#!/usr/bin/perl
# Look for backdoors
#
$|=1;
require "lib/sapi.pl";

$usage    = "usage $0 target\n";

# Try to figure out system commands

$NMAP     = "/usr/bin/nmap";     $NMAP    = "/usr/local/bin/nmap" unless -f $NMAP;   $NMAP = "nmap" unless -f $NMAP;
$RPCINFO  = "/usr/sbin/rpcinfo"; $RPCINFO = "rpcinfo"             unless -f $RPCINFO;
$FTP      = "/usr/bin/ftp";      $FTP     = "ftp"                 unless -f $FTP;
$UDP_SCAN = $NMAP." -oM - -sU";
$found    = 0;

# Get the target IP address

$target = $ARGV[0] or die $usage;
print "Checking for vulnerable services\n";

# Set the ports to scan

@tcpports      = qw(48 555 1243 6711 6776 6969 7597 12345 16959 20034 21554 23456 27374 30100 30102 31785);
@udpports      = qw(2140 3150 10067 10167 31337 31789 31791);
$imap_port     = 143;
$sendmail_port = 25;

### Check TCP ports

$timeout = 3;
$script = <<EOS;
send: ver
send: QUIT
expect: EOF
EOS

foreach $port (@tcpports) {
  ($ret,$msg) = &sapi($target,$port,$script,$timeout);
  next unless $ret;
  if ( ($port == 12345) or ($port == 20034) )                             { $netbus      = 1; $found = 1; }
  if (  $port == 48  )                                                    { $drat        = 1; $found = 1; }
  if ((($port == 30100) or ($port == 30102)) and ($msg =~ /NetSphere/i) ) { $netsphere   = 1; $found = 1; }
  if ( ($port == 6969)  and ($msg =~ /GateCrasher/i) )                    { $gatecrasher = 1; $found = 1; }
  if (  $port == 7597  )                                                  { $qazworm     = 1; $found = 1; }
  if ( ($port == 21554) and ($msg =~ /GirlFriend/i) )                     { $girlfriend  = 1; $found = 1; }
  if ( ($port == 31785) and ($msg =~ /host/) )                            { $hackatack   = 1; $found = 1; }
  if ( ($port == 23456) and ($msg =~ /EvilFTP/i) )                        { $evilftp     = 1; $found = 1; }
  if ( ($port == 555)   and ($msg =~ /phAseZero/i) )                      { $phasezero   = 1; $found = 1; }
  if ((($port == 1243)  and ($msg =~ /connected/i)) or
      (($port == 16959) and ($msg =~ /PWD/i)) or
       ($port == 27374) or ($port == 6776) or ($port == 6711))            { $subseven    = 1; $found = 1; }
}

### Check IMAP

$script = "send: a002 LOGOUT\nexpect: EOF\n";
($ret,$msg) = &sapi($target,$imap_port,$script,$timeout);

if ( ($ret == 1) and ($msg =~ /OK/) and !($msg =~ /Microsoft/) and
    !($msg =~ /Netscape/) and !($msg =~ /NTMail/) and !($msg =~ /IMail/) ) {
    $v = $version = (split(/ /,$msg))[4];
    $v =~ s/v//; $v =~ s/\.//;
    if ($v < 10234)                               { $imap     = $version; $found = 1; }
}

### Check Sendmail

$script = "send: DEBUG\nsend: QUIT\nexpect: EOF";
($ret,$msg) = &sapi($target,$sendmail_port,$script,$timeout);

if ( ($ret == 1) and ($msg =~ /^200/) )           { $sendmail   = 1; $found = 1; }

### Check UDP ports

$command = $UDP_SCAN.' -p '.join(",",@udpports).' '.$target;
if (open(UDP_SCAN, "$command|")) {
  while(<UDP_SCAN>) {
    chomp;
    if ( / 31337\/open/ )                         { $backorifice  = 1; $found = 1; }
    if ( / 2140\/open/ or / 3150\/open/ )         { $deepthroat   = 1; $found = 1; }
    if ( / 10067\/open/ or / 10167\/open/ )       { $portalofdoom = 1; $found = 1; }
    if ( / 31789\/open/ or / 31791\/open/ )       { $hackatack    = 1; $found = 1; }

  }
  close(UDP_SCAN);
} else {
  print "Warning: cannot run udp scan\n";
  $udperr = 1;
}

### Check mountd and nfsd via rpcinfo

$command = $RPCINFO.' -p '.$target;
if (open(RPC_SCAN, "$command|")) {
  while(<RPC_SCAN>) {
    chomp;
    ($prog, $vers, $proto, $port, $name) = split;
    if ($name eq "mountd" or $prog == 100005)     { $mountd = 1; $found = 1; }
	if ($name eq "nfsd")                          { $nfsd   = 1; $found = 1; }
  }
  close(RPC_SCAN);
} else {
  print "Warning: cannot run rpc scan (can't check mountd or nfsd)\n";
  $rpcerr = 1;
}

### Check anonymous FTP

if ( open(FTP, "$FTP -nv <<EOF
open $target
user anonymous guest\@nowhere.com
cd /
put /etc/group $$.foo
dele $$.foo
quit
EOF |")
) {
  while(<FTP>) {
    if (/^226/)                                   { $ftp = 1; $found = 1; }
  }
  close(FTP);
}

### Output the results

print "Check common services ...... ",
      (($mountd or $nfsd or $imap or $sendmail or $ftp)?"warning":"ok"),"\n";
print "  Mountd may be vulnerable\n"                                  if $mountd;
print "  NFSd may be vulnerable\n"                                    if $nfsd;
print "  Imap version ($imap) may be vulnerable to buffer overflow\n" if $imap;
print "  Sendmail is vulnerable to attack using DEBUG command\n"      if $sendmail;
print "  Anonymous FTP is writable and vulnerable to attack\n"        if $ftp;

print "Check for NetSphere ........ ",($netsphere   ?"backdoor found":"clean"),"\n";
print "Check for GateCrasher ...... ",($gatecrasher ?"backdoor found":"clean"),"\n";
print "Check for GirlFriend ....... ",($girlfriend  ?"backdoor found":"clean"),"\n";
print "Check for Hack A Tack ...... ",($hackatack   ?"backdoor found":"clean"),"\n";
print "Check for EvilFTP .......... ",($evilftp     ?"backdoor found":"clean"),"\n";
print "Check for phAseZero ........ ",($phasezero   ?"backdoor found":"clean"),"\n";

print "Check for Back Orifice ..... ",($upderr?"upd error":$backorifice ?"possible backdoor found":"clean"),"\n";
print "Check for DeepThroat ....... ",($upderr?"upd error":$deepthroat  ?"possible backdoor found":"clean"),"\n";
print "Check for Portal of Doom ... ",($upderr?"upd error":$portalofdoom?"possible backdoor found":"clean"),"\n";
print "Check for NetBus ........... ",($netbus      ?"possible backdoor found":"clean"),"\n";
print "Check for Drat ............. ",($drat        ?"possible backdoor found":"clean"),"\n";
print "Check for SubSeven ......... ",($subseven    ?"possible backdoor found":"clean"),"\n";
print "Check for Qaz trojan/worm .. ",($qazworm     ?"possible backdoor found":"clean"),"\n";

print "No backdoors found!\n" unless $found;

exit;
