#!/usr/bin/perl
#
#  bin/rlogin.saint
#
# Report rlogin enabled
# Added check for /bin/login buffer overflow, s.k. 12/2001
# Added extreme mode check and converted to PERL, s.k. 12/2001

use Socket;
require 'perl/misc.pl';
require 'perllib/getopts.pl';

print "BEGIN\n";

&Getopts("v");

$argptr = $#ARGV;
if ($ARGV[$argptr] eq "FW" ||
    $ARGV[$argptr] eq ".PLUS" ||
    $ARGV[$argptr] eq "FW.PLUS") {
    $argptr--;
}
die "Usage: $0 [-v] hosttype target"
	if $argptr < 0;

$target = $ARGV[$argptr--];
if ($argptr >= 0) {
    $hosttype = join ' ', @ARGV[0..$argptr];
}
else {
    $hosttype = "UNKNOWN";
}
$port = 513;

# Issue warning just because rlogin is enabled
$service = "login";
$status = "a";
$severity = "zwoi";
$trustee = "ANY\@$target";
$trusted = "ANY\@$target";
$service_output = "remote login on the Internet";
$text = "rlogin is enabled";
&saint_print;

# Check for vulnerable /bin/login versions
if ($hosttype eq "AIX 4.3" ||
    $hosttype eq "AIX 5.1" ||
    $hosttype eq "AIX 4" ||
    $hosttype eq "AIX 5" ||
    $hosttype eq "AIX" ||
    $hosttype =~ /HP-UX [AB]*[6-9]/ ||
    $hosttype =~ /HP-UX [AB]*1[01]/ ||
    $hosttype eq "HP-UX" ||
    $hosttype =~ /OpenServer 5\.0\.[0-6]/ ||
    $hosttype eq "OpenServer 5.0" ||
    $hosttype eq "OpenServer 5" ||
    $hosttype =~ /OpenServer [0-4]/ ||
    $hosttype eq "SCO" ||
    $hosttype =~ /IRIX 3/ ||
    $hosttype eq "IRIX" ||
    $hosttype =~ /Solaris [2-8]/ ||
    $hosttype =~ /SunOS 5\.[2-8]/ ||
    $hosttype eq "SunOS 5" ||
    $hosttype =~ /SunOS [1-4]/ ||
    $hosttype eq "SunOS" ||
    $hosttype eq "UNKNOWN") {
	$severity = "zcio";
	$service_output = "login vulnerability";
	$text = "possible vulnerability in login";
	&saint_print;
}

