                    [ OK ]
root@22ce9139edc3:/opt# service mosquitto status
 * mosquitto is running
root@22ce9139edc3:/opt#

d）

 tail -f /var/log/mosquitto/mosquitto.log
1724038069: mosquitto version 1.4.15 (build date Tue, 18 Jun 2019 11:42:22 -0300) starting
1724038069: Config loaded from /etc/mosquitto/mosquitto.conf.
1724038069: Opening ipv4 listen socket on port 1883.
1724038069: Opening ipv6 listen socket on port 1883.
1724038099: New connection from 127.0.0.1 on port 1883.
1724038099: New client connected from 127.0.0.1 as mosqsub|2828-22ce9139ed (c1, k60).
1724038102: Socket error on client mosqsub|2828-22ce9139ed, disconnecting.
1724038103: New connection from 127.0.0.1 on port 1883.
1724038103: New client connected from 127.0.0.1 as mosqsub|2829-22ce9139ed (c1, k60).
1724038127: Socket error on client mosqsub|2829-22ce9139ed, disconnecting.

e)

法

环境变量设置：确保在编译之前设置了 AFL 的相关环境变量

export AFL_USE_ASAN=1
export AFL_USE_LLVM=1

复制前

复制后

docker复制文件

先将windows桌面文件拖到远程连接软件中，然后执行以下操作

yl@shy-Super-Server:~$ sudo pwd
/home/yl
yl@shy-Super-Server:~$ sudo docker cp /home/yl/afl-fuzz.c aflnetyl:/opt
Successfully copied 260kB to aflnetyl:/opt
yl@shy-Super-Server:~$

安装afl问题

afl-fuzz测试

问题原因，复制命令错了，最后目录出错

使用 timeout 限制时间

你可以在命令前添加 timeout 命令，指定 24 小时的超时时间（以秒为单位，即 86400 秒），如下所示：

timeout 86400 afl-fuzz -d -i $AFLNET/tutorials/mosquitto/in-mqtt -o ./out-mqtt -m none -N tcp://127.0.0.1/1883 -P MQTT -D 10000 -q 3 -s 3 -E -K -R ./src/mosquitto

解释

• timeout 86400：这个命令会让 afl-fuzz 在 86400 秒（即 24 小时）后自动停止。

这样，你就可以确保 afl-fuzz 在指定的时间内运行，达到你想要的测试时间限制。

 跳过 CPU 频率缩放检查

如果你不想更改系统的 CPU 频率缩放设置，你可以通过设置环境变量 AFL_SKIP_CPUFREQ 来跳过这个检查

export AFL_SKIP_CPUFREQ=1
afl-fuzz -d -i /opt/aflnet/tutorials/mosquitto/in-mqtt -o ./out-mqtt -m none -N tcp://127.0.0.1/1883 -P MQTT -D 10000 -q 3 -s 3 -E -K -R ./src/mosquit

搭建环境

克隆aflnet仓库后，

进入目录，

make

make 是一个自动化构建工具，主要用于管理和自动化编译程序的过程。它通过读取一个叫做 Makefile 的文件来确定如何编译和链接程序。以下是 make 的主要作用和使用方式：

1. 自动化构建：make 主要用于编译源代码并生成可执行文件。它可以自动化管理编译依赖关系，避免手动重新编译不必要的文件。

2. 依赖管理：make 通过定义目标（如可执行文件）及其依赖关系（如源文件和头文件），确保只有在源文件或头文件发生更改时才重新编译。

3. 规则和命令：在 Makefile 中定义规则和命令，make 会根据这些规则和命令自动执行构建步骤。