#!/usr/bin/perl
#######################################
# Filename: inn.saint                 #
#######################################


# >>>> Current vulnerability 2.2.2 <<<<<<<<<
require 'config/paths.pl';
require 'perl/misc.pl';

print "BEGIN\n";

# Array of all the strings to send to the server on the port

if ($#ARGV < 0) {
   die "Usage: $0 target\n";
}

$target = "$ARGV[1]";
$port ="$ARGV[0]";
if($ARGV[0] =~ /\:/) {
#   $port = $ARGV[0];
   $port =~ s/\:TCP//;
} elsif ($ARGV[0] =~ /X-(\d+)/) {
   $port = 6000 + $1;
} else {
   open(SERVICES, $SERVICES) or die "$0: cannot open $SERVICES: $!\n";
   while(<SERVICES>) {
      $port_name{$1} = $2 if /(\S+)\s+([0-9]+)\/tcp/;
   }
   $port = $port_name{$ARGV[0]} if $port_name{$ARGV[0]};
}

if (!$port) {
   $port = getservbyname($ARGV[0], "tcp");
}

#Determine if INN Version is vulnerable to buffer overflow
   $args = "-b $target $port";
   die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");

   while(<SCAN>) {
     if (/INN 1\.[0-5]/i) { 
      $service = $ARGV[0];
      $status = "a";
      $severity = "bo";
      $trustee = "ANY\@$target";
      $trusted = "ANY\@$target";
      $service_output = "innd vulnerabilities";
      $text = "INN pre 1.6 buffer overflow";
      &saint_print();
     }
     elsif (/INN 1\.[0-9]/ || /INN 2\.[01]/ || /INN 2\.2\.[012]/) {
      $service = $ARGV[0];
      $status = "a";
      $severity = "zcio";
      $trustee = "ANY\@$target";
      $trusted = "ANY\@$target";
      $service_output = "innd vulnerabilities";
      $text = "INN pre 2.2.3 buffer overflow";
      &saint_print();
     }
   }
   close(SCAN);
