vserver source code

/*
*   Vulnerable server linked to these videos
*    - Windows Exploit Development Remote Stack Buffer Overflow  http://www.youtube.com/watch?v=ekazS--EYfM
*    - Build Metasploit Module (Windows Exploit Development)  http://www.youtube.com/watch?v=bvI541y4gFI
*
*/
#include "iostream.h"
#include "string.h"
#include "windows.h"
#include "winsock2.h"

#pragma comment(lib,"ws2_32.lib")

// This must be an array of chars
char *validPwd = "root";

int checkPwd( char *msg ) {

    char pwd[50] = "";
    strcpy( pwd, msg );

    if( strcmp( pwd, validPwd ) == 0 )
        return 1;
    else
        return 0;

}

int main() {

    HINSTANCE hinstLib= LoadLibrary(TEXT("ws2help.dll"));
    char pwd[500] = "";

    WSADATA WsaDat;
    if(WSAStartup(MAKEWORD(2,2),&WsaDat)!=0)
    {
        printf("WSA Initialization failed!\r\n");
        return 0;
    }

    SOCKET Socket = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
    if( Socket == INVALID_SOCKET ) {

        printf("Socket creation failed.\r\n");
        return 0;
    }

    SOCKADDR_IN serverInf;
    serverInf.sin_family = AF_INET;
    serverInf.sin_addr.s_addr = INADDR_ANY;
    serverInf.sin_port = htons(15000);

    if( bind(Socket,(SOCKADDR*)(&serverInf),sizeof(serverInf)) == SOCKET_ERROR ) {
        printf("Unable to bind socket!\r\n");
        return 0;
    }

    listen(Socket,1);
    SOCKET sd; // Socket descriptor

    while( 1 ) {

        printf(  "Listening on port 15000...\r\n");

        if( (sd = accept(Socket, NULL, NULL) ) == -1 ) {
            printf("Accept error" );
            return 1;
        }

        printf( "Client connected!\r\n\r\n" );


        // Receive password
        char bufferP[4000] = "";
        memset(bufferP, 0, 4000);
        int inDataLength = recv( sd, bufferP, 4000, 0);

        // If password is correct
        if( checkPwd( bufferP ) )
            printf( "Welcome to vserver!\n" );
        else
            printf( "Access denied\n" );


    } // End while

    // Shutdown our socket
    shutdown(sd,SD_SEND);
    // Close our socket entirely
    closesocket(sd);


    // Cleanup Winsock
    WSACleanup();
    return 0;
}