/*
 * 
 * sendmail_expn
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>

#define NAME "Sendmail EXPN"
#define DESC "\
Sendmail should not allow a remote user to perform EXPN or VRFY\n\
commands, since it can give away some interesting informations.\n\
This plugin determines if the remote sendmail allow those commands\n\n\
Risk factor : low"

#define COPYRIGHT "no copyright"
#define SUMM "sendmail EXPN and VRFY exploit"




PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_GATHER_INFO);
	plug_set_family(desc, "Sendmail");
	return(0);
}
	
void getline(int soc, char * buf)
{
 int i = 0;
 char c;
 int flag = 0;

 bzero(buf, 2048);
 while(!flag)
 {
  read(soc, &c, 1);
  buf[i++] = c;
  if(c==0 || c=='\n' || i>2046)flag = 1;
 }
}     



PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	int soc;
	char * buf;
	int expn=0,vrfy=0;
	
	if(host_get_port_state(args, 25)<=0)return(0);
	soc = open_sock_tcp(args, 25);
	if(soc<0)return(-1);
	buf = emalloc(2048);
	getline(soc, buf);
	sprintf(buf, "EXPN root\n");
	send(soc, buf, strlen(buf),0);
	getline(soc, buf);
	if(!strncmp(buf, "250", 3))expn=1;
	
	sprintf(buf, "VRFY root\n");
	send(soc, buf, strlen(buf), 0);
	getline(soc, buf);
	if(!strncmp(buf, "250", 3))vrfy=1;
	if(expn||vrfy)
	{
	char * data = emalloc(240);
	
	if(expn && vrfy)sprintf(data, "(as well as VRFY)");
	sprintf(buf, "Sendmail allows the %s command to be performed,\n\
%s\nThis can give away some interesting informations to an intruder\n\n\
Solution : edit /etc/sendmail.cf",
	expn ? "EXPN":"VRFY", data);
	efree(&data);
	post_info(args, 25, buf);
	}
	socket_close(soc);
	efree(&buf);
	return(0);
}
