#!/usr/bin/perl5.8.4
#
# 
# http.sara: version 2.1, 08 Mar 99, 23:30:00, last mod by todd
# http.sara: version 2.2, 09 May 99, 21:00:00, last mod by todd
# http.sara: version 2.3, 15 Nov 99, 23:00:00, last mod by todd
# http.sara: version 2.4  10 Mar 00, 21:00:00, last mod bt todd
# http.sara: version 2.5  20 Apr 00, 21:00:00, last mod by todd
# http.sara: version 2.6  26 Apr 00, 15:00:00, last mod by todd/pendleton
# http.sara: version 2.7  16 Apr 00, 09:00:00, last mod by todd
# http.sara: version 2.8  24 May 00, 15:00:00, last mod by todd
# http.sara: version 2.9  12 Jun 00, 15:00:00, last mod by todd
# http.sara: version 2.10 12 Jul 00, 17:00:00, last mod by todd
# http.sara: version 2.11 21 Jul 00, 21:00:00, last mod by todd
# http:sara: version 2.12  9 Jul 00, 09:00:00, last mod by todd
# http.sara: version 2.13 13 Jul 00, 21:00:00, last mod by todd
# http.sara: version 2.14 16 Oct 00, 17:00:00, last mod by todd
# http.sara: version 2.15 04 Dec 00, 17:00:00, last mod by todd
# http.sara: version 2.16 19 Dec 00, 17:00:00, last mod by todd
# http.sara: version 2.17 03 Jan 01, 23:00:00, last mod by todd
# http.sara: version 2.18 30 May 01, 23:30:00, last mod by todd
# http.sara: version 2.20 19 Jun 01, 14:10:00, last mod by todd
# http.sara: version 2.30 23 Jul 01, 19:00:00, last mod by todd
# http.sara: version 2.40 23 Aug 01, 11:00:00, last mod by todd
# http.sara: version 2.45 22 Jan 02, 11:00:00, last mod by todd
# http.sara: version 2.50 23 Apr 02, 11:00:00, last mod by todd
# http.sara: version 2.51 30 Apr 02, 11:00:00, last mod by todd
# http.sara: cersion 2.52 15 Jun 02, 11:00:00, last mod by todd
# http.sara: version 2.53 12 Aug 02, 21:00:00, last mod by todd
# http.sara: version 3.05 04 Jul 05, 21:00:00, last mod by todd
# http.sara: version 4.00 26 May 06, 21:00:00, last mod by todd
#
# Checks several classes of getting files by (a) executing programs
# or (2) reading files
#


require 'config/paths.pl';
require 'config/sara.cf';
require 'perl/hostname.pl';
require 'perl/misc.pl';
require 'perllib/getopts.pl';

&Getopts("a:v");

$SANITY = "YEP";	# Reset if 1st test gives a 200 OK
$SANITYCGI = "YEP";     # Reset if ist test gives a 500 Server Error

# Array of all the strings to send to the server on the port
$string[0] = 'GET /cgi-bin/this_page_could_not_exist.pl?test=sara HTTP/1.0\n\n\n';
$attack[0] = 'sanity';
$svcode[0] = 'g';
$string[1] = "GET /NULL.printer HTTP/1.0\n" . "Host: localhost\nSARA\n\n\n";
$attack[1] = "IIS 5.0 (ISAPI) may be vulnerable to buffer overflow";
$svcode[1] = 'ycio';
$string[2] = "GET /x.ida?SARA-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=X HTTP/1.1\nHost: sara.sara.sara\r\n\r\n";
$attack[2] = 'MS Index services (idq.dll) may be vulnerable to buffer overflow (MS01-033)';
$svcode[2] = 'bo';

if ($#ARGV < 1) {
   die "Usage: http.sara [-v] [-a attack#] port target\n";
}
# Get Attack Mode
foreach (keys %ENV) {
  $level_flag=$ENV{SARA_LEVEL};
}
$extreme = 0;
$extreme = 1 if $level_flag == 3 || $level_flag == 5;
$target = "$ARGV[1]";
$port ="$ARGV[0]";
if($ARGV[0] =~ /\:/) {
   $port =~ s/\:TCP//;
} else {
   open(SERVICES, $SERVICES) or die "$0: cannot open $SERVICES: $!\n";
   while(<SERVICES>) {
      $port_name{$1} = $2 if /(\S+)\s+([0-9]+)\/tcp/;
   }
   $port = $port_name{$ARGV[0]} if $port_name{$ARGV[0]};
}

if (!$port) {
   $port = getservbyname($ARGV[0], "tcp");
}

$service   = $ARGV[0];
exit if $service eq "https" || $port == 443;
$status    = "a";
$severity  = "g";
$trustee   = "";
$trusted   = "";
$service_output = "";
$printed   = 0;
$apache    = 0;
$netscape  = 0;
$php       = 0;
$openssl   = 0;
$iis_5     = 0;
$win2k     = 0;
$iis_pwd_bd= 0;
$response  = 0;
if ($service eq "http"){ 
  $text = "offers http";
} else {
  $text = "offers http on port $service";
}
#
# Check for selected attack request
#
if ($opt_a) {
  $i = 0;
  (@tmp) = split(/,/,$opt_a);
  for (@tmp) {
    if (/\-/) {
      ($start,$stop) = split(/\-/);
      for $cnt ($start .. $stop){
       $selected[$i] = $cnt;
       $i++
      }
    } else {
      $selected[$i] = $_;
      $i++;
    }
  }
}

#
#  Dtermine if it is Windows 2000 or above
#
  $args = "-f 3 -b -s \"QUIT\n\" $target 445";
  die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");
  while(<SCAN>) {
    chomp;
    if (/^445/ && /::$/) {
      $win2k=1;
    }
  }

$i = 0;
while ($string[$i]) {
   if(@selected) {
     $go_selected = 0;
     for (@selected) {
      $go_selected = 1 if ($i == $_);
     }
     if ($go_selected != 1) {
       $i = $i +1;
       next;
     }
    }
   $iis_pwd_bd = 1 if($attack[$i] eq "Potential Microsoft password backdoor");
   $args = "-w 15 -bs  \"$string[$i]\" $target $port";
   print "\n$string[$i]\n" if $opt_v;
   die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");
   while(<SCAN>) {
   $response = 1;
   $iis_pwd_bd = 0 if($attack[$i] eq "Potential Microsoft password backdoor");
   print $_ if $opt_v;
   if(/::$/) {
     $i = $i +1;
     next
   }
       }
   }
 }

#
#  Test for O'Reilly, Netscape, and Apache Server Server.
#     If O'Reilly and Version < WebSitePro/2.5
#     If Enterprise less than 4.1 then vulnerable;
#     If Enterprise 2.6. SP3, then Admin Server (if running) vulnerable
#     If Fastrack less than 4.0 then vulnerable
#


       $iis_5 = 1 if (/Server: Microsoft-IIS\/5.0/);

      if (/20[01] OK/){
       if ($string[$i] =~ /HTTP/ && ! /disable/i && ! /Cache Manager Daemon/i) {
        if (! /Not Found/ && ! /Denied/i) {		# User defined 404
         if (! /only be used on local server/) {	# Cold Fusion
          if(! /FrontPage Error/) {                    # Front Page 
           if(! /Bad Request/i && ! /bad-request/) {
            $SANITY="" if $attack[$i] eq "sanity";     #Case where always 200
            if($SANITY) {
                if ($attack[$i] =~ "RDS") {
                  $args = "-N -h $target";
                  open (RDS, "$MSADC $args |");
                  while (<RDS>) {
                   chomp;
                   if (/Machine/) {
                    ($dum0, $name) = split(/:/);
                    $name =~ s/\s+//;
                    if ($name) {
                      $service = $ARGV[0];
                      $sid = "HTTP-264";
                      ($severity,$service_output,$text) = &get_sid($sid);
                      $text .= " ($service)";
                      $status = "a";
                      $trustee = "ANY\@ANY";
                      $trusted = "ANY\@ANY";
                      &sara_print();
                      $printed = 1;
                    }
                   }
                  }
                } elsif($attack[$i] =~ /Index services/) {
                    if(/0xc0000005/) { 
                      $status = "a";
                      $service = $ARGV[0];
                      $sid = "HTTP-265";
                      ($severity,$service_output,$text) = &get_sid($sid);
                      $text .= " ($service)";
                      $trustee = "ANY\@ANY";
                      $trusted = "ANY\@ANY";
                      &sara_print();
                      $printed = 1;
                    }
              }
             }
            }
          }
         }
        }
       }
     } elsif (/500/ && /Server/ && !/OK/) {
        $SANITYCGI="" if $attack[$i] eq "sanity";     #Case where always 500
        if ( $SANITYCGI ) {
#         if ($string[$i] =~ /infosrch/ || $attack[$i] =~ /shell/) { 
         if ($attack[$i] =~ /shell/) {
           $service = $ARGV[0];
           $status = "a";
           $trustee = "ANY\@ANY";
           $service_output = "possible http cgi access";
           $trusted = "ANY\@ANY";
           $text = "WWW: $attack[$i] is active and may be vulnerable ($service)";
           $severity = $svcode[$i];
           &sara_print ();
           $printed=1;
         } 
       }
     } 
   }
   close(SCAN);
   $i = $i + 1;
 }
#
#  MS IIS 5 backdoor section
#
}
if ($printed == 0 && $response == 1) {
  &sara_print();
}
sub iis_buffer_overflow {

#
#Buffer overflow strings for IIS 5
#
$_bo_mode = 0 if ($bo_mode eq "ISAPI");
$_bo_mode = 1 if ($bo_mode eq "RAD");
$bo_string[0] = "GET /NULL.printer HTTP/1.0\n" . "Host: SARA-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n\n";
$bo_attack[0] = "IIS 5.0 (ISAPI) is vulnerable to buffer overflow (MS 29231)";
$bo_svcode[0] = "bo";
$bo_when[0]   = "win2k";

$bo_string[1] = " GET /_vti_bin/_vti_aut/fp30reg.dll?AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA HTTP/1.0\n\n\n";
$bo_attack[1] = "MS FrontPage (RAD) is vulnerable to buffer overflow (MS01-035)";
$bo_svcode[1] = "bo";
$bo_when[1]   = "win2k";


#
#  IIS 5.x Buffer Overflow Section
#     IIS 5 ISAPI: always runs (only on Win 2000)
#     IIS 5 idq.dll runs on Windows 2000 (and above) targets
#     IIS FrontPage RAD test only runs in extreme mode
#
   $cnt = $_bo_mode;
   if ($extreme != 1) {
     if ($bo_when[$cnt] ne "ALL") {
       if (($bo_when[$cnt] eq "win2k" && $win2k == 0) || !$bo_when[$cnt]) {
           return -1;
       }
     }
   }
   $bo_response = 0;
   $bo_wait = 0;
   $args = "-w 5 -bs  \"$bo_string[$cnt]\" $target $port";
   print "\n$bo_string[$cnt]\n" if $opt_v;
   die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");
   while(<SCAN>) {
     chomp;
     print "$_\n" if $opt_v;
   }
   close(SCAN);
   $get_string = "GET /\n";
   $args = "-w 5 -bs  \"$get_string\" $target $port";
   print "$get_string\n" if $opt_v;
   die "Can't open $TCP_SCAN: $!\n" unless open(TMP, "$TCP_SCAN $args|");
   while(<TMP>) {   
     chomp;
     $bo_response = 1;
     print "$_\n" if $opt_v;
   }
   close(TMP);
   if ($bo_response == 0) {
     $service = $ARGV[0];
     $status = "a";
     $trustee = "ANY\@ANY";
     $service_output = "Vulnerable Web Server ($bo_mode) [CA-2002-09]";
     if ($bo_attack[$cnt] =~ /RAD/) {
       $service_output = "Vulnerable FrontPage (RAD)";
     }
     $trusted = "ANY\@ANY";
     $text = "$bo_attack[$cnt] ($service)";
     $severity = $bo_svcode[$cnt];
     &sara_print();
     $printed = 1;
     sleep(30);
     $bo_wait = 0; 
     return 1;
   } else {
     return 0;
   }
}
