#!/bin/sh
#  This software was derived from SATAN 1.1.1 by Dan Farmer and Wietse Venema
#  (http://www.porcupine.org/satan).
#
#
# 
# sendmail.sara: version 2, 8 Mar 99, 23:30:00, last mod by todd
# sendmail.sara: version 3, 3 Jan 01, 23:30:00, last mod by todd
# sendmail.sara: version 4, 4 Mar 03, 23:30:00, last mod by todd in Exumas
# sendmail.sara: version 5,22 Sep 03, 17:00:00, last mod by todd
#
#  Searches for sendmail servers that are vulnerable
#

. config/paths.sh

tmp_file="./tmp_file.$$"

status="UNKNOWN"
target=$1
mail_type=""
port=25
#  Build VRFY tests
vrfy_string="VRFY root\nVRFY administrator\nquit\n"
# Build EXPN tests
expn_string="$expn_string\nEXPN root\nEXPN administrator\nquit\n"
dcde_string="EXPN DECODE\nEXPN UUDECODE\nquit\n"
# Build DEBUG strings
dbg_string="DEBUG\nquit\n"

if $TEST "X$target" = "X" ; then
        $ECHO Usage $0 target
        exit 1
fi

$TCP_SCAN -bs "quit\n" -w 20 $target $port > $tmp_file 2> /dev/null
# If no "OK", then not IMAP
VERSION=`$GREP 220 $tmp_file`
if [ -z "$VERSION" ]; then
  $RM -f $tmp_file
  exit 0
fi
# Generic OK
if [ "`$ECHO $VERSION | $GREP -i \"Sendmail \"`" ]; then
 if [ "`$ECHO $VERSION | $GREP -i \"8\.12\.[1-9][0-9]\/\"`" ]; then
     status=OK 
 elif [ "`$ECHO $VERSION | $GREP -i \"8\.1[3-9]\"`" ]; then
     status=OK
 elif [ "`$ECHO $VERSION | $GREP -i \"8\.[2-9][0-9]\.[0-9]/\"`" ]; then
     status=OK
 fi
fi
#  If Microsoft then OK
if [ "`$ECHO $VERSION | $GREP -i Microsoft`" ]; then  
   status=OK
#  If NTMail mostly OK
elif [ "`$ECHO $VERSION | $GREP -i NTMail`" ]; then
   status=OK
#  If NetScape then ... (versions 3.6 and above are good)

elif [ "`$ECHO $VERSION | $GREP -i NetScape`" ]; then
  if [ "`$ECHO $VERSION | $GREP \"1\.[0-9]\"`" ]; then
    mail_type="(Netscape)"
    status=BAD
  elif [ "`$ECHO $VERSION | $GREP \"2\.[0-9]\"`" ]; then
    mail_type="(Netscape)"
    status=BAD
  elif [ "`$ECHO $VERSION | $GREP \"3\.[0-5]\"`" ]; then
    mail_type="(Netscape)"
    status=BAD
  fi
else
  if [ "`$ECHO $VERSION | $GREP -i \"Sendmail [0-7]\.[0-9]\"`" ]; then
    status=BAD
  elif [ "`$ECHO $VERSION | $GREP -i \"Sendmail 8\.[0-9]\.\"`" ]; then
    status=BAD
  elif [ "`$ECHO $VERSION | $GREP -i \"Sendmail 8\.10\.\"`" ]; then
     status=BAD
  elif [ "`$ECHO $VERSION | $GREP -i \"Sendmail 8\.11\.\"`" ]; then
     if [ "`$ECHO $VERSION | $GREP -v \"Sendmail 8\.11\.7p1\+Sun\"`" ]; then
       status=BAD 
     fi
  elif [ "`$ECHO $VERSION | $GREP -i \"Sendmail 8\.12\.[0-9]\/\"`" ]; then
     status=BAD 
  elif [ "`$ECHO $VERSION | $GREP -i \"Sendmail 8\.12\.[0-9]\+Sun\/\"`" ]; then
     status=BAD                                                                 
  elif [ "`$ECHO $VERSION | $GREP -i \"Sendmail SMI-8\.[0-9]\.\"`" ]; then
     status=BAD
  elif [ "`$ECHO $VERSION | $GREP -i \"Sendmail SMI-8\.10\.\"`" ]; then
     status=BAD   
  elif [ "`$ECHO $VERSION | $GREP -i \"Sendmail SMI-8\.11\.\"`" ]; then
     status=BAD   
  elif [ "`$ECHO $VERSION | $GREP -i \"Sendmail SMI-8\.12\.[0-9]\"`" ]; then
     status=BAD   
  elif [ "`$ECHO $VERSION | $GREP -i \"Sendmail SGI-8\.9\.\"`" ]; then
     status=BAD
  elif [ "`$ECHO $VERSION | $GREP -i \"Sendmail SGI-8\.10\.\"`" ]; then
     status=BAD
  elif [ "`$ECHO $VERSION | $GREP -i \"Sendmail SGI-8\.11\.\"`" ]; then
     status=BAD
  elif [ "`$ECHO $VERSION | $GREP -i \"Sendmail SGI-8\.12\.[0-9]\/\"`" ]; then
     status=BAD 
  elif [ "`$ECHO $VERSION | $GREP -i \"Exim 3\.3[0-3]\"`" ]; then
     status=BAD
     mail_type="(Exim)"
  elif [ "`$ECHO $VERSION | $GREP -i \"Lotus Domino Release 5\.0\.[0-4]\"`" ]; then
     mail_type="(Lotus)"
     status=BAD
  fi
fi
if [ "$status" = "BAD" ]; then
	service="smtp"
	status="a"
	trustee="ANY@ANY"
	trusted="ANY@ANY"
	service_output="sendmail version"
	text="sendmail $mail_type version may be vulnerable to buffer overflow"
       	severity="ycio"
	$ECHO "$target|$service|$status|$severity|$trustee|$trusted|$service_output|$text"
elif [ "$status" = "UNKNOWN" ]; then
        service="smtp"
        status="a"
        trustee="ANY@ANY"
        trusted="ANY@ANY"
        service_output="possible sendmail version"
        text="sendmail unknown version may be vulnerable to buffer overflow"
        severity="zcio"
        $ECHO "$target|$service|$status|$severity|$trustee|$trusted|$service_output|$text"           
fi
#
# Test for VRFY exploits
#
$TCP_SCAN  -b -s "$vrfy_string" $target $port > $tmp_file 2> /dev/null
if [ "`cat $tmp_file  | grep \n250`" ]; then
  VRFY="BAD"
else 
  VRFY="OK"
fi
#
# Test for EXPN exploits
#
$TCP_SCAN  -b -s "$expn_string" $target $port > $tmp_file 2> /dev/null
if [ "`cat $tmp_file  | grep \n250`" ]; then
  EXPN="BAD"
else
  EXPN="OK"
fi
#
# Test for DECODE exploits
#
$TCP_SCAN  -b -s "$dcde_string" $target $port > $tmp_file 2> /dev/null
if [ "`cat $tmp_file  | grep \/bin`" ]; then
  DECODE="BAD"
else
  DECODE="OK"
fi

#
# Test for DEBUG exploits
#
$TCP_SCAN  -b -s "$dbg_string" $target $port > $tmp_file 2> /dev/null
if [ "`cat $tmp_file  | grep \n200`" ]; then
  DEBUG="BAD"
else
  DEBUG="OK"
fi
if [ "$VRFY" = "BAD" ]; then
        service="smtp"
        status="a"
        trustee="ANY@ANY"
        trusted="ANY@ANY"
        service_output="sendmail configuration"
        text="sendmail VRFY command may provide hacker information"
        severity="zcio"
        $ECHO "$target|$service|$status|$severity|$trustee|$trusted|$service_output|$text"
fi
if [ "$EXPN" = "BAD" ]; then
        service="smtp"
        status="a"
        trustee="ANY@ANY"
        trusted="ANY@ANY"
        service_output="sendmail configuration"
        text="sendmail EXPN command may provide hacker information"
        severity="zcio"
        $ECHO "$target|$service|$status|$severity|$trustee|$trusted|$service_output|$text"
fi

if [ "$DECODE" = "BAD" ]; then
        service="smtp"
        status="a"
        trustee="ANY@ANY"
        trusted="ANY@ANY"
        service_output="Sendmail vulnerabilities"
        text="sendmail DECODE may allow unauthorized write access to files"
        severity="uw"
        $ECHO "$target|$service|$status|$severity|$trustee|$trusted|$service_output|$text"
fi

if [ "$DEBUG" = "BAD" ]; then
        service="smtp"
        status="a"
        trustee="ANY@ANY"
        trusted="ANY@ANY"
        service_output="sendmail configuration"
        text="sendmail DEBUG may allow unauthorized access"
        severity="ycio"
        $ECHO "$target|$service|$status|$severity|$trustee|$trusted|$service_output|$text"
fi
  $RM -f $tmp_file
exit 0

# finis
