/*
 * 
 * standardsys
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>


#define NAME "Standard System holes"
#define DESC "Underlines little holes of a newly installed system \
Most newly installed system have some 'standard' ports opens, that are \
no use to anyone except the intruders"
#define COPYRIGHT "no copyright"
#define SUMM "underlines little holes of a newly installed system"


PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_GATHER_INFO);
	plug_set_family(desc, "Misc.");
	return(0);
}



PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
 int soc;
  if(host_get_port_state(args, 7)>0)
  	{
	if((soc = open_sock_tcp(args, 7))>0)
	{
         char * buf = emalloc(2);
         buf[0]='a';
         send(soc, buf, 1, 0);
         bzero(buf, 2);
         
         recv(soc, buf, 1, 0);
  	 
         if(buf[0]=='a')post_info(args, 7, 
  	 "The 'echo' port is open :\nThis may lead to denial of services");
         efree(&buf);
	 socket_close(soc);
	 }
  	}
  if(host_get_port_state(args, 11)>0)
  	{
        
	if((soc = open_sock_tcp(args, 11))>0)
	{
        char * buf = emalloc(255);
        recv_line(soc, buf, 254);
  	if(strlen(buf))post_info(args, 11, 
  	"The 'systat' port is open :\nThis can give away some informations to an intruder");
	socket_close(soc);
        efree(&buf);
	}
	}
  if(host_get_port_state(args, 15)>0)
  	{
	if((soc = open_sock_tcp(args, 15))>0)
	{
        char * buf = emalloc(255);
        recv_line(soc, buf, 254);
  	if(strlen(buf))post_info(args, 15,
  	"The 'netstat' port is open :\nThis can give away some informations to an intruder");
	socket_close(soc);
        efree(&buf);
	}
	}
  if(host_get_port_state(args, 79)>0)
  	{
	if((soc = open_sock_tcp(args, 7))>0)
	{
        char * buf = emalloc(255);
        sprintf(buf, "root\n");
        send(soc, buf, strlen(buf), 0);
        bzero(buf, 255);
        recv_line(soc, buf, 255);
  	if(strlen(buf) && strstr(buf, "ogin:"))post_info(args, 79,
  	"The 'finger' port is open :\nThis can give away valuable informations to an intruder");
	socket_close(soc);
        efree(&buf);
	}
	}
  return(0);
}

