/*
 * 
 * sendmail_decode
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>

#define NAME "Sendmail 'decode' vulnerability tester"
#define DESC "\
If '/etc/aliases' contains \"|/usr/bin/uudecode\" anyone can send mail to\n\
decode, write to any file onwed by daemon, if they can connect to sendmail\n\
daemon, can write to any file owned by any user. \n\n\
Risk factor : High"

#define COPYRIGHT "no copyright"
#define SUMM "sendmail 'decode' exploit"




PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_GATHER_INFO);
	plug_set_family(desc, "Sendmail");
	return(0);
}
	
void getline(int soc, char * buf)
{
 int i = 0;
 char c;
 int flag = 0;

 bzero(buf, 2048);
 while(!flag)
 {
  read(soc, &c, 1);
  buf[i++] = c;
  if(c==0 || c=='\n' || i>2046)flag = 1;
 }
}     



PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	int soc;
	char * buf;
	int i;
	
	
	if(host_get_port_state(args, 25)<=0)return(0);
	soc = open_sock_tcp(args, 25);
	if(soc<0)return(-1);
	buf = emalloc(2048);
	getline(soc, buf);
	sprintf(buf, "expn decode\n");
	send(soc, buf, strlen(buf),0);
	
	getline(soc, buf);
	for(i=0;i<strlen(buf);i++)
	 buf[i]=tolower(buf[i]);
	
	if(!strncmp(buf, "250 ", 4) && strstr(buf, "/bin/"))
	{
	 post_hole(args, 25,
"The sendmail 'decode' hole appears to be present\n\
but was not exploited...\n\
Solution : upgrade to a decent version of sendmail");
 	}
	socket_close(soc);
	efree(&buf);
	return(0);
}
