#!/usr/bin/perl
#
# yppasswdd.saint
#
# identify operating systems which have
# vulnerable versions of yppasswdd
#
# Usage: yppasswdd.saint [OS type] target [FW][.PLUS]
#
# Sam Kline, WWDSI, 6/01
#
require 'perl/misc.pl';
require 'config/paths.pl';

print "BEGIN\n";
$argptr = $#ARGV;
if (($ARGV[$argptr] eq "FW") ||
    ($ARGV[$argptr] eq ".PLUS") ||
    ($ARGV[$argptr] eq "FW.PLUS")) { $argptr--; }

$target = $ARGV[$argptr];
$service = "yppasswdd";
$argptr--;

if ($argptr < 0) {
  $ostype = "UNKNOWN";
} else {
  $ostype = join (" ", @ARGV[0..$argptr]);
}

$status = "a";
$trusted = "ANY@$target";
$trustee = "ANY@$target";

if (($ostype eq "SunOS") ||
    ($ostype eq "SunOS 5") ||
    ($ostype =~ /SunOS 5.[6-8]/) ||
    ($ostype =~ /Solaris 2.[6-8]/) ||
    ($ostype =~ /Solaris [78]/) ||
    ($ostype =~ /OpenServer 5\.0\.[56]/) ||
	# nmap might confuse OpenServer with UnixWare 7.0.0
    ($ostype =~ /UnixWare 7\.0\.0/) || 
    ($ostype eq "SCO")) {
	$severity = "bo";
	$service_output = "yppasswdd detected";
	$text = "yppasswdd may be vulnerable to buffer overflow";
	&saint_print();
} elsif (($ostype eq "UNKNOWN") ||
         # < 6.5 unknown; 6.5 >= ver < 6.5.16 vulnerable w/o patch
         ($ostype =~ /IRIX [345]/) ||
         ($ostype eq "IRIX 6") ||
         ($ostype =~ /IRIX 6\.[0-5]/)) {
	$severity = "zcio";
	$service_output = "yppasswdd detected";
	$text = "yppasswdd may be vulnerable to buffer overflow";
	&saint_print();
}

# check for evidence of exploitation
$input_tcp_scan = "id\\r\\n";
open(TCPSCAN, "$TCP_SCAN -bs \"$input_tcp_scan\" $target 77 |")
	|| die "$0: Cannot run $TCP_SCAN";
while(<TCPSCAN>) {
  if (/77/ || /rje/) {
    $severity = "ht";
    $service_output = "Vulnerability Exploits";
    $text = "Possible vulnerability exploit: 77/TCP";
    &saint_print;
  }
}

