#!/usr/bin/perl5.8.4
#
# version 1, Sat Feb 12 18:00:00 2000, last mod by todd
#

#
# Search for Backdoors and Distributed Denial of Service (DDoS) daemons
#
require 'config/paths.pl';
require 'config/sara.cf';
require 'perl/misc.pl';
require 'perllib/getopts.pl';

$usage = "usage $0 target";

die $usage unless ($#ARGV <= 0);

$target = $ARGV[0];
$ddos_flag = "FALSE";
$name = $target;

if ($name !~ /[0-9]+\.[0-9]+\.[0-9]+/) {
        ($name, $aliases, $type, $len, @ip) = gethostbyname($name);
        ($a,$b,$c,$d) = unpack('C4',$ip[0]);
        $name = "$a.$b.$c.$d";
        }
else {
        ($a, $b, $c, $d)  = split('\.',"$name");
        $name = "$a.$b.$c.$d";
}

$| = 1; 

open(SERVICES, $SERVICES) || die "$0: cannot open $SERVICES: $!\n";
while (<SERVICES>) {
	$service_name{$2} = $1 if /(\S+)\s+([0-9]+)\/udp/;
}
#NOHUP kludge to get standard out from parent and client


$status         = "a";
$service        = "worm";
$trusted        = "";
$trustee        = "";
$service_output = "";

&Getopts("v");
if ($#ARGV < 0) {
   die "Usage: bin/backdoors..sara [-v] hostname\n";
}

$target = $ARGV[0];
$port = 65535;
$args = "-s 77";
die "Can't open $FPING: $!\n" unless open(PING, "$FPING $args $target 2>&1|");

while(<PING>) {
   chop;
   if ($opt_v) {
     print "$_\n";
   }
}
close(PING);
$args = "$target $port";
die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");
while(<SCAN>) {
   if (/:/) {
         $status = "a";
         $severity = "ycio";
         $trustee = "ANY\@$target";
         $trusted = "ANY\@$target";
         $service_output = "possible backdoor found";
         $text = "possible Adam worm backdoor found";
         &sara_print();
   }
}   
close (SCAN);


$args="$DDOS_SCAN $name";
die unless open(DDOS, "$NOHUP $args|");
while(<DDOS>) {
        if ( /sicken/ || /TFN/ || /PONG/ || /shaft/ ||/pong/ ) {
          if (/PONG/ && /trinoo/) {
             $status="a";
             $service="backdoor";
             $severity="ht";
             $trustee="ANY\@ANY";
             $trusted="ANY\@ANY";
             $service_output="distributed denial of service";
             $text="Probable trinoo handler detected";
             &sara_print();
          } elsif(/pong/ && /mstream/) {
	     $status="a";
             $service="backdoor";
             $severity="ht";
             $trustee="ANY\@ANY";
             $trusted="ANY\@ANY";
             $service_output="distributed denial of service";
             $text="Probable mstream handler detected";
             &sara_print();
          }
          if (/TFN/) {
             $status="a";
             $service="backdoor";
             $severity="ht";
             $trustee="ANY\@ANY";
             $trusted="ANY\@ANY";
             $service_output="distributed denial of service";
             $text="Probable TFN handler detected";
             &sara_print();
          }
          if (/sicken/) {
             $status="a";
             $service="backdoor";
             $severity="ht";
             $trustee="ANY\@ANY";
             $trusted="ANY\@ANY";
             $service_output="distributed denial of service";
             $text="Probable Stacheldraft handler detected";
             &sara_print();
          }
           if (/shaft/) {
             $status="a";
             $service="backdoor";
             $severity="ht";
             $trustee="ANY\@ANY";
             $trusted="ANY\@ANY";
             $service_output="distributed denial of service";
             $text="Probable shaft handler detected";
             &sara_print();
          }
}
}
close(DDOS);

