/*
 *
 * This plugin has been written by Javi Polo <javipolo@oioio.ddns.org>
 * and is released under the GPL (Gnu Public License)
 *
 */

#include <includes.h>

#define NAME "Sendmail HELO overflow"
#define DESC "\
Some versions of sendmail have a bug that makes that mails sent by\n\
anybody who sent before a HELO string longer than about 1024 bytes\n\
wont have the additional info that sendmail stamps on the mail header\n\
such as the IP of the user who mailed it, the username of who did it \n\
and some more, because the long HELO name crops this info\n\
Risk factor : low"
#define COPYRIGHT "Javi Polo, GPL"
#define SUMM "send anonymous mail"

PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_GATHER_INFO);
	plug_set_family(desc, "Sendmail");
	return(0);
}
	

PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	int s,i;
	char * buff;
	
	if(host_get_port_state(args, 25)<=0)return(0);
	s = open_sock_tcp(args, 25);
	if(s<0)return(-1);
	buff = emalloc(1024);
	recv_line(s, buff, 1023);
        sprintf(buff, "helo ");
        write(s, buff, 5);
	sprintf(buff, "a");
	for(i=0;i<1030;i++) send(s, buff, 1,0);
        sprintf(buff, "\n");
        send(s, buff, 1,0);
	recv_line(s, buff, 1023);
        	
	if(!strncmp(buff, "250 ", 4))
	{
	post_info(args, 25,
"Sendmail allows a remote user to send anonymous mail from\n\
this host\n\n\
Solution : upgrade to Sendmail 8.9.X or higher");
 	}
        sprintf(buff,"quit\n");
        send(s, buff, strlen(buff),0);
        socket_close(s);
	efree(&buff);
	return(0);
}
