0x02 : Sample Vulnerabilty :-
This is a fairly easy
daemon[5] to exploit, it is taken from HITBcon's CTF and modified slightly just to
make it easier for people that are wanting to try this themself.
Code:
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <sys/socket.h>
#include <resolv.h>
#include <arpa/inet.h>
#include <errno.h>
#include <string.h>
#include <unistd.h>
#define MAXBUF 5000
#define TESTBUF 1000
size_t flen;
int pr( char *str)
{
char buf[2000];
strcpy(buf,str);
return 0;
}
int main(int argc, char **argv)
{
int sockfd;
int clientfd;
struct sockaddr_in self;
char buffer[MAXBUF];
u_short MY_PORT;
if (argc < 2)
{
MY_PORT = 7500;
printf("starting on default port 7500\n");
}
else if (argc == 2)
{
MY_PORT= atoi(argv[1]);
printf("Starting service on port %d\n", MY_PORT);
}
if ( (sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0 )
{
perror("Socket");
exit(errno);
}
bzero(&self, sizeof(self));
self.sin_family = AF_INET;
self.sin_port = htons(MY_PORT);
self.sin_addr.s_addr = INADDR_ANY;
if ( bind(sockfd, (struct sockaddr*)&self, sizeof(self)) != 0 )
{
perror("socket--bind");
exit(errno);
}
if ( listen(sockfd, 20) != 0 )
{
perror("socket--listen");
exit(errno);
}
while (1)
{
struct sockaddr_in client_addr;
u_int addrlen=sizeof(client_addr);
/*---accept a connection (creating a data pipe)---*/
clientfd = accept(sockfd, (struct sockaddr*)&client_addr, &addrlen);
//printf("%s:%d connected\n", inet_ntoa(client_addr.sin_addr),
ntohs(client_addr.sin_port));
/*---Echo back anything sent---
send(clientfd, buffer, recv(clientfd, buffer, MAXBUF, 0), 0);*/
if (!fork())
{
flen = recv(clientfd, buffer, MAXBUF, 0);
send(clientfd, buffer, flen, 0);
pr(buffer);
}
close(clientfd);
}
close(sockfd);
return 0;
}
The vulnerability is fairly obvious in this case, the program reads input from the socket (upto
5000Bytes),
forks[6] and hands the
input to the pr function:
Code:
int pr( char *str)
{
char buf[2000];
strcpy(buf,str);[7]
return 0;
}
A simple stack based overflow.
Re: One persons journey with Back Track
Originally Posted by Izik
