vuln_server.c

// Servidor con buffer overflow — para ejercicios de explotación remota.
//
// Compilar inseguro:   make 0x420   (en este repo lo compilamos seguro,
//                      mover a 0x550 si quieres reproducir el shellcode)
//
// Bug: handle() copia datos del cliente a un buffer fijo sin comprobar
// tamaño. Más de 1024 bytes desbordan la pila.
#include "../0x260/0x265_hacking.h"
#include <netinet/in.h>

#define PORT 4000

void handle(int sockfd) {
    char buffer[1024];
    int n = recv(sockfd, buffer, 4096, 0);  // ⚠ recv mucho más grande que buffer
    if (n < 0) return;
    buffer[n] = '\0';
    send(sockfd, "ack\n", 4, 0);
    printf("[recv %d bytes] %.40s...\n", n, buffer);
}

int main(void) {
    int sockfd, new_sockfd, yes = 1;
    struct sockaddr_in host_addr, client_addr;
    socklen_t sin_size;

    if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) fatal("socket");
    setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(int));

    host_addr.sin_family      = AF_INET;
    host_addr.sin_port        = htons(PORT);
    host_addr.sin_addr.s_addr = INADDR_ANY;
    memset(&host_addr.sin_zero, 0, 8);

    if (bind(sockfd, (struct sockaddr *) &host_addr, sizeof(struct sockaddr)) == -1)
        fatal("bind");
    if (listen(sockfd, 5) == -1) fatal("listen");

    printf("[*] vuln_server escuchando en %d\n", PORT);
    while (1) {
        sin_size = sizeof(client_addr);
        new_sockfd = accept(sockfd, (struct sockaddr *) &client_addr, &sin_size);
        if (new_sockfd == -1) continue;
        if (fork() == 0) {
            close(sockfd);
            handle(new_sockfd);
            close(new_sockfd);
            exit(0);
        }
        close(new_sockfd);
    }
    return 0;
}