/*
 * 
 * ftp_backdoor
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>

#define NAME "NULL Linux ftp backdoor"
#define DESC "\
There was a backdoor in the old ftp daemons of Linux,\n\
which allowed a remote user to log in with the username\n\
'NULL', and then have the root privileges over FTP\n\
This plugin determines if it is present on the remote host\n\n\
Risk factor : high"
#define COPYRIGHT "no copyright"
#define SUMM "checks if the user NULL backdoor is present on the remote ftpd"





PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_GATHER_INFO);
	plug_set_family(desc, "FTP");
	return(0);
}
	

PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	int soc;
	char * buf;
	
	
	if(host_get_port_state(args, 21)<=0)return(0);
	soc = open_sock_tcp(args, 21);
	if(soc<0)return(-1);
	
	if(!ftp_log_in(soc, "NULL", "NULL"))
	{
	 post_hole(args, 21, 
"The remote host appears to have the old linux 'NULL'\n\
ftp backdoor... ftp there as user 'NULL' and you are root\n\
Solution : upgrade wu-ftpd to a recent version");	
       }
        shutdown(soc, 2);
        efree(&buf);
        socket_close(soc);
	return(0);
}

