使用metasploit进行栈溢出攻击-3

有了shellcode，就可以进行攻击了，但是要有漏洞才行，真实世界中的漏洞很复杂，并且很难发现，因此我专门做一个漏洞来进行攻击。

具体来说就是做一个简单的tcp server，里面包含明显的栈溢出漏洞。

具体如下：

/* server.c */
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <arpa/inet.h>
void showClientInf(struct sockaddr_in client_addr) {
        printf("
The IP of client is:%s",inet_ntoa(client_addr.sin_addr));
        printf("
The Port of client is:%d
",ntohs(client_addr.sin_port));
}
unsigned long get_sp(void) 
{ 
__asm__("movl %esp,%eax"); 
} 
void testf()
{
    printf("ttttt
");
}


void recvastring(int new_fd)
{
    unsigned char buff[100];
    int i=0;
    printf("sp=0x%x,addr=0x%x bytes.
",get_sp(),&buff);
    int numbytes = recv(new_fd,buff,1024,0);
    if(numbytes==-1)
    {
        perror("recv");
        exit(9);
    }
}
int main() {
    int sockfd,new_fd;
    struct sockaddr_in my_addr;
    struct sockaddr_in their_addr;
    int flag=1,len=sizeof(int); 
    int sin_size;
    char buff[100];
    int numbytes;
    printf("socket
");
    if((sockfd = socket(AF_INET,SOCK_STREAM,0))==-1) {
        perror("socket");
        exit(1);
    }
    my_addr.sin_family = AF_INET;
    my_addr.sin_port = htons(7777);
    my_addr.sin_addr.s_addr = INADDR_ANY;
    bzero(&(my_addr.sin_zero),8);
    printf("bind
");
    if( setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &flag, len) ==-1) 
    { 
        perror("setsockopt"); 
        exit(1); 
    }
    if(bind(sockfd,(struct sockaddr *)&my_addr,sizeof(struct sockaddr))==-1)
    {
        perror("bind");
        exit(1);
    }
    printf("listen
");
    if(listen(sockfd,10)==-1) {
        perror("listen");
        exit(1);
    }
    printf("server is run...
");
    while(1) {
        sin_size = sizeof(struct sockaddr_in);
        printf("accept
");
        if((new_fd = accept(sockfd,(struct sockaddr *)
        &their_addr,&sin_size))==-1)
        {
            perror("accept");
            exit(1);
        }
        showClientInf(their_addr);
        if(!fork()) {
            printf("recv
");
            recvastring(new_fd);
            printf("close-new_fd 1
");
            close(new_fd);
            exit(0);
        }
        printf("close-new_fd 2
");
        close(new_fd);
    }
    printf("close-sockfd
");
    close(sockfd);
}

这个核心就是我们关注的recvastring函数，包含明显的栈溢出漏洞。我们专门看一下：

void recvastring(int new_fd)
{
    unsigned char buff[100];
    int i=0;
    printf("sp=0x%x,addr=0x%x bytes.
",get_sp(),&buff);
    int numbytes = recv(new_fd,buff,1024,0);
    if(numbytes==-1)
    {
        perror("recv");
        exit(9);
    }
}

同样编译生成：

bai@ubuntu:/mnt/hgfs/r/stack$ gcc -fno-stack-protector -z execstack -g -o server socketserver.c
bai@ubuntu:/mnt/hgfs/r/stack$ ./server
socket
bind
listen
server is run...
accept