#!/usr/bin/perl5.8.4
# 
# ostype.sara attempts todescribe the target OS 
#
# usage: ostype.sara host
# 
# ostype.sara requires a preloaded nmap.  If
# not found, ostype.sara will exit without protest.
#
# Note:  sara does not provide the nmap envrionment!
# 
# Author:  Advanced Research Corporation  8 Mar 99
#

require 'config/paths.pl';
require 'perl/misc.pl';
require 'perllib/getopts.pl';
require 'config/sara.cf';

#
   $nmap_flag=$ENV{SARA_NMAP};
#   $concurrent_processes=$ENV{CONCURRENT_PROC};
if ($nmap_flag) {
  $nmap=$NMAP;
}
if ($#ARGV != 0){
 die "Usage: hosttype.sara target\n";
}
$target=$ARGV[0];
#
#  Check for nmap program
#
$service_output = "";
die "Can't open ZAP: $!\n" unless open(SMB_OS, "$SMB_OS $target|");
while (<SMB_OS>) {
     $service_output =  "HOST Windows NT"   if /Windows 4\.0/;
     $service_output =  "HOST Windows 2000" if /Windows 5\.0/;
     $service_output =  "HOST Windows XP"   if /Windows 5\.1/;
     $service_output =  "HOST Windows 2003" if /Windows 5\.2/;
}
if ($service_output) {
  $status = "a";
  $service = "host";
  $severity = "";
  $trustee = "";
  $trusted = "";
  $text = "";
  &sara_print();
  exit;
}
if ( -e "bin/snmpscan.sara") {
  open (SNMP, "bin/snmpscan.sara -l $target|");
  while (<SNMP>) {
   $printed = 1 if /sysDescr/;
   print;
  }
}
exit if $printed == 1; 
if ( -e $nmap && $concurrent_processes == 1)
{
  $ports = $fw_ports;
  $ports =~ s/\s+/,/g;
  open (NMAP, "$nmap -sT -P0 -p $ports -O $target |");
  while (<NMAP>){
    chop;
    if ($_ =~ /^OS /){
      @name = split(": ", $_);
      $osname="@name[1]@name[2]@name[3]@name[4]@name[5]@name[6]";
# kludge since we cannot distinguish from NT4/95/98
    }
  }
  close (NMAP);
  if ($osname) {
    $status = "a";
    $service = "host";
    $trustee = "";
    $trusted = "";
    $severity = "";
    $text = "offers nmap";
    $service_output = "HOST $osname";
    &sara_print();
    $printed = 1;
  }
}
if($printed != 1) {
   $service_output = "";
   $input_stream='QUIT\\r\\n\\r\\n';
   $args = "-f 3 -bs \"$input_stream\" $target 139";
   die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");
   while(<SCAN>) {
     if ( /\\131\\000\\000\\001\\143/) {
        $service_output = "HOST Windows";
     }
  }
  $args = "-f 3 $target 445";
  die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");
  while(<SCAN>) {
    chomp;
    if (/^445/) {
      $DS = "TRUE";
    }
  }
  close (SCAN);
}
