#!/usr/bin/perl
#
# bin/adore.saint
#
# Detect adore worm
#
require 'config/paths.pl';
require 'perl/misc.pl';

print "BEGIN\n";
$usage = "usage $0 target";
 
die usage if $#ARGV < 0;
$target = $ARGV[0];

$port = 65535;
$icmp_data_len = 77;
$status = "a";
$service = "adore";
$trusted = "ANY@$target";
$trustee = "ANY@$target";
$service_output = "Worm detected";

# First check whether backdoor is already open

$args = "-bs \"id\\n\" $target $port";
$already_open = 0;

open(TCP_SCAN, "$TCP_SCAN $args |")
	|| die "$0: cannot run $TCP_SCAN";

while(<TCP_SCAN>) {
	if (/uid/i) {
		$already_open = 1;
		$severity = "ht";
		$text = "Possible worm detected (Adore)";
		&saint_print();
	}
}
close (TCP_SCAN);

if (!$already_open) {
    # try to open the backdoor with an ICMP packet

    $ping_args = "-l $icmp_data_len $target";

    open(PING, "$FPING $ping_args |")
	|| die "$0: cannot run $FPING";

    close(PING);

    # see if it worked

    open(TCP_SCAN, "$TCP_SCAN $args |")
	|| die "$0: cannot run $TCP_SCAN";

    while(<TCP_SCAN>) {
	if (/uid/i) {
		$severity = "ht";
		$text = "Worm detected (Adore)";
		&saint_print();
	}
    }
    close (TCP_SCAN);
}

