vuln_service.c

代码给出了Linux系统下蠕虫代码如何通过有漏洞的系统进行蔓延的。

/* File: remote.c
 *
 * Author: Chris Church
 * Class: ECE 4883
 * Lab:	Worms and Virus Lab
 * 2003.03.20
 * Purpose: a generic, simple, vulnerable network service
 *          
 * Adapted from code borrowed from Amul Shah for Buffer Overflow Lab
 *
 */

#include "stackinfo.h"

#define BUFFER_SIZE 16
#define ONEK 1024
#define HALFK 512
char sendbuff[ONEK];

void svcHandle(int sockfd);

int main(int argc, char *argv[])
{
  int sockfd, newsockfd;
  struct sockaddr_in clientaddr, serveraddr;
  int clientaddrlength;
  int pid;
  int PORTNUMBER = 3333;
  int yes = 1;



  // Open a TCP socket
  if( (sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0 )
    {
      perror("socket");
      exit(-1);
    } 
  else 
    {
      fprintf(stdout, "TCP socket opened \n");
    }

  setsockopt( sockfd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(int));

  // Set up structures to bind the address to the socket.
  bzero(&serveraddr, sizeof(serveraddr));
  serveraddr.sin_family 	= htons(AF_INET);
  serveraddr.sin_addr.s_addr 	= htonl(INADDR_ANY);
  serveraddr.sin_port 		= htons(PORTNUMBER);

  // bind the socket to a well-known port
  if (bind(sockfd, (struct sockaddr *) &serveraddr, sizeof(serveraddr)) != 0)
    {
      perror("can't bind to socket");
      exit(-1);
    }
  else
    {
      fprintf(stdout, "port %d is bound \n", ntohs(serveraddr.sin_port));
    }

  if (listen(sockfd, 128) < 0)
    {
      perror("listen");
      exit(-1);
    }
  else
    {
      fprintf(stdout, "server has begun listening \n");
    }

  /*
   * This server waits until a new connection comes in.
   * It then fork()s and lets its child handle the incoming
   * requests.
   * The parent goes back and waits to accept new connections.
   */
  clientaddrlength = sizeof(clientaddr);
  while ( (newsockfd = accept(sockfd, (struct sockaddr *) 
			      &clientaddr, &clientaddrlength)) >= 0)
    {
      
      /* Fork a child to handle the connection. */
      pid = fork();
      if (pid < 0)
	{
	  perror("fork");
	  exit(-1);
	}
      else if (pid == 0)
	{
	  // child
	  close(sockfd);
	  svcHandle(newsockfd);
	  exit(EXIT_SUCCESS);
	}
      else 
	{
	  // parent
	  close(newsockfd);
	}
    }
  
  // reach here only on an accept error
  perror("accept");
  exit(-1);
}


void svcHandle(int sockfd)
{
  char userinput[BUFFER_SIZE];

  if ( (dup2( sockfd, STDOUT_FILENO)) < 0 )
    {
      perror("svcHandle: Error STDOUT_FILENO");
      return;
    }


  if ( (dup2( sockfd, STDIN_FILENO)) < 0 )
    {
      perror("svcHandle: Error STDOUT_FILENO");
      return;
    }

  bzero( userinput, BUFFER_SIZE);

  gets( userinput);

  printf( "%s\n", userinput);
}