#!/usr/bin/perl
#
# registry.saint
# Copyright (C) 2001 World Wide Digital Security, Inc.
# by Sam Kline, WWDSI, 5/01
# modified 3/12/02 to check Windows updates (s.k.)

require 'perl/misc.pl';
require 'perllib/netbios.pl';
require 'perllib/getopts.pl';

print "BEGIN\n";

$usage = "Usage: $0 [-v] <target>";
Getopts("p:u:v") || die $usage;
die "usage" if $#ARGV < 0;
$target = $ARGV[0];
$username = $opt_u if $opt_u;
$password = $opt_p if $opt_p;

$service = "netbios";
$status = "a";

# Get NetBios name

&open_socket($target, udp, 0);
$nb_name = &netbios_name_request($target);
&close_socket;

die "cannot determine netbios name" unless $nb_name;
print "Netbios name: $nb_name\n" if $opt_v;

&netbios_init;

# Establish null session

&open_socket($target, tcp, 139);

if (!&session_request($nb_name)) {
    print "Session request failed\n" if $opt_v;
    goto CLOSE;
}
if (!&session_negotiate("NTLM")) {
    print "Session negotiate failed\n" if $opt_v;
    goto CLOSE;
}
if (!&session_setup($nb_name, "", "", "NTLM")) {
    print "Session setup failed\n" if $opt_v;
    goto CLOSE;
}

$win2k = ($remote_os =~ /Windows 5.0/ &&
	  $remote_auth =~ /Windows 2000/) ? 1:0;
$winnt4 = ($remote_os =~ /Windows NT 4.0/) ? 1:0;
if (!&tree_connect($nb_name)) {
    print "Tree connect failed\n" if $opt_v;
    goto CLOSE;
}

# Request registry

if (!&nt_create("\\winreg")) {
    print "NT create (\\winreg) failed\n" if $opt_v;
    goto CLOSE;
}
if (!&bind_pipe("\\winreg")) {
    print "Bind pipe failed\n" if $opt_v;
    goto CLOSE;
}
if (!&open_hklm) {
    print "Could not open HKEY LOCAL MACHINE\n" if $opt_v;
    goto CLOSE;
}
if (!&init_read(12)) {
    print "Could not initialize registry read\n" if $opt_v;
    goto CLOSE;
}
if (!&open_reg_entry("SYSTEM")) {
    print "Could not open SYSTEM key\n" if $opt_v;
    goto CLOSE;
}

$severity = "yi";
$trusted = "ANY\@ANY";
$trustee = "ANY\@ANY";
$service_output = "registry access";
$text = "Registry readable by null session";
&saint_print();

$username = "" if !$username;
$password = "" if !$password;

CLOSE: &close_socket;

if (defined $username) {
    # Check for Windows updates
    $severity = "zcio";
    $trusted = "ANY\@ANY";
    $trustee = "ANY\@ANY";
    $service_output = "Windows updates needed";

    &netbios_init;
    &open_socket($target, tcp, 139);

    if (!&session_request($nb_name)) {
	print "Session request failed\n" if $opt_v;
	goto CLOSE_END;
    }
    if (!&session_negotiate("")) {
	print "Session negotiate failed\n" if $opt_v;
	goto CLOSE_END;
    }
    if (!&session_setup($nb_name, $username, $password, "")) {
	print "Session setup failed\n" if $opt_v;
	warn "Cannot access $nb_name using login $username";
	goto CLOSE_END;
    }
    if (!&tree_connect($nb_name)) {
	print "Tree connect failed\n" if $opt_v;
	goto CLOSE_END;
    }
    if (!&nt_create("\\winreg")) {
	print "NT create (\\winreg) failed\n" if $opt_v;
	goto CLOSE_END;
    }
    if (!&bind_pipe("\\winreg")) {
	print "Bind pipe failed\n" if $opt_v;
	goto CLOSE_END;
    }
    if (!&open_hklm) {
	print "Could not open HKEY LOCAL MACHINE\n" if $opt_v;
	goto CLOSE_END;
    }
    if (!&init_read(12)) {
	print "Could not initialize registry read\n" if $opt_v;
	goto CLOSE_END;
    }

    # Make sure we can read the registry
    if (!&open_reg_entry("SOFTWARE\\Microsoft")) {
	print "Could not open SOFTWARE\\Microsoft key\n" if $opt_v;
	goto CLOSE_END;
    }
    # Check for updates
    if ($win2k) {
	if (!&open_reg_entry("SOFTWARE\\Microsoft\\Updates\\Windows 2000\\SP3\\SP2SRP1")) {
	    $text = "Win2000 SP2 Security Rollup 1 not installed";
	    &saint_print;
	}
	if (!&open_reg_entry("SOFTWARE\\Microsoft\\Updates\\Windows 2000\\SP3\\Q314147")) {
	    $text = "Windows 2000 SNMP hotfix not installed";
	    &saint_print;
	}
	if (!&open_reg_entry("SOFTWARE\\Microsoft\\Updates\\Windows 2000\\SP3\\Q300845")) {
	    $text = "Windows 2000 browser applet redirect";
	    &saint_print;
	}
	if (!&open_reg_entry("SOFTWARE\\Microsoft\\Updates\\Windows 2000\\SP3\\Q313829")) {
	    $text = "Windows 2000 shell buffer overflow";
	    &saint_print;
	}
	if (!&open_reg_entry("SOFTWARE\\Microsoft\\Updates\\Windows 2000\\SP3\\Q311967")) {
	    $text = "Win2000 Multiple UNC Provider buffer overflow";
	    &saint_print;
	}
    }
    if ($winnt4) {
	if (!&open_reg_entry("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Hotfix\\Q299444")) {
	    $text = "WinNT 4.0 SP6a Security Rollup 1 not installed";
	    &saint_print;
	}
	if (!&open_reg_entry("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Hotfix\\Q313829")) {
	    $text = "Windows NT 4.0 shell buffer overflow";
	    &saint_print;
	}
	if (!&open_reg_entry("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Hotfix\\Q311967")) {
	    $text = "WinNT 4.0 Multiple UNC Provider buffer overflow";
	    &saint_print;
	}
    }

CLOSE_END: &close_socket;
}
