#!/usr/bin/perl5.8.4

# bin/depends.sara
#
# Last Mod 11 Aug 00, 23:30:00 by Bob Todd
#
require 'config/paths.pl';
require 'perl/misc.pl';
require 'perl/get_host.pl';

if ($#ARGV < 1) {
   die "Usage: bin/depends.sara service hostname\n";
}
$_service  = $ARGV[0];
$target    = $ARGV[1];
$t2r = "perl/contrib/t2r.pl";
$dscan = "bin/dscan";
foreach (keys %ENV) {
   $saradata=$ENV{SARA_DATA};
   $level_flag=$ENV{SARA_LEVEL};
}
$os=get_OS();
if ($_service eq "netbios-ssn") {
 if ($os =~ /Linux/i) {
    open (T2R,"$t2r -t linx86  -H 127.0.0.1 -h $target -M S|");
  } elsif ($os =~ /SunOS/i) {
    open (T2R,"$t2r -t solx86  -H 127.0.0.1 -h $target -M S|");
  } elsif ($os =~ /FreeBSD/i) {
    open (T2R,"$t2r -t fbsdx86 -H 127.0.0.1 -h $target -M S|");
  } elsif ($os =~ /UNKNOWN/) {
    open (T2R,"$t2r -t linx86  -H 127.0.0.1 -h $target -M S|");
  } else {
    exit;
  }
  while (<T2R>) {
   if (/System is vulnerable to attack/) {
     $sid = "SMB-006";
     ($severity,$service_output,$text,$cve) = &get_sid($sid);
     $status  = "a";
     $service = "netbios-ssn";
     $trustee = "ANY\@$target";
     $trusted = "ANY\@$target";
     &sara_print();

   }
  }
  close (T2R);
}
if ($_service eq "ms-rpc") {
  open (DSCAN, "$dscan $target|"); 
  while(<DSCAN>) {
     chomp;
    if(/appears to be vulnerable/) {
      $sid = "RPC-001";
       ($severity,$service_output,$text,$cve) = &get_sid($sid);
       $status  = "a";
       $service = $_service;
       $trustee = "ANY\@$target";
       $trusted = "ANY\@$target";
       &sara_print();
       last;
    } elsif (/unidentified signature/) {
       $sid = "RPC-002";
       ($severity,$service_output,$text,$cve) = &get_sid($sid);
       $status  = "a";
       $service = $_service;
       $trustee = "ANY\@$target";
       $trusted = "ANY\@$target";
       &sara_print();
       last;
   }
  }
  close (DSCAN);
}
if ($_service eq "telnet") {
  if ($os =~ /IRIX/) {
    if ($level_flag >= 3) {
      open(TELNET,"bin/irix-telnet $target|");
      while(<TELNET>) {
        chomp;
        if (/System Vulnerable/) {
          $sid = 'TEL-001';
          ($severity,$service_output,$text, $cve) = &get_sid($sid);
          print "$target|telnet|a|$severity|ANY\@ANY|ANY\@ANY|$service_output|$text\n";
        }
      }
      close(TELNET);
    } else {
      $sid = 'TEL-002';
      ($severity,$service_output,$text, $cve) = &get_sid($sid);
      print "$target|telnet|a|$severity|ANY\@ANY|ANY\@ANY|$service_output|$text\n";
    }
  }
}
if ($_service eq "sadmind") {
 if ($os eq "SunOS" || $os =~ /SunOS 5.[0-7]/ || $os eq "UNKNOWN") {
   $sid = 'SOL-001';
   ($severity,$service_output,$text, $cve) = &get_sid($sid);
   print "$target|sadmind|a|$severity|ANY\@ANY|ANY\@ANY|$service_output|$text\n";
 }
}

if ($_service eq "calendar") {
 if ($os =~ /SunOS 5.[0-6]/||$os =~ /HP-UX/||$os eq "UNKNOWN") {
   $sid = 'SOL-002';
   ($severity,$service_output,$text, $cve) = &get_sid($sid);
   print "$target|rpc.cmsd|a|$severity|ANY\@ANY|ANY\@ANY|$service_output|$text\n";
 }
}

if ($_service eq "tooltalk") {
 if ($os =~ /SunOS 5.[0-8]/||$os =~ /IRIX/||$os eq "UNKNOWN") {
   $sid = 'SOL-003';
   ($severity,$service_output,$text, $cve) = &get_sid($sid);
   print "$target|ttdbserverd|a|$severity|ANY\@ANY|ANY\@ANY|$service_output|$text\n";
 }
}

if ($_service eq "yppasswdd") {
 if ($os =~ /SunOS 5.[6-8]/) {
   $sid = 'SOL-004';
   ($severity,$service_output,$text, $cve) = &get_sid($sid);
   print "$target|yppasswdd|a|$severity|ANY\@ANY|ANY\@ANY|$service_output|$text\n";
 }
}

if ($_service eq "printer") {
# Look for possibly vulnerable LPRng print spooler
  $printer_printed=0;
  $args = " -s \"\006saralp root status\n\" -b $target 515";
  open(LPRNG, "$TCP_SCAN $args |" );
  while(<LPRNG>) {
    if (/Printing Spooling/i) {
          $status="a";
          $sid     = 'PTR-001';
          ($severity,$service_output,$text, $cve) = &get_sid($sid);
          $service = "printer";
          $trustee = "ANY\@$target";
          $trusted = "ANY\@$target";
          &sara_print();
          $printer_printed=1;
    } 
  }
close (LPRNG);
}
#snmpXdmid test (bid 2417)
if ($_service eq "boks") {
 if ($os =~ /SunOS 5.[6-8]/) {
   $sid = 'SOL-005';
   ($severity,$service_output,$text, $cve) = &get_sid($sid);
   print "$target|statd|a|$severity|ANY\@ANY|ANY\@ANY|$service_output|$text\n"; 
 }
}

sub get_OS() {
$OS = "UNKNOWN"; 
open (FACTS, "results/$saradata/facts");
while (<FACTS>) {
 if (/^$target/) {
  if (/SunOS/i) {
    if (/SunOS\s*([0-9].[0-9])/) {
      $OS = "SunOS $1"; 
    } else {
      $OS = "SunOS" if $OS !~ "SunOS";
    }
  }
  if (/IRIX/ || /SGI/) {
    if (/IRIX\s*([0-9].[0-9])/) {
      $OS = "IRIX $1";
    } else {
      $OS = "IRIX" if $OS !~ /IRIX/;
    }
  }
  if (/Linux/i) {
    if (/Kernel\s+([0-9].[0-9])/ || /Linux\s+([0-9].[0-9])/) {
      $OS = "Linux $1";
    } else {
      $OS = "Linux" if $OS !~ /Linux/;
    }
  }
  if ( /\\131\\000\\000\\001\\143/ || /Microsoft/ || /Windows/) {
    $OS = "Windows";
    $OS = "Windows 2000/XP" if (/Windows 2000/);
  }
  if ($OS eq "UNKNOWN") {
  $OS = "VAX" if /VAX/;
  $OS = "Digital UNIX" if /Digital UNIX/;
  $OS = "HP-UX" if /HP-UX/;
  $OS = "JetDirect" if /JetDirect/i;
  $OS = "Tektronix" if /Tektronix/;
  $OS = "Router" if /Router/;
  $OS = "Cisco" if /Cisco/;
  $OS = "BSD" if /BSD/ && $_ !~ /Mac/;
  $OS = "FreeBSD" if /FreeBSD/i;
  }
 } 
}

return "$OS";
close (FACTS);
}
