This challenge gave parts of the points as soon as you find a crash in the binary, which was a forking network service. With a short LD_PRELOAD library, you can bypass all the networking code and fuzz the handler function directly with afl using the qemu mode.
The basic steps:
- find a libc function that gets called after all initialization is done and overwrite it. Alternatively: define a constructor and do the initialization yourself
- for position-independent executables, find the load address with dl_iterate_phdr
- call whatever function you want to fuzz in the binary
- run afl with -Q and AFL_PRELOAD