#!/usr/bin/perl5.8.4

# bin/ssh.sara
#
# Last Mod 19 Mar 01, 23:30:00 by Bob Todd
# Last Mod 20 Nov 01, 23:30:00 by Bob Todd
# Last Mod 03 Dec 01, 19:00:00 by Bob Todd
# Last Mod 30 May 02, 18:00:00 by Bob Todd
# Last Mod 10 May 04, 12:00:00 by Bob Todd
# Last Mod 28 Jan 07, 12:00:00 by Bob Todd
#
require 'config/paths.pl';
require 'config/sara.cf';
require 'perl/misc.pl';
require 'perllib/getopts.pl';

$service  = "ssh";
$port = "22";
&Getopts("v");

if ($#ARGV < 0) {
   die "Usage: bin/ssh.sara [-v] hostname\n";
}

$target = $ARGV[0];
$service_output = $_;
$status = "a";
$severity = "g";
$text = "offers ssh";
$args = "-bs \"quit\"";

die "Can't open $TCPSCAN: $!\n" unless open(TCP, "$TCP_SCAN $args $target $port 2>&1|");

while(<TCP>) {
   chop;
   if (/SSH/i) {
     $service_output = $_;
     if (/OpenSSH/) {
       if (/OpenSSH_1/||/OpenSSH_2/) {
         $status  = "a";
         $sid = 'SSH-001';
         ($severity,$service_output,$text, $cve) = &get_sid($sid);
         $trustee = "ANY\@$target";
         $trusted = "ANY\@$target";
       } elsif (/_3.[0-7]/ && !/_3.7.1p2/) {
         $status  = "a";
         $sid = 'SSH-001';
         ($severity,$service_output,$text, $cve) = &get_sid($sid);
         $trustee = "ANY\@$target";
         $trusted = "ANY\@$target";
       } elsif (/_4.[0-3].p/) {
         $status  = "a";
         $sid = 'SSH-003';
         ($severity,$service_output,$text, $cve) = &get_sid($sid);
         $trustee = "ANY\@$target";
         $trusted = "ANY\@$target";
        } elsif (/_3.8.1/) {
         $status  = "a";
         $sid = 'SSH-004';
         ($severity,$service_output,$text, $cve) = &get_sid($sid);
         $trustee = "ANY\@$target";
         $trusted = "ANY\@$target";
       }

     } else { 
       if (/SSH-2.0-3.0.0/ || /SSH-2.0-3.0.1/ || /SSH-2.0-3.1.1/ || /SSH-2.0-2.3
.1/) {
        if (!/F-SECURE/) {
         $status  = "a";
         $sid = 'SSH-002';
         ($severity,$service_output,$text, $cve) = &get_sid($sid);
         $trustee = "ANY\@$target";
         $trusted = "ANY\@$target";
        }
       }
     }
  }
}

if ($severity) {
   &sara_print();
}
close(TCP);
#------------------------------------------------------------------------
$SSH      = "bin/sssh";
$OPTIONS  = "-n";
$CMD      = "saracmd;exit";
$USR_FILE = "rules/auth-data/users";
$PWD_FILE = "rules/auth-data/passwords";
if (-e $SSH) {
  @users = "";
  $usr_cnt = 0;
  ($hostname,$dummy) = split(/\./, $target);
  open (USR, "$USR_FILE");
  while (<USR>) {
    chomp;
    if (/\%HOST/) {
      $_ = "";
      $_ = $hostname if ($hostname =~ /[a-zA-Z]/);
    }
    $users[$usr_cnt++] = $_;
  }    
  @pwds    = ("", "\%USER", "pa\$\$w0rd");
  $pwd_cnt = 3;
  if ($use_passwords == 1) {
    @pwds = "";
    $pwd_cnt = 0;
    open (PWD, "$PWD_FILE");
    while (<PWD>) {
      chomp;
      next if (/^\#/);
      next if (/NETBIOS/);
      $pwds[$pwd_cnt++] = $_;
    }
  }
  for $user (@users) {
    next if !$user;
    for $pwd (@pwds) {
      $pass = $pwd;
      if ($pwd =~ /\%USER1/) {
        $pass  = $user;
        $pass .= "1";
      } elsif ($pwd =~ /\%USER/) {
        $pass  = $user;
      }
      $pass  = "\'$pass\'";
      print "$SSH -l $user -p $pass $OPTIONS $target \"$CMD\"\n" if $opt_v;
      open (SSH, "$SSH -l $user -p $pass $OPTIONS $target \"$CMD\" 2>&1|");
      while (<SSH>) {
        print if $opt_v;
        if (/Permission denied/ || /Protocol/i) {
        last;
      }
      elsif (/saracmd/i) {
        $status = "a";
        $sid = 'MISC-002';
        ($severity,$service_output,$text, $cve) = &get_sid($sid);
        $text =~ s/\;/$user/;
        $text =~ s/\;/$pass/;
        $text =~ s/\;/$service/;
        &sara_print();
        last;
      }
     }
   }
 }
}
close (SSH);
