#!/usr/bin/perl

# bin/ssh.saint
#
# Originally based on ssh.sara
# Last Modified: 5/23/2002
#
require 'config/paths.pl';
require 'config/saint.cf';
require 'perl/misc.pl';
require 'perllib/getopts.pl';

print "BEGIN\n";
$VER_3_OK  = "3.1.2";
$VER_OK   = "1.2.32";
$VER_MAYBE_OK = "1.2.26";
$VER_OPEN_OK = "3.1";
$VER_O_OK = "1.5.8";
$VER_VSHELL_OK = "1.0.2";
$openssh = 0;
$ossh = 0;
$vshell = 0;


if ($#ARGV < 0) {
   die "Usage: bin/ssh.saint hostname\n";
}

$target = $ARGV[0];
$service = "ssh";
$args = "-b";

die "Can't open $TCPSCAN: $!\n" unless open(TCP, "$TCP_SCAN $args $target 22 2>&1|");

while(<TCP>) {
   chop;
   if (/SSH/i) {
    @version = split("\"", $_);
    @version = split("-", @version[0]);
    $proto = @version[1];
    $version = @version[2];
    chomp $version;
    if ($version =~ /ossh/) {
	$version = @version[3];
	chomp $version;
	$ossh = 1;
    }
    if ($version =~ /OpenSSH/) {
	$version =~ s/OpenSSH_//;
	$openssh = 1;
    }
    $vshell = 1 if $version =~ /VShell/i;

    $version = $& if $version =~ /^[\d\.]+/;

    $status = "a";
    $trustee = "ANY@$target";
    $trusted = "ANY@$target";

    if ($openssh) {
      if ($version lt $VER_OPEN_OK || $proto < 2) {
	 $severity = "zcio";
	 $service_output = "SSH vulnerabilities";
	 $text = "OpenSSH $version may be vulnerable";
	 &saint_print();
      }
    } elsif ($ossh) {
      if ($version lt $VER_O_OK) {
	 $severity = "zcio";
	 $service_output = "SSH vulnerabilities";
	 $text = "OSSH $version may be vulnerable";
	 &saint_print();
      }
    } elsif ($vshell) {
      if ($version lt $VER_VSHELL_OK) {
	 $severity = "us";
	 $service_output = "VShell vulnerability";
	 $text = "Buffer overflow in VShell $version";
	 &saint_print();
      }
    } else {
      if ($version lt $VER_MAYBE_OK) {
         $severity = "us";
         $service_output = "SSH vulnerabilities";
         $text = "SSH $version is vulnerable";
         &saint_print();
      } elsif ($version lt $VER_OK ||
	       ($version >= 3 && $version lt $VER_3_OK)) {
         $severity = "zcio";
         $service_output = "SSH vulnerabilities";
         $text = "SSH $version may be vulnerable";
         &saint_print();
      } elsif ($version >= 2 && $proto < 2) {
	 $severity = "zcio";
	 $service_output = "SSH vulnerabilities";
	 $text = "SSH $version may be vulnerable";
	 &saint_print;
      }
    }
   } else {next; }
}

close(TCP);
