/*
 * 
 * sendmail_debug
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>

#define NAME "Sendmail : 'debug' vulnerability tester"
#define DESC "\
On very old implementations of sendmail, the 'debug'\n\
option allow a remote user to execute arbitrary commands\n\
as root\n\n\
Risk factor : High"
#define COPYRIGHT "no copyright"
#define SUMM "sendmail 'debug' exploit"




PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_GATHER_INFO);
	plug_set_family(desc, "Sendmail");
	return(0);
}
	
void getline(int soc, char * buf)
{
 int i = 0;
 char c;
 int flag = 0;

 bzero(buf, 2048);
 while(!flag)
 {
  read(soc, &c, 1);
  buf[i++] = c;
  if(c==0 || c=='\n' || i>2046)flag = 1;
 }
}     



PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	int soc;
	char * buf;
	int i;
	
	
	if(host_get_port_state(args, 25)<=0)return(0);
	soc = open_sock_tcp(args, 25);
	if(soc<0)return(-1);
	buf = emalloc(2048);
	getline(soc, buf);
	sprintf(buf, "debug\n");
	send(soc, buf, strlen(buf),0);
	
	getline(soc, buf);
	for(i=0;i<strlen(buf);i++)
	 buf[i]=tolower(buf[i]);
	
	if(strstr(buf, "200 debug set"))
	{
	 post_hole(args, 25,
"The sendmail 'debug' hole appears to be present\n\
but was not exploited...\n\
Solution : upgrade to a decent version of sendmail");
 	}
	socket_close(soc);
	efree(&buf);
	return(0);
}
