#!/usr/bin/perl5.8.4
#  This software was derived from SATAN 1.1.1 by Dan Farmer and Wietse Venema
#  (http://www.porcupine.org/satan).
#
# See if the target provides anonymous ftp, non-intrusive.
# Version 2, Mon Mar 08 23:30:00 1999, last mod by todd
# Version 2.1, Wed May 05 21:00:00 1999, last mod by todd
# Version 2.2, Mon Sep 20 22:00:00 1999, last mod by todd
# Version 2.3, Sun Jun 25 21:00:00 2000, last mod by todd
# Version 2.4, Tue Jul 25 20:30:00 2000, last mod by todd
# Version 2.5, Wed Jan 03 23:00:00 2001, last mod by todd
# Version 2.6, Wed May 02 23:00:00 2001, last mod by todd
# Version 2.7  Fri Sep 21 23:00:00 2001, last mod by todd
# Version 2.8, Wed Dec 14 09:00:00 2005, last mod by todd
# Version 3.0  Wed Dec 14 21:00:00 2005, sid.def integration
require 'config/paths.pl';
require 'config/sara.cf';
require 'perl/misc.pl';
require 'perllib/getopts.pl';

# print STDERR "@ARGV\n";
$usage="Usage: $0 [-v] target";
&Getopts("v") || die $usage;
if ($#ARGV != 0 ) {
      die "$usage";
}

$target = $ARGV[0];

$service = &basename($0, ".sara");
$trustee         = "";
$trusted         = "";
$severity	 = "";
$service_output  = "";
$text            = "offers ftp";
$cve             = "";
$tmp_flag	 = 0;
$tmp_anon_flag   = 0;
$tmp_anon_write  = 0;
$ftp_conditional = 0;
open(FTP, "$FTP -nv <<EOF
open $target
quote user anonymous
quote pass -sara\@
cd /
put /etc/services sara.$$
dele sara.$$
quit
EOF |") || die "cannot run $FTP";
while(<FTP>) {
    if (defined($opt_v)) {
	print;
    }
    if (/Not Connected/i) {
          $status="a";
          $severity="m";
    } elsif (/wu-2.[0-5]/ || /wu-2.6.[01]\(/ || /wuarchive/) {
	  $status="a";
          $sid = "FTP-001";
          ($severity,$service_output,$text,$cve) = &get_sid($sid);
	  $trustee="ANY\@$target";
	  $trusted="ANY\@$target";
          &sara_print();
         $tmp_flag=1;
    } elsif (/ProFTPD 1\.3\.0/ && !/ProFTPD 1\.3\.0a/){
          $sid = "FTP-002";
          $trustee="ANY\@$target";
          $trusted="ANY\@$target";
          ($severity,$service_output,$text,$cve) = &get_sid($sid);
          &sara_print;
          $tmp_flag=1;
   } elsif (/Version [0-5]\.[0-9]+\/OpenBSD/ || /Version 6\.[0-4]+\/OpenBSD/) {
          $status="a";
          $sid = FTP-004;
          $trustee="ANY\@$target";
          $trusted="ANY\@$target";
         ($severity,$service_output,$text,$cve) = &get_sid($sid);
          &sara_print();
          $tmp_flag=1;
   } elsif (/FTP server \(Version 4\.3/ || /FTP server \(Version 5\.1/){
          $status="a";
         $sid = "FTP-005";
         ($severity,$service_output,$text,$cve) = &get_sid($sid);
          &sara_print();
          $tmp_flag=1;
   } elsif (/FTP server \(BeroFTP/i) {
          $status="a";
          $sid = "FTP-006";
         ($severity,$service_output,$text,$cve) = &get_sid($sid);
          &sara_print();
          $tmp_flag=1;

   } elsif (/FTP server \(Version 1\.7\.212\.[0-2]/){
          $status="a";
          $sid = "FTP-007";
          $trustee="ANY\@$target";
          $trusted="ANY\@$target";
         ($severity,$service_output,$text,$cve) = &get_sid($sid);
          &sara_print();
          $tmp_flag=1;
   } elsif (/FTP server \(Version 1\.1\.214\.[0-5]/){
          $status="a";
          $sid = "FTP-008";
          $trustee="ANY\@$target";
          $trusted="ANY\@$target";
         ($severity,$service_output,$text,$cve) = &get_sid($sid);
          &sara_print();
          $tmp_flag=1;
    } elsif ((/ FTP/ || /WFTP/i) && /^220/) {
        if (/wu\-/) {
          $ftp_conditional = 0;
        } else {
          $ftp_conditional = 1;
        }
    }
    $cve = "";
    if (/^230/) {
	$status = "a";
	$trustee = $trusted = "";
	$service_output = "ANONYMOUS";
	$text = "offers anon ftp ";
   } elsif (/^226/) {
	$tmp_anon_flag=1;
        $sid = "FTP-011";
        $trustee="ANY\@$target";
        $trusted="ANY\@$target";
        ($severity,$service_output,$text,$cve) = &get_sid($sid);
        &sara_print();
        $tmp_anon_write = 1;

   } elsif (/^553/ && $tmp_anon_flag == 0) {
        if ($tmp_flag == 1){
        }
        $severity = "";
	$service_output = "FTP-ANONYMOUS";
	$text = "~ftp is not writable";
	$trustee = $trusted = "";
        $tmp_anon_flag=1;
   } elsif (/^530/ && $tmp_anon_flag == 0) {
	$status = "a";
        if ($tmp_flag == 1){
	}
	$trustee="";
	$trusted="";
        $severity="";
	$service_output = "FTP";
	$text = "offers no anon ftp";
        &sara_print();
        $tmp_flag = 0;
      }
}
#
#  New test for pub directory writable
#
$cve = "";
if ($tmp_anon_flag == 1) {
  open(FTP, "$FTP -nv <<EOF
  open $target
  quote user anonymous
  quote pass -sara\@
  cd /pub
  put /etc/services pubsara.$$
  dele pubsara.$$$
  quit
  EOF |") || die "cannot run $FTP";
  while(<FTP>) {
    if (defined($opt_v)) {
        print;
    }
    if (/^226/) {
        $severity = "nw";
        $trustee = "~ftp@$target";
        $trusted = "ANY\@ANY";
        $service_output = "writable FTP-ANONYMOUS home directory";
        $text = "~ftp pub directory is writable";
        &sara_print();
    }
  }
}
  open(FTP, "$FTP -nv <<EOF
  open $target
  quote user anonymous
  quote pass -sara\@
  cd /incoming
  put /etc/services pubsara.$$
  dele pubsara.$$
  quit
  EOF |") || die "cannot run $FTP";
  while(<FTP>) {
    if (defined($opt_v)) {
        print;
    }
  if (/^226/) {
        $tmp_anon_write = 1;
  }
 }
open(FTP, "$FTP -nv <<EOF
  open $target
  quote user anonymous
  quote pass -sara\@
  get ../../../../../etc/services /dev/null
  get ../../../../../boot.ini /dev/null
  get .../.../.../.../.../etc/services /dev/null
  get .../.../.../.../.../boot.ini /dev/null
  quit
  EOF |") || die "cannot run $FTP";
  while(<FTP>) {
    if (defined($opt_v)) {
        print;
    }
    if (/^226/) {
       $status="a";
       $sid = "FTP-009";
       $trustee="ANY\@$target";
       $trusted="ANY\@$target";
      ($severity,$service_output,$text,$cve) = &get_sid($sid);
       &sara_print();
    }
 }
if($ftp_conditional == 1 && $tmp_anon_write == 1) {
   $status="a";
   $severity="z";
   $trustee="ANY\@$target";
   $trusted="ANY\@$target";
   $service_output="Potential FTPD vulnerabilities";
   $text="Many vendor FTPD problems if not patched";
   &sara_print();
} elsif ($severity eq "") {
   $status="a";
   $severity="g";
   &sara_print();
}


