/*
 * 
 * cfinger_search
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>

#define NAME "search.**@host cfingerd feature"
#define DESC "There is a bug in the cfingerd daemon which allow a\n\
remote user to get the list of all the users of the vulnerable system.\n\
This information may be of some help to a darkside hacker\n\n\
Risk factor : medium-high"
#define COPYRIGHT "no copyright"
#define SUMM "determines if cfingerd sends the list of users of the remote system"


PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_GATHER_INFO);
	plug_set_family(desc, "finger abuses");
	return(0);
}


PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	
	int soc;
	char * buffer;
	
	if(host_get_port_state(args, 79)<=0)return(0);  
	soc = open_sock_tcp(args, 79);
	if(soc<0)return(0);
	buffer = emalloc(1024);
	sprintf(buffer, "search.**\n");
	send(soc, buffer, strlen(buffer),0);
	bzero(buffer,1024);
	recv(soc, buffer, 1023,0);
	if(strstr(buffer, "matches"))
	{ 
	 char * report = emalloc(300+strlen(buffer));
	 sprintf(report,
"The finger daemon of the remote host is\n\
subject to the search.**@host cfingerd bug.\n\
Here is the output of this command :\n\
%s\nSolution : drop cfingerd and get an up-to-date in.fingerd\n\
or delete the 'finger' line in /etc/inetd.conf is you don't use this\n\
service", buffer);
	 post_hole(args, 79, report);
	 efree(&report);
	} 
	efree(&buffer);
	socket_close(soc);
	return(0);
}

