#!/usr/bin/perl5.8.4
#  This software was derived from SATAN 1.1.1 by Dan Farmer and Wietse Venema
#  (http://www.porcupine.org/satan).
#
#
# version 1, Mon Mar 20 18:44:32 1995, last mod by wietse
# version 2, Mon Mar  8 23:30:00 1999, last mod by todd
#

#
# Report TCP services (banners where possible).
#
require 'config/sara.cf';
require 'config/paths.pl';
require 'perl/misc.pl';
require 'perllib/getopts.pl';
$rs_no_report = '|21|23|25|80|110|143|';

$usage = "usage $0 [-v] ports target";
 
&Getopts("v") || die $usage;
die $usage unless ($#ARGV >= 1);

($services = $ARGV[0]) =~ tr /,/ /;
$target = $ARGV[1];
$status = "a";

$| = 1; 

open(SERVICES, $SERVICES) || die "$0: cannot open $SERVICES: $!\n";
while (<SERVICES>) {
	$service_name{$2} = $1 if /(\S+)\s+([0-9]+)\/tcp/;
}
close(SERVICES);

$input_stream='QUIT\\r\\n\\r\\n';
if ($level_flag == 3 || $level_flag == 5){
  $input_stream='USER sara\\r\\nNICK q\\r\\nQUIT\\r\\n\\r\\n'; 
}
$_fw_tcp_scan = $fw_tcp_scan;
($dum, $_fw_tcp_scan) = split(/\s+/,$_fw_tcp_scan);
$_fw_tcp_scan =~ s/,/ /g;
if ($services =~ /$_fw_tcp_scan/) {
  $command = "$TCP_SCAN -f $fw_timeout -l $fw_loadlimit -bs \"$input_stream\" $target $services";
} else { 
  $command = "$TCP_SCAN  -w 30 -bs \"$input_stream\" $target $services";
}
print "$command\n" if $opt_v;

open(TCP_SCAN, "$command|")
	|| die "$0: cannot run $TCP_SCAN";

while(<TCP_SCAN>) {
	if (defined($opt_v)) {
	    print;
	}
	chop;
           $severity = "";
           $trustee = "";
           $trusted = "";
           $service_output = "";
           $text = "probable remote shell backdoor found at port $port";
	s/^600([0-9]):[^:]*/600$1:X-$1/;
	s/^60([1-9][0-9]):[^:]*/60$1:X-$1/;
	($port, $service, $flag, $service_output) = split(/:/, $_, 4);
#  Kludge due to coSARA dependence on buggy ICS interface
        next if($port == 21 && ! $service_output); 
        $rs_string =substr($service_output,0,40);
	$service = $service_name{$port} if $service_name{$port};
	if ($flag =~ /t/ && $port != 23 && $service_output) {
		$service = "telnet on port $port";
	} elsif ($service eq "UNKNOWN") { 
		$service = "$port:TCP"; 
	}
	$service_output =~ s/\|/?/g;
	$text = "offers $service";
        if ($rs_string =~ /# / && $rs_no_report !~ /\|$port\|/ ){
           $status = "a";
           $severity = "rs";
           $trustee = "ANY\@ANY";
           $trusted = "ANY\@ANY";
           $service_output = "backdoor found";
           $text = "probable remote shell backdoor found at port $port";
        }
	&sara_print();
}
