#!/usr/bin/perl
# 
# ostype.saint gets the target OS 
# usage: ostype.saint host
# 
require 'config/paths.pl';
require 'perl/misc.pl';

print "BEGIN\n";
if (($#ARGV < 0) || ($#ARGV > 1)){
 die "Usage: ostype.saint target";
}

$target=$ARGV[0];
$status = "a";
$service = "nmap";

if ($#ARGV != 0) {
   if ($ARGV[1] !~ /FW/ && $ARGV[1] !~ /PLUS/) {
     die $usage;
   }
}

#  If NMAP exists and is executable
if (-x $NMAP) {

  if ($ARGV[1] =~ /PLUS/) {
    $ports = "21-23,25,53,79,80,109-111,113,135-139,143,443,512-515,6000";
  } else {
    $ports = "22,25,53,111,135,443,6000";
  }
  open (NMAP, "$NMAP -sS -P0 -p $ports -O $target |");
  while(<NMAP>) {
     chop;
     if (/guess(es)?: /){
       ($osname = $') =~ s/,\s*/-/g;
     }
     if (/Difficulty=(\d+)/ && $1 < 75) {
	$trustee = "ANY\@ANY";
	$trusted = "ANY\@ANY";
	$severity = "yi";
	$text = "initial TCP sequence number is predictable";
	$service_output = "TCP sequence number prediction";
	&saint_print;
     }
  }
  close NMAP;

  $trustee = "";
  $trusted = "";
  if ($osname) {
    $severity = "i";
    $text = "used nmap";
    $service_output = "NMAP $osname";
    &saint_print();
  } else {
    # make a fact anyway because it triggers smurf.saint
    $severity = "";
    $text = "cannot determine host type";   
    $service_output = "";
    &saint_print();
  }
}
