diff --git a/exploit.c b/exploit.c index b2c7c9d..4202577 100644 --- a/exploit.c +++ b/exploit.c @@ -21,11 +21,29 @@ int main(int argc, char** argv){ dest_addr.sin_port = htons(80); dest_addr.sin_addr.s_addr = inet_addr(argv[1]); - socklen_t len = 0; - int ret = getsockname(fd,(struct sockaddr*)&dest_addr, &len); - printf("ret_getsockname = %d\n", ret); - ret = connect(fd,(struct sockaddr*)&dest_addr, len); + int ret = connect(fd,(struct sockaddr*)&dest_addr, sizeof(dest_addr)); printf("ret_connect = %d\n", ret); + + char buffer[100]; + memset(buffer, 0, 100); + + strncpy(buffer, "GET /login.html HTTP/1.1\r\n", 100); + send(fd, buffer, strlen(buffer), 0); + + strncpy(buffer, "Host: ftp.wingdata.htb\r\n", 100); + send(fd, buffer, strlen(buffer), 0); + + strncpy(buffer, "Accept: */*\r\n", 100); + send(fd, buffer, strlen(buffer), 0); + + strncpy(buffer, "\r\n", 100); + send(fd, buffer, strlen(buffer), 0); + + int n; + while (( n = recv(fd, buffer, 99, 0)) > 0){ + buffer[n] = 0; + printf("%s", buffer); + } return 0; }