/*
 * 
 * uploader_exe
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>
#define NAME "uploader.exe problem"
#define DESC "O'reilly's webserver  'website' contains a demopackage\n\
that contains the cgi-program uploader.exe. It's possible to use\n\
it to upload CGI-programs on the remote WebServer thus allowing an\n\
intruder to execute arbitrary commands remotely\n\
Platforms affected : WindowsNT, Windows95\n\
Risk factor : High"
#define COPYRIGHT "found by Herman de Vette"
#define SUMM "uploads a file on the remote WebSite server"

int is_http_command_ok(struct arglist * env, char * comm);




PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_ATTACK);
	plug_set_family(desc, "CGI abuses");
	return(0);
}

int is_http_command_ok(struct arglist * env, char * comm)
{
 char * command = emalloc(200);
  short soc=-1;
  short i=0;
  char * buff = emalloc(256);
  
  sprintf(command, "GET %s HTTP/1.0\nhostname: %s\n\n",
          command,  plug_get_hostname(env));
          
  soc = open_sock_tcp(env, 80);
  if(soc <0)return(0); /* couldn't open a connection */
  send(soc, command, strlen(command), 0);
  read(soc, buff, 255);
  efree(&command);
  close(soc);
 
  if(strstr(buff, "HTTP/1.0 200 ") || strstr(buff, "HTTP/1.1 200 "))i=1; /* No e
rror */
  else i=0; /* Error */
  
  efree(&buff);
  return(i);
}




PlugExport int plugin_run(struct arglist * env);
PlugExport int plugin_run(struct arglist * env)
{
	
	if(host_get_port_state(env, 80)<=0)return(0);
  	if(is_http_command_ok(env, "/cgi-win/uploader.exe"))
        {
         post_hole(env, 80, 
"It may be possible for a remote user to upload one's CGI scripts\n\
and to execute them on the remote web server\n\
Solution : remove the CGI 'uploader.exe'");
        }
	return(0);
}
