#!/usr/bin/perl
#######################################
# Filename: sendmail.saint            #
#######################################

#  6/15/99
#  Fixed bug found by, Camiel Dobbelaar <camield@inet.unisource.nl>, on line 107
#  Also, Camiel saw the /200/ should be /\n200/ because of the timezone.
#  2/17/00
#  Modified VRFY/EXPN check to eliminate false alarms.
#  Eliminated EHLO check.



# >>>> Current vulnerability 8.8.1 -> 8.8.4 <<<<<<<<<
require 'config/paths.pl';
require 'perl/misc.pl';

print "BEGIN\n";

# Array of all the strings to send to the server on the port
@sm_strings = ("VRFY root\nVRFY administrator\n",
	       "EXPN root\nEXPN administrator\n");
$str_decode = ("EXPN DECODE\nEXPN UUDECODE\n");
$debug_cmd = ("DEBUG\n");

if ($#ARGV < 0) {
   die "Usage: $0 target\n";
}

$target = "$ARGV[1]";
$port ="$ARGV[0]";
if($ARGV[0] =~ /\:/) {
#   $port = $ARGV[0];
   $port =~ s/\:TCP//;
} elsif ($ARGV[0] =~ /X-(\d+)/) {
   $port = 6000 + $1;
} else {
   open(SERVICES, $SERVICES) or die "$0: cannot open $SERVICES: $!\n";
   while(<SERVICES>) {
      $port_name{$1} = $2 if /(\S+)\s+([0-9]+)\/tcp/;
   }
   $port = $port_name{$ARGV[0]} if $port_name{$ARGV[0]};
}

if (!$port) {
   $port = getservbyname($ARGV[0], "tcp");
}

foreach $string (@sm_strings) { 
   $args = "-bs \"$string\" $target $port";
   die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");

   while(<SCAN>) {
      if (/250/) {
         $service = $ARGV[0];
         $status = "a";
	 $severity = "zwoi";
	 $trustee = "ANY\@$target";
	 $trusted = "ANY\@$target";
	 $service_output = "sendmail info";
         ($info, $junk) = split(/ /, $string);
	 $text = "Sendmail command $info is enabled";
         &saint_print();
      }
   }
   close(SCAN);
}

#Determine if Sendmail Version is vulnerable to the decode flaw
   $args = "-bs \"$str_decode\" $target $port";
   die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");

   while(<SCAN>) {
    if (/\/bin\//) {
      $service = $ARGV[0];
      $status = "a";
      $severity = "uw";
      $trustee = "ANY\@$target";
      $trusted = "ANY\@$target";
      $service_output = "sendmail decode";
      $text = "Sendmail can write to user files using decode";
      &saint_print();
    }
   }
   close(SCAN);

#(Sendmail version buffer overflow now checked from rules/facts)
#Check to see if DEBUG comand attack can be used
   $args = "-bs \"$debug_cmd\" $target $port";
   die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");

   while(<SCAN>) {
    if (/\n200/) {
      $service = $ARGV[0];
      $status = "a";
      $severity = "uw";
      $trustee = "ANY\@$target";
      $trusted = "ANY\@$target";
      $service_output = "Sendmail vulnerabilities";
      $text = "Sendmail is vulnerable to attack using DEBUG command";
      &saint_print();
    }
   }
   close(SCAN);
