#!/usr/bin/perl5.8.4

# bin/dns-chk.sara
#
# Last Mod  8 Mar 99, 23:30:00 by Bob Todd
# Last Mod  9 Jul 02, 16:00:00 by Bob Todd
# Last Mod 19 Aug 02, 21:00:00 by Bob Todd
# Last Mod 16 Aug 03, 12:00:00 by Bob Todd
#
require 'config/paths.pl';
require 'config/sara.cf';
require 'perl/misc.pl';
require 'perllib/getopts.pl';

#Vulnerable versions
#$VER[1]   = "4.9.8";
#$VER[2]   = "8.2.5";
#$VER[3]   = "8.3.2";
#$VER[2]   = "9.2.1";

$status         = "a";
$service        = "domain";
$trusted        = "";
$trustee        = "";
$service_output = "";
$cve            = "";
$printed        = "";

&Getopts("v");
if ($#ARGV < 0) {
   die "Usage: bin/dns_check.sara [-v] hostname\n";
}

$target = $ARGV[0];
if ( -x $DIG ) {
  $args = "version.bind chaos txt";
  open (NS, "$DIG \@$target $args |");
} elsif ( -x $NSLOOKUP) {

# For DIG dig @mail-arc.com version.bind chaos txt
  $args = "-query=txt -class=chaos version.bind";
  open(NS, "$NSLOOKUP $args $target 2>/dev/null|");
} else {
  die "nslookup nor dig found, aborting dns-chk.sara\n";
}
  while(<NS>) {
    chomp;
     if (/can't/i && !$printed) {
         $sid = "DNS-002";
         ($severity,$service_output,$text,$cve) = &get_sid($sid);
         $text =~ s/\n//;
         $status = "a";
         $trustee = "ANY\@$target";
         $trusted = "ANY\@$target";
         &sara_print();
         $printed = "YES";
     }
   
     if (/VERSION.BIND/i && !$printed) {
        @version_full = split("\"", $_);
        @version = split("-", @version_full[1]);
        $version = @version[0];
        $version_full = @version_full[1];
        if (($version =~ /4.[0-8].[0-9]/) ||($version =~ /4.9.[08]/) ||
           ($version =~ /8.[0-1].[0-9]/) || ($version =~ /8.2.[0-5]/) ||
           ($version =~ /8.3.[0-2]/)     || ($version =~ /9.2.[01]/)) {
           print "$_\n" if $opt_v;
           $sid = "DNS-001";
           ($severity,$service_output,$text,$cve) = &get_sid($sid);
           $text =~ s/\n//;
           $trustee = "ANY\@$target";
           $trusted = "ANY\@$target";
           $text   .= " (ver $version)";
           &sara_print();
           $printed = "YES";
       }
     } else { next; }
}
#
#  Check to see if DNS will allow zone transfers
#
close(NS);
if ( -x $DIG ) {
  $domainname = "";
  $args = "\@$target soa $target";
  open (NS, "$DIG $args |");
  while (<NS>) {
   if (/SOA/ && !/;/) {
     ($domainname,$dummy) = split(/\s+/);
   }
  }
  close (NS);
  $args = "\@$target axfr $domainname";
  open (NS, "$DIG $args|");
} elsif (-x $NSLOOKUP) {
$domainname = "";
$args = "-querytype=any ";

die "Can't open $NSLOOKUP: $!\n" unless open(NS, "$NSLOOKUP $args $target 2>&1|");

while(<NS>) {
   chomp;
   print "$_\n" if $opt_v;
   if (/nameserver/i) {
     ($domainname,$dummy) = split(/\s+/,$_);
     print "DOMAIN $domainname\n" if $opt_v;;
   last;
   }
}
close(NS);

die "Can't open $NSLOOKUP: $!\n" unless open(NS, "$NSLOOKUP  2>&1   <<EOC
server $target
ls -d $domainname
EOC |");
} else {
  die " Cannot find nslookup or dig ... aborting\n";
}
while(<NS>) {
   chomp;
   if (/SOA/) {
     $severity = "zwoi";
     $trustee = "ANY\@$target";
     $trusted = "ANY\@$target";
     $service_output = "DNS Zone Transfers";
     $text = "DNS will dump domain data to remote users";
     &sara_print();
     last;
   }

}
close (NS);

