#!/usr/bin/perl5.8.4
# 
# registry.sara attempts to open smb registry and check version numbers
# of potentially vulnerable products
#
# usage: registry.sara  -u user -p password  [-v] host
# 
# registry.sara requires a preloaded samba-TNG configuration in /usr/local/samba
# IF not found, it will terminate  
# Note:  sara does not provide the samba-THG envrionment!
# 
# Author:  Advanced Research Corporation  1 Jun 03 
# 
#

require 'config/paths.pl';
require 'config/sara.cf';
require 'perl/misc.pl';
require 'perllib/getopts.pl';
require 'rules/registry.rules';
$sid_file = "rules/sid.def";
#
if ($#ARGV <= 1 ) {
      die "Usage: registry.sara -u user [-p password] [-v] target";
}
Getopts("u:p:v");
die "Usage: registry.sara -u user [-p password] [-v] target" if ! $opt_u;
$rpcclient=$RPCCLIENT;
$target=$ARGV[0];
#
#  Check for samba programs
#
if (-e $rpcclient)
{
$printed=0;

#
#Check which version of rpcclient
$tng="";
open (TEST,"$RPCCLIENT -h 2>/dev/null|");
while (<TEST>) {
if (/Version TNG/i || /Samba-TNG/) {
    $tng="TNG";
    last;
  }
}
close (TEST);
exit if ! $tng;

my $account =  "$opt_u";
my $password = "$opt_p";
for (@rules_registry) {
($sid, $application, $reg_key, $outputf, $outputp) = split(/\|/);
$reg_key =~ s/\\SW\\/\\Software\\/;
$reg_key =~ s/\\MS\\/\\Microsoft\\/;
  $command = "regenum \"$reg_key\"";
  ($output, $testf) = split(/,/, $outputf);  
  ($dum, $testf) = split(/\[/, $testf);
  ($testf, $dum) = split(/\]/, $testf);
  $testf =~ s/\.//g;
  $testf =~ s/\n//g;
  ($dum, $testp) = split(/,/, $outputp);
  ($dum, $testp) = split(/\[/, $testp);
  ($testp, $dum) = split(/\]/, $testp);
  $testp =~ s/\.//g;
  $testp =~ s/\n//g;
#$command = "quit";
    open(IPC, "$rpcclient -U \"$account%$password\" -c '$command' -S $target 2>/dev/null|");
    while (<IPC>) {
      print $_ if $opt_v;
      if (/$output/) {
        ($dum,$dum,$version) =split(/:/);
        $version =~ s/\,/./g;
        $version =~ s/\n//g;
        $version =~ s/\s+//g;

        $version_string = $version;
        $version =~ s/\.//g;
        if ($version <= $testf && $testf) {
          if ($version >= $testp){
            if($printed == 0) {
              ($severity,$service_output,$text) = &get_sid($sid);
              $status = "a";
              $service = "netbios-ssn";
              $trustee = "ANY\@ANY";
              $trusted = "ANY\@ANY";
              $version_string =~ s/\n//;
              $version_string =~ s/\s+//g;
              $text .= " \[$application: Version $version_string\]";
              &sara_print();
            }
          }
        }
      }
    }
    close(IPC);
  }
 }  
