/*
 * 
 * frontpage
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */

#include <includes.h>

#define NAME "Microsoft Frontpage exploits"
#define DESC "\
Some Microsoft Frontpage extensions allow remote\n\
users to view any file on the system and to overwrite\n\
those file\n\
If vulnerable, a site must quickly contact Microsoft for\n\
a patch\n\n\
Risk factor : High"

#define COPYRIGHT "Written after a paper from pedward@WEBCOM.COM"
#define SUMM "plays with Microsoft Frontpage extensions"

PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
        plug_set_name(desc, NAME);
        plug_set_description(desc, DESC);
        plug_set_summary(desc, SUMM);
        plug_set_copyright(desc, COPYRIGHT);
        plug_set_category(desc, ACT_ATTACK);
        plug_set_family(desc, "Remote file access");
        return(0);
}

PlugExport int plugin_run(struct arglist * args);       
PlugExport int plugin_run(struct arglist * args)
{
  if(host_get_port_state(args, 80)>0)
  {
    int has_frontpage = 0;
    int pwd_worldreadable = 0;
    int soc = open_sock_tcp(args, 80);
    
    if(soc<0)return(0);
    else socket_close(soc);
    if(is_cgi_installed(args, "_vti_inf.html"))
    {
     has_frontpage = 1;
     
    }
    else
    {
     int soc;
     char * buffer = emalloc(255);
     int i;
     soc = open_sock_tcp(args, 80);
     sprintf(buffer, "POST /_vti_bin/shtml.exe/_vti_rpc\n");
     send(soc, buffer, strlen(buffer), 0);
     bzero(buffer, strlen(buffer));
     recv(soc, buffer, 254,0);
     for(i=0;i<strlen(buffer);i++)buffer[i] = tolower(buffer[i]);
     
     if(strstr("http/1.1 200", buffer) || strstr("http/1.0 200", buffer))
     		has_frontpage = 1;
     socket_close(soc);
     efree(&buffer);
     }
    
    
    if(has_frontpage && (is_cgi_installed(args, "_vti_pvt/authors.pwd")))
    		pwd_worldreadable = 1;
    
    if(pwd_worldreadable)
    {
     post_hole(args, 80, 
"The remote web server appears to be running with FrontPage\n\
extensions, and lets the file 'authors.pwd' being world readable\n\
'GET _vti_pvt/authors.pwd' appears to happily send the file\n\
authors.pwd to whoever requested it\n\n\
Solution : contact Microsoft for a fix and double check your\n\
configuration file");
    } else if(has_frontpage)
     {
     post_info(args, 80,
"The remote web server is runing with FrontPage extensions\n\
Even though we did not detect any problem, you might want\n\
to double check your config file");
     }
    }
    return(0);
}
     
