/*
 * 
 * sendmail_overwrite
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>

#define NAME "Sendmail overwrite feature"
#define DESC "\
Some versions of sendmail allow a remote user to send a mail\n\
directly to a non-root owned file. This feature can be used to \n\
overwrite a '.rhost' file of a user or whatever...\n\n\
Risk factor : High"
#define COPYRIGHT "no copyright"
#define SUMM "send a mail to a file"




PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_GATHER_INFO);
	plug_set_family(desc, "Sendmail");
	return(0);
}
	
 



PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	int soc;
	char * buf;
	int i;
	
	
	if(host_get_port_state(args, 25)<=0)return(0);
	soc = open_sock_tcp(args, 25);
	if(soc<0)return(-1);
	buf = emalloc(2048);
	recv_line(soc, buf, 2047);
	sprintf(buf, "mail from: nessus\n");
	send(soc, buf, strlen(buf),0);
	recv_line(soc, buf, 2047);
	
	sprintf(buf, "rcpt to: /tmp/.tst\n");
	send(soc, buf, strlen(buf),0);
	recv_line(soc, buf, 2047);
	for(i=0;i<strlen(buf);i++)
	 buf[i]=tolower(buf[i]);
	
	if(!strncmp(buf, "250 ", 4))
	{
	sprintf(buf, "data\nnessus-generated test file\n.\nquit\n");
	send(soc, buf, strlen(buf), 0);
	 post_hole(args, 25,
"Sendmail allows a remote user to write directly to a file\n\
which is very dangerous.\n\n\
Solution : upgrade");
 	}
	sprintf(buf, "quit\n");
	send(soc, buf, strlen(buf),0);
	socket_close(soc);
	efree(&buf);
	return(0);
}
