#!/usr/bin/perl5.8.4
#
# snmpscan.sara was derived from snpscan 0.05
# snmpscan 0.05 alpha was written Knight / Phunc, knight@phunc.com
#
# snmpscan.sara tests for the pressence of 4 MIB communities.  If
# there are no communities, nothing is reported. If the "public"
# community is found, a BROWN advisory is reported.  If other
# communities are found, a YELLOW advisory is reported.  This program
# DOES NOT attempt to send any directives to change community settings.
#		
# version 1,   Fri Jan 21 23:30:00 2000, last mod by todd
# version 1.1, Wed Aug 03 21:00:00 2005, last mod by todd
#
use lib 'perl/Modules';
use Net::SNMP;
require 'config/paths.pl';
require 'config/sara.cf';
require 'perl/misc.pl';
require 'perllib/getopts.pl';

$usage = "snmpscan.sara \[-v\] target\n";
$myhosttype ='';
&Getopts("lv");
($#ARGV < 1) or die $usage;
my @hosts = ($ARGV[0]);

my $version = "0.05s alpha";
my $debug = 0;

my @comms = ( "dummy","private", "public", "ilmi", "ILMI", "system",
              "write", "all", "monitor", "agent", "manager",
              "OrigEquipMfr", "admin", "default", "password",
              "tivoli", "openview", "community", "snmp", "snmpd",   
              "Secret C0de", "security", "all private", "rmon",
              "rmon_admin", "hp_admin", "NoGaH\$\@!", "0392a0",
              "xyzzy", "agent_steal", "freekevin", "fubar",
              "secret", "cisco", "apc", "ANYCOM", "cable-docsis", 
              "c", "cc", "Cisco router", "cascade", "comcomcom",  
              "internal", "blue", "yellow", "TENmanUFactOryPOWER",
              "OrigEquipMfr", "origEquipMfr");
@comms    = ("dummy", "public") if $opt_l;
my $i=0;
my $comret=0;
my $hostname='';
my $print_flag=0;
if ($opt_v) {
  print "SNMPscan (version: $version) by knight\@phunc.com of phunc\n";
  print "         $debug Updated for SARA by Advanced Research Corporation\n\n";
  $debug = 1;
}

for ($a=0;$a<scalar(@hosts);$a++)
{
  $hostname=$hosts[$a];
  if ($opt_v) {
    print "Guessing community on host '$hostname':\n";
  }

  for $community (@comms) {
    $comret = getdescription($community);
    if($comret eq 1)
    {
     $mycommunity = $community;
     $target = $hostname;
     $service = "snmp";
     $status  ="a";
     $severity = "zcio";
     $trustee="ANY\@ANY";
     $trusted="ANY\@ANY";
     if ( $community ne "public") {
       $sid = "SNMP-003";
       ($severity,$service_output,$text,$cve) = &get_sid($sid);
       $text =~ s/\;/$community/g;
       if ( $community eq "dummy") {
         $sid = "SNMP-001";
         ($severity,$service_output,$text,$cve) = &get_sid($sid);
         $print_flag = 1;
         last;
      }
     } else {
         $sid = "SNMP-002";
         ($severity,$service_output,$text,$cve) = &get_sid($sid);
     }
     $print_flag=1;
     if ($opt_v) {
      print "\tCommunity '$community' *** successful *** \n";
     }
    } else
    { 
     if ($opt_v) {
      print "\tCommunity '$community' unsuccessful.\n";
     }
    }
  }
  if ($print_flag == 1) {
    &sara_print;
    $target = $hostname;
    $service = "snmp";
    $status  ="a";
    $severity = "";
    $trustee="";
    $trusted="";
    $severity_output="";
    $myhosttype =~ s/\n/\;/g;
    $text="snmp sysDescr is $myhosttype";
    &sara_print;
  }
}


sub getdescription {
  my ($community) = @_;
  my $port = 161;
  my @sysDescrs = ('1.3.6.1.2.1.1.1.0','1.3.6.1.4.1.410.1.1.1.1.0');
  print "Hostname: $hostname\n" if ($debug);
  print "Community: $community\n" if ($debug);
  print "Port: $port\n\n" if ($debug);
  for $sysDescr (@sysDescrs) {
    if ($sysDescr eq $sysDescrs[1]) {
      next if ($community ne "dummy" and $community ne "public");
    }
    my ($session, $error) = Net::SNMP->session(
			Hostname	=> $hostname,
			Community	=> $community,
			Port		=> $port
			);

    if (!defined($session)) {
      printf("ERROR: %s\n", $error) if ($debug);
      next;
    }
    $session->timeout(1);
    $session->retries(1);
#  $session->debug;
    my $response='';
    if (!defined($response = $session->get_request($sysDescr))) {
       printf("ERROR: %s \(mib=%s\)\n",$session->error,$sysDescr) if ($debug);
       $session->close;
       next ;
  }

       printf("System for host '%s' is: %s \(mib=%s\)\n", $hostname,
	$response->{$sysDescr},$sysDescr) if ($debug);

       $session->close;
       $myhosttype = $response->{$sysDescr};
       return 1;  
  }
  return 0;
}
