#!/usr/bin/perl5.8.4
# 
# sample.sara.ext: version 1.1 06 Dev 99, 23:30:00, last mod by todd

# A sample SARA extension subprogram to be used by SARA developers.
# This sample retrieves two arguments.  It is left to the student to
# reduce this sample to one argument.  SARA extensions will never receive
# three or more arguments.  Additional information (e.g., firewall, attack
# level, etc. are passed though %ENV
#


require 'config/paths.pl';
require 'perl/misc.pl';
require 'config/sara.cf';
#
# To cause the extension to be executed, you would normally place an
# entry in ./rules/todo.  See the ./rules/todo in this distribution for
# details
#
# All SARA extensions are controlled by the configuration file, sara.cf
# Under production runs, extensions may be disabled.  to enable extensions,
# be sure that the following is in sara.cf
#
#                  $enable_extensions = 1;
#
# Note that extensions are disabled by default
#
if ($enable_extensions ne 1){
  exit 1;
}
#
#
# Check here for the number of variables.  Normally it will be 
#one argument (target) or two (port, target).  Unlike SAINT, other
#parameters are passed through %ENV
#
#Here we are checking for two args
#
if ($#ARGV < 1) {
   die "Usage: sample.sara.ext port target\n";
}
#
# Collecting the port and target
#
$target = "$ARGV[1]";
$port ="$ARGV[0]";
#
# Port processing includes looking up port to see if it is a well known
# service.  If so, it will provide the service name
#
if($ARGV[0] =~ /\:/) {
   $port =~ s/\:TCP//;
} else {
   open(SERVICES, $SERVICES) or die "$0: cannot open $SERVICES: $!\n";
   while(<SERVICES>) {
      $port_name{$1} = $2 if /(\S+)\s+([0-9]+)\/tcp/;
   }
   $port = $port_name{$ARGV[0]} if $port_name{$ARGV[0]};
}

if (!$port) {
   $port = getservbyname($ARGV[0], "tcp");
}
$service = $port;
#
# $status will normally be "a" indicating that service is available
#
# $severity will be eventually set to one of the following:
#    ""    = a service not to be reported by this module
#    "g"   = a well known service that is not vulerable
#    "y**" = a yellow vulnerability
#    "z**" = a brown vulnerability
#    "**"  = a red vulnerability
#   Actual severity codes can be found in the SARA Documentation page
#
# $trustee not normally set unless service is vulnerable
# $trusted not normally set unless service is vulnerable
#
# $service_output = name of tutorial that should be referenced if vulnerable
#   List of vulnerabilities are in ./html/tutorials/vulnerability
#   You should create an entry in this directory called $service_output.html
#   but the blanks should be replaced by "_".  You should then create your
#   tutorial in the specified directory with the identified name.  For instance
#   if $service_output is "My tutorial" the resulting filename should be
#   "My_tutorial.html"
#
# $text = string that is displayed in SARA reports
#
$status = "a";
$severity= "g";
$trustee = "";
$trusted = "";
$service_output = "SAMPLE";
$printed = 0;
#
# Though not needed in this example, we may need to know if the firewall
# flag was set (in sara.cf, Configuration Management screen, or the 
#command line). It is similar for the attack level.
#
foreach (keys %ENV) {
   $firewall_flag=$ENV{SARA_FW};
}
# 
# In this sample, we will check on web servers that we previously found
# on $port.  This sample is called from ./rules/todo as are most of the
# SARA subprograms
#
# Web servers can be found on many ports. This sample subprogram will be
# called for every port that offers a Web server
#
if ($service == http){ 
  $text = "offers http";
} else {
  $text = "offers http on port $service";
}
#
# Here we will send to string to the $target on $port and see what happens.
# We will do a simple minded test and see if "/cgi-bin/zap.cgi" exists
# and is executable.  If it is, the server is assumed to be vulnerable.  
# Otherwise, it a "good" service.  I told you it was simple minded.
#
$string = "GET /cgi-bin/zap.cgi HTTP/1.0\n\n";

$args = "-w 1 -bs  \"$string\" $target $port";
die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");
   while(<SCAN>) {
#
# If wed get an OK indication from the Web server, that means that
# this "bad program is available.  As a result, we will set the appropriate
# stuff send to SARA internals through &sara_print.
#
    if  (/200 OK/){
           $trustee = "ANY\@ANY";
           $service_output = "possible http cgi access SAMPLE";
           $trusted = "ANY\@ANY";
           $text = "WWW: zap.cgi is active and & be vulnerable";
           $severity = "yus";
           &sara_print ();
           $printed=1;
    }
  }
  close(SCAN);
#
# If we haven't found anything, we will print an OK record.  This is
# not always necessary.  Many times, nothing will be reported, if we
# don't find anything bad.
#
if ($printed == 0) {
  &sara_print();
}
