#!/usr/bin/perl

# bin/telnet.saint
#
# Check for vulnerabilities in the telnet daemon
# by Sam Kline, 7/2001
# Added check for vulnerabilities in /bin/login
# Sam Kline, 12/2001
# Copyright 2001 World Wide Digital Security, Inc.

require 'config/paths.pl';
require 'perl/misc.pl';
require 'perllib/getopts.pl';

print "BEGIN\n";
$usage="Usage: $0 [-v] [-x 0|1] hosttype target";

&Getopts("vx:") || die $usage;
$arg_index = $#ARGV;
if ($ARGV[$arg_index] eq "FW" ||
    $ARGV[$arg_index] eq ".PLUS" ||
    $ARGV[$arg_index] eq "FW.PLUS") {
    $arg_index--;
}
die $usage if $arg_index < 0;
$target = $ARGV[$arg_index--];
$hosttype = ($arg_index >= 0) ?
	(join ' ', @ARGV[0..$arg_index]) : "UNKNOWN";

# Check for /bin/login buffer overflow
$service = "login";
$status = "a";
$trusted = "ANY\@$target";
$trustee = "ANY\@$target";
$service_output = "login vulnerability";
if ($hosttype eq "AIX 4.3" ||
    $hosttype eq "AIX 5.1" ||
    $hosttype eq "AIX 4" ||
    $hosttype eq "AIX 5" ||
    $hosttype eq "AIX" ||
    $hosttype =~ /HP-UX [AB]?[6-9]/ ||
    $hosttype =~ /HP-UX [AB]?1[01]/ ||
    $hosttype eq "HP-UX" ||
    $hosttype =~ /OpenServer 5\.0\.[0-6]/ ||
    $hosttype eq "OpenServer 5.0" ||
    $hosttype eq "OpenServer 5" ||
    $hosttype =~ /OpenServer [0-4]/ ||
    $hosttype eq "SCO" ||
    $hosttype =~ /IRIX 3/ ||
    $hosttype eq "IRIX" ||
    $hosttype =~ /Solaris [2-8]/ ||
    $hosttype =~ /SunOS 5\.[2-8]/ ||
    $hosttype eq "SunOS 5" ||
    $hosttype =~ /SunOS [1-4]/ ||
    $hosttype eq "SunOS" ||
    $hosttype eq "UNKNOWN") {
	$severity = "zcio";
	$text = "possible vulnerability in login";
	&saint_print;
}

# Check for Avirt Gateway vulnerability
$service = "telnet";
$args = "dos\\r\\n";
open(TCPSCAN, "$TCP_SCAN -bs \"$args\" $target 23 |")
	|| die "$0: cannot run $TCP_SCAN";
# Look for DOS prompt
while(<TCPSCAN>) {
    print if $opt_v;
    if (/[CDEF]:\\\\[Ww][Ii][Nn]/) {
	$severity = "rs";
	$service_output = "Avirt Gateway vulnerabilities";
	$text = "unrestricted Avirt Gateway telnet server";
	&saint_print;
    }
}

# Check for buffer overflow in telnet

# Telnet options IAC AYT (Interpret As Command: Are You There)
$args = "\\377\\366";
print "$args\n" if $opt_v;
$ayt = 0;

open(TCPSCAN, "$TCP_SCAN -Tbs \"$args\" $target 23 |")
	|| die "$0: cannot run $TCP_SCAN";
# expect a "[yes]" response
while(<TCPSCAN>) {
    print if $opt_v;
    $ayt = 1 if (/\[.*yes.*\]/i);
}
close TCPSCAN;
  
if ($ayt) {
    $service = "telnet";
    $trusted = "ANY\@ANY";
    $trustee = "ANY\@ANY";
    $status = "a";
    $service_output = "telnetd vulnerabilities";

    if ($opt_x) {
	# attempt buffer overflow
	$args = "\\377\\366" x 512;
	$ayt = 0;

	open(TCPSCAN, "$TCP_SCAN -Tbs \"$args\" $target 23|");
	while(<TCPSCAN>) {
	    print if $opt_v;
	    $ayt = 1 if (/\[.*yes.*\]/i);
	}
	close TCPSCAN;

	# if we didn't get a "[yes]" response, then buffer
	# overflow succeeded
	if (!$ayt) {
	    $severity = "bo";
	    $text = "buffer overflow in telnetd telrcv"; 
	    &saint_print;
	}
    }
    else {
	$severity = "zcio";
	$text = "possible buffer overflow in telnetd telrcv";
	&saint_print;
    }
}
