#!/usr/bin/perl5.6.1
# Security Administrators Research Assistant Plugin Module
# CIS Ruleset Director
# Copyright:  Advanced Research Corporation, 2001
#
# Plugin General Initialization Parameters
$pi_mode = "disabled";
$pi_title = "CIS Ruleset Director";
$pi_version = "CIS-1.0.1";
$pi_copyright = "Copyright, 2001, Advanced Research Corporation";

# Plugin CIS Specific Parameters
$pi_todo   = 'cis_todo'; 	# Replaces the attack parameters in sara.cf
$pi_menu   = 'cis_menu';	# Replaces the menus
$pi_home   = 'cis_home';	# Replaces the home page
$pi_data   = '';		# Replaces the data management page
$pi_target = 'cis_target';	# Replaces the target selection page
$pi_analysis = 'cis_analysis';	# Replaces the Analysis and Reporting 
$pi_report = 'cis_report';      # Replaces reportwriter call in sara
#
# Plugin Functions
#
sub cis_todo {
# Must check for conflicts on the attack level.  If a plug has already
# modified attack level and this plug is going to change (not append)
# then a conflict must be alerted and further plugin operations stopped.
if ($pi_mode eq "enabled") {
  $attack_level = 6;
  @custom2= ('rpc.sara',
	     $custom2_tcp_scan = 'tcpscan.sara 1-1000', 
             $custom2_udp_scan = 'udpscan.sara 1-1000', '*?',);
 %timeouts = (
		'smb.sara', 120,
		'relay.sara', 120,
		$custom2_tcp_scan, 60,
		$custom2_udp_scan, 60
	      );
}
return;
}

sub cis_menu {
`cp plugins/images/CISlogo-Sara.gif html/plugins/images`;
$rd = "$HTML_ROOT/dots/reddot.gif";
$bd = "$HTML_ROOT/dots/bluedot.gif";
$sc =  "<TITLE> SARA Version $sara_version ($pi_title: $pi_version)</TITLE>\n";
$sc .= "<BODY BACKGROUND=\"$HTML_ROOT/images/bckgrnd.jpg\" vlink=\"#000000\" link=\"#04289D\">\n";
$sc .= "<CENTER>\n";
$sc .= "<img src=\"$HTML_SERVER/plugins/images/CISlogo-Sara.gif\" ALT=\"CIS\" BORDER=\"0\">\n";
$sc .="</CENTER>\n";
$sc .= '<TABLE WIDTH="660" CELLPADDING="0" CELLSPACING="0" BORDER="0">\n';
$sc .= '<TR><TD WIDTH="10%" VALIGN="top">\n';
$sc .= "<IMG SRC=\"$HTML_SERVER/images/dummy.gif\">\n";
$sc .= "<A HREF=\"$HTML_SERVER/sara.html\"\n";
$sc .= "onmouseover=\"movepic('button0',\'$rd\')\"\n";
$sc .= "onmouseout=\"movepic('button0',\'$bd\')\">\n";
$sc .= "<IMG NAME=\"button0\" SRC=\"$bd\" Border = \"0\"></A>\n";
$sc .= '<strong> CIS-SARA Home </strong><P>\n';
$sc .= "<A HREF=\"$HTML_SERVER/search/sara_search_form.pl\"\n";
$sc .= "onmouseover=\"movepic('button1',\'$rd\')\"\n";
$sc .= "onmouseout=\"movepic('button1',\'$bd\')\">\n";
$sc .= "<IMG NAME=\"button1\" SRC=\"$bd\" Border = 0 ></A>\n";
$sc .= '<strong> CIS-SARA Search </strong><P>\n';
$sc .= "<A HREF=\"$HTML_SERVER/data/sara_data_form.pl\"\n";
$sc .= "onmouseover=\"movepic('button2',\'$rd\')\"\n";
$sc .= "onmouseout=\"movepic('button2',\'$bd\')\">\n";
$sc .= "<IMG NAME=\"button2\" SRC=\"$bd\" Border = 0 ></A>\n";
$sc .= '<strong> Data Management</strong><P>\n';
$sc .= "<A HREF=\"$HTML_SERVER/running/sara_run_form.pl\"\n";
$sc .= "onmouseover=\"movepic('button3',\'$rd\')\"\n";
$sc .= "onmouseout=\"movepic('button3',\'$bd\')\">\n";
$sc .= "<IMG NAME=\"button3\" SRC=\"$bd\" Border = 0 ></A>\n";
$sc .= '<STRONG>Target selection</STRONG><p>\n';
$sc .= "<A HREF=\"$HTML_SERVER/reporting/analysis.pl\"\n";
$sc .= "onmouseover=\"movepic('button4',\'$rd\')\"\n";
$sc .= "onmouseout=\"movepic('button4',\'$bd\')\">\n";
$sc .= "<IMG NAME=\"button4\" SRC=\"$bd\" Border = 0 ></A>\n";
$sc .= '<STRONG> Data Analysis</STRONG><p>\n';
$sc .= "<A HREF=\"$HTML_SERVER/admin/sara_cf_form.pl\"\n";
$sc .= "onmouseover=\"movepic('button5',\'$rd\')\"\n";
$sc .= "onmouseout=\"movepic('button5',\'$bd\')\">\n";
$sc .= "<IMG NAME=\"button5\" SRC=\"$bd\" Border = 0 ></A>\n";
$sc .= '<strong>Configuration Mgt</strong><p>\n';
$sc .= "<A HREF=\"$HTML_SERVER/sara_documentation.html\"\n";
$sc .= "onmouseover=\"movepic('button6',\'$rd\')\"\n";
$sc .= "onmouseout=\"movepic('button6',\'$bd\')\">\n";
$sc .= "<IMG NAME=\"button6\" SRC=\"$bd\" Border = 0 ></A>\n";
$sc .= '<strong>Documents/CVE</strong><p>\n';
$sc .= "<A HREF=\"$HTML_SERVER/docs/FAQ.html#trouble\"\n";
$sc .= "onmouseover=\"movepic('button7',\'$rd\')\"\n";
$sc .= "onmouseout=\"movepic('button7',\'$bd\')\">\n";
$sc .= "<IMG NAME=\"button7\" SRC=\"$bd\" Border = 0 ></A>\n";
$sc .= '<strong>Troubleshooting</strong><P>\n';
$sc .= "<A HREF=\"http://www.sans.org/topten.html\">\n";
$sc .= "<img src=\"$HTML_SERVER/images/top-10-certified.gif\"></A>\n";
$sc .= "<A HREF=\"http://cve.mitre.org\">\n";
$sc .= "<img width=110 src=\"$HTML_SERVER/images/cvebanner.jpg\"></A>\n";
return "$sc";
}

sub cis_home {
$sc  = "<HR>\n";
$sc .= "Advanced Research Corporation (ARC) and The Center for \n";
$sc .= "Internet Security (CIS) have entered into an agreement for\n";
$sc .= "ARC to provide a SARA plug-ins for the Center's network security \n";
$sc .= "benchmarks.  The integrated facility is known as CIS-SARA. \n";
$sc .= "The Center's subscription service includes operating system\n";
$sc .= "specific benchmarks reflecting a global consensus on the settings \n";
$sc .= "required for prudent security practice, plus the ARC plug-in for \n";
$sc .= "SARA that enables Center subscribers to continuously monitor the \n";
$sc .= "status of their benchmark settings.  \n";
$sc .= "<P>\n";
$sc .= "The Center's goal is to substantially increase the ambient \n";
$sc .= "security status of computers connected to the Internet around the \n";
$sc .= "globe, thus making e-commerce and other computer uses more secure \n";
$sc .= "and less vulnerable to unauthorized intrusions.  For further \n";
$sc .= "information, see the Center's website at\n";
$sc .= "<A HREF=\"http://www.cisecurity.org\"><i>www.cisecurity.org</i></a>.\n";
$sc .= "<P>\n";
$sc .= "ARC is the provider of publicly available security auditing tools \n";
$sc .= "such as SARA for network analysis and TARA for system analysis.  \n";
$sc .= "Information and downloads for SARA and TARA can be found at ARC's \n";
$sc .= "website at <A HREF=\"http://www-arc.com\"><i>www-arc.com</i></a>.\n";
$sc .= "<HR>\n";
$sc .= "<center>\n";
$sc .= "<i>Copyright:  Advanced Research Corporation 2001</i>\n";
$sc .= "</center>\n";
  return $sc;
}

sub cis_target {
my $screen ='';
if ($pi_mode eq "enabled") {
($_host) = split(/,/, $html_script_args);

#
# First figure out what radio buttons etc. should be "on". Note: the
# variables below are global. Perhaps we should hide in our own package
# name space.
#
@check_subnets = ("checked","");
 foreach (keys %ENV) {
   $firewall_flag=$ENV{SARA_FW};
}
$fwf = 0;
$fwf = 1 if $firewall_flag;

@check_firewall = ("checked","") if $fwf == 0; 
@check_firewall = ("","checked") if $fwf == 1;

#
# In case the primary target has not yet been set.
#
$primary_target = $THIS_HOST unless $primary_target;
$_host = $primary_target unless $_host;
$screen = '<Center><H1>SARA Target Selection</H1></Center>';
if ($daemon && $allow_scan == 0) {
   $screen .= '<H3>Target Selection Prohibited</H3>\n';
   $screen .= ' SARA does not allow remote target selection\n<HR>\n';
} else {
  $screen .= '<hr>\n<FORM METHOD=POST ACTION="sara_run_action.pl">\n';
  $screen .= '<H3> Primary target selection </H3>\n';
  $screen .= 'Primary target host, network, or range.<BR>';
  $screen .= '<Font size=1>\n<PRE>\n';
  $screen .= 'Host example     myhost.local.com\n';
  $screen .= 'Hosts example    myhost1.local.com myhost2.local.com ...\n';
  $screen .= 'Network example  192.168.0.0/23 (two class C subnets)\n';
  $screen .= 'Range example    192.168.0.55-192.168.0.98\n';
  $screen .= '</PRE>\n</Font>\n';
  $screen .= "<INPUT SIZE=\"48\" NAME=\"primary_target\" Value=\"$_host\">\n";
  $screen .= '<input Type=hidden Name=sequence Value="$seq">\n';
  $screen .= '<P>\n<DL compact>\n';
  $screen .= '<DT><DD><input type=radio ';
  $screen .= "name=\"attack_proximate_subnets\" value= \"0\" $check_subnets[0]>\n";
  $screen .= 'Scan the referenced target(s), network(s), or range.\n';
  $screen .= '<DT><DD><input type=radio ';
  $screen .= "name=\"attack_proximate_subnets\" value= \"1\" $check_subnets[1]>\n";
  $screen .= 'Scan hosts in the primary subnet.\n</DL>\n<HR>\n';
  $screen .= '<h3>Firewall Support </h3>\n';
  $screen .= 'Is the host you are scanning behind a firewall?  If it is, ';
  $screen .= 'you should enable firewall support, or your results might not';
  $screen .= ' be accurate, or you might get no results at all.\n';
  $screen .= "<Dl compact>\n<DT><DD><input type=radio name=\"fw_flag\"";
  $screen .= " value= \"0\" $check_firewall[0]>";
  $screen .= 'No Firewall Support\n';
  $screen .= '<DT><DD><input type=radio name="fw_flag" ';
  $screen .= "value= \"1\" $check_firewall[1]> Firewall Support\n";
  $screen .= '</DL><CENTER>\n';
  $screen .= '<INPUT TYPE="submit" VALUE=" Start the scan "></CENTER>\n<P>\n';
  if ($daemon) {
    $screen .= '<I>Note:  Once started, the scan cannot be interrupted.';
    $screen .= 'For single host scans, the process should take less than'; 
    $screen .= '10 minutes.  For network scans, it may take several hours.';
    $screen .= 'This screen will not change until the scan is complete.</I>';
  }
  $screen .= '</FORM>\n</BODY>\n</HTML>\n';
  $screen .= '</TD></TABLE>\n';
}
  return $screen;
}

sub cis_analysis {
  my $r_host = $r_ip = "";
  my $r_service = $r_test = $r_string = $r_pass = $r_msg ="";
  my @r_rules = "";
  my $r_cnt = 0;
  my $r_host_f = "results/$sara_data/all-hosts";
  my $r_facts_f = "results/$sara_data/facts";
  die "No cis.rules in plugin dir" unless open (RULES, "plugins/cis.rules");
  print CLIENT <<EOF;
<TABLE Border = 3>
<TR><TD><B>Host</B></TD>
<TD><B>Service</B></TD>
<TD><B>CIS Level</B></TD>
<TD><B>Warning</B></TD>
<TD><B>Information</B></TD></TR>
EOF
  while (<RULES>) {
    chomp;
    $line = $_;
    if ($line !~ /#/ && $line) {
      $r_rules[$r_cnt] = $line;
      $r_cnt++
    }
  }
  close (RULES);
#
# Begin processing hosts
#
  die "No all_hosts in results/$r_host_f" unless open(HOSTS,"$r_host_f");
  while (<HOSTS>) {
   chomp;
   ($r_host, $r_ip) = split(/\|/, $_);
   (@r_facts) = `grep \"$r_host\" $r_facts_f`;
#
# Begin processing rules/host
#
   for (@r_rules) {
    ($r_service,$r_test,$r_string,$r_level,$r_msg0,$r_msg1) = split(/\|/, $_);
    @fact_h_r = grep(/\|$r_service\|/, @r_facts);
    if (@fact_h_r) {
# Search ...
      if ($r_test =~ /search/) {
        $_results = grep(/$r_string/, @fact_h_r); 
        if ($_results >> 0) {
          $r_search = "TRUE";
          $r_tmp = "$r_host,$r_service,$r_level,$r_msg0,-\n";
          $r_tmp = "" if ! $r_msg0;
        } else {
          $r_search = "";
          $r_tmp = "$r_host,$r_service,$r_level,-,$r_msg1\n";
          $r_tmp = "" if ! $r_msg1;
        }
# Searchif ...
      } elsif ($r_test =~ /searchif/ && $r_search eq "TRUE") {
        $_results = grep(/$r_string/, @fact_h_r);
        if ($_results >> 0) {
          $r_search = "TRUE";
          $r_tmp = "$r_host,$r_service,$r_level,$r_msg0,-\n";
          $r_tmp = "" if ! $r_msg0;
        } else {
          $r_search = "";
          $r_tmp = "$r_host,$r_service,$r_level,-,$r_msg1\n";
          $r_tmp = "" if ! $r_msg1;

        }
# Find ...
      } elsif ($r_test eq "find") {
        $_results = grep(/$r_service/, @fact_h_r);
        if ($_results) {
          $r_tmp = "$r_host,$r_service,$r_level,$r_msg0,-\n";
          $r_tmp = "" if ! $r_msg0;
        } else {
          $r_search = "";
          $r_tmp = "$r_host,$r_service,$r_level,-,$r_msg1\n";
          $r_tmp = "" if ! $r_msg1;

        }
      }
      if ($r_tmp) {
        $r_tmp =~ s/\,/<\/TD><TD>/g;
        print CLIENT "<TR><TD>$r_tmp</TD></TR>";
      }
     }
    }
  }
  close (HOSTS);
  print CLIENT "</TABLE></TD></TR></TABLE>";
  return;
}

sub cis_report {
  my $r_host = $r_ip = "";
  my $r_service = $r_test = $r_string = $r_pass = $r_msg ="";
  my @r_rules = "";
  my $r_cnt = 0;
  my $r_host_f = "results/$sara_data/all-hosts";
  my $r_facts_f = "results/$sara_data/facts";
  open(CLIENT,"> results/$sara_data/report.html");
  open(CSV,"> results/$sara_data/report.csv");
  die "No cis.rules in plugin dir" unless open (RULES, "plugins/cis.rules");
  print CLIENT <<EOF;
<TABLE Border = 3>
<TR><TD><B>Host</B></TD>
<TD><B>Service</B></TD>
<TD><B>CIS Level</B></TD>
<TD><B>Warning</B></TD>
<TD><B>Information</B></TD></TR>
EOF
  while (<RULES>) {
    chomp;
    $line = $_;
    if ($line !~ /#/ && $line) {
      $r_rules[$r_cnt] = $line;
      $r_cnt++
    }
  }
  close (RULES);
#
# Begin processing hosts
#
  die "No all_hosts in results/$r_host_f" unless open(HOSTS,"$r_host_f");
  while (<HOSTS>) {
   chomp;
   ($r_host, $r_ip) = split(/\|/, $_);
   (@r_facts) = `grep \"$r_host\" $r_facts_f`;
#
# Begin processing rules/host
#
   for (@r_rules) {
    ($r_service,$r_test,$r_string,$r_level,$r_msg0,$r_msg1) = split(/\|/, $_);
    @fact_h_r = grep(/\|$r_service\|/, @r_facts);
    if (@fact_h_r) {
# Search ...
      if ($r_test =~ /search/) {
        $_results = grep(/$r_string/, @fact_h_r); 
        if ($_results >> 0) {
          $r_search = "TRUE";
          $r_tmp = "$r_host,$r_service,$r_level,$r_msg0,-\n";
          $r_tmp = "" if ! $r_msg0;
        } else {
          $r_search = "";
          $r_tmp = "$r_host,$r_service,$r_level,-,$r_msg1\n";
          $r_tmp = "" if ! $r_msg1;
        }
# Searchif ...
      } elsif ($r_test =~ /searchif/ && $r_search eq "TRUE") {
        $_results = grep(/$r_string/, @fact_h_r);
        if ($_results >> 0) {
          $r_search = "TRUE";
          $r_tmp = "$r_host,$r_service,$r_level,$r_msg0,-\n";
          $r_tmp = "" if ! $r_msg0;
        } else {
          $r_search = "";
          $r_tmp = "$r_host,$r_service,$r_level,-,$r_msg1\n";
          $r_tmp = "" if ! $r_msg1;

        }
# Find ...
      } elsif ($r_test eq "find") {
        $_results = grep(/$r_service/, @fact_h_r);
        if ($_results) {
          $r_tmp = "$r_host,$r_service,$r_level,$r_msg0,-\n";
          $r_tmp = "" if ! $r_msg0;
        } else {
          $r_search = "";
          $r_tmp = "$r_host,$r_service,$r_level,-,$r_msg1\n";
          $r_tmp = "" if ! $r_msg1;

        }
      }
      if ($r_tmp) {
        print CSV "$r_tmp";
        $r_tmp =~ s/\,/<\/TD><TD>/g;
        print CLIENT "<TR><TD>$r_tmp</TD></TR>";
      }
     }
    }
  }
  close (HOSTS);
  print CLIENT "</TABLE></TD></TR></TABLE>";
  close(CLIENT);
  close(CSV);
  return;
}
}

