Network Hacking (C/C++)

C/C++
C/C++ are the most popular programming languages used in developing exploit code. Some C/C++ code can be compiled with any compiler and on any operating system. There are also C/C++ scripts that are made to be compiled by a particular compiler, or in a particular operating system. You can usually find this information commented in the top of the script. Below is a list of the most popular compilers for each operating system.
C/C++

Windows
• Microsoft Visual C++
• Borland C++
• Dev-C++
Mac
• MrC/MrCpp
• Xcode
Linux
• GCC


Google Search! Search Here!

Web
Images
Local Listing
Mobile Web

Most C/C++ exploit code is made to be compiled in Linux. If you wish to run one them but you’re only option is Windows, then you can use Cygwin . Cygwin is a Linux-like environment that runs in Windows and acts as a Linux emulation layer, allowing you to run Linux scripts in windows. Although many Linux C/C++ exploit scripts will work with Cygwin, there are also many may not. I will show you how you can use Cygwin right after I give you an example of compiling and running a C/C++ script in Ubuntu Linux. If you aren’t already using Linux, I would recommend following along using VirtualBox from the Linux chapter.

1. Open up Terminal.

2. Go to http://milw0rm.com/exploits/269 and copy the remote root exploit.

3. Open up the VI editor in the terminal by typing in “vi” and hitting <Enter>. You should see the following screen:

4. To get into typing mode type in I (Shift + I).

5. You are now in insert mode. Right click and paste in the exploit.

6. The script should have pasted in. Now it’s time to save it. Hit the <ESC> key and then type in “:wq exploit.c” . This quits and saves the document as exploit.c .

7. Now type in the command: ls. This command lists all the files in the current directory. You should see your newly made file in the list.

8. Now we will compile the script using the GCC compiler, but before we compile this script we need to first install a development package of all the libraries and headers needed to compile C/C++ scripts. It’s a very easy process. In the terminal type in the following command:

sudo apt-get install build-essential

9. This command downloads the package and then asks you if you would like to continue with installing. Type in a “y” and hit enter. It automatically will install the package.

10. Now to compile the script type in the command “gcc exploit.c” , it will quickly compile. If there was no error displayed, then it was successful. By using the “ls” command you can now see there’s a new file named “a.out” this is the compiled script.

11. To run the new file type in the command “./a.out”. This will display a little note telling you how to run the exploit against a server. The below image shows all of these steps together.

12. The last line of the picture shows the proper way a hacker would use the script against a server.

13. Once the hacker ran the script against a vulnerable server running BeroFTPD 1.3.4 and the script worked, the hacker would now have root access to the server. Below is an image of what the root account on Ubuntu would look like.

As you can see the “whoami” command tells you who you are on the system. In this case I am root.