#!/usr/bin/perl
#
# bin/backdoors.saint
# Look for Windows backdoors
#

require 'config/saint.cf';
require 'config/paths.pl';
require 'perl/misc.pl';
require 'perllib/getopts.pl';

print "BEGIN\n";
$usage = "usage $0 [-v] target";
 
&Getopts("v") || die $usage;
die $usage unless ($#ARGV < 2);

$target = $ARGV[0];
if ($ARGV[1] =~ "FW") {
  $firewall_flag=1;
}
$input_tcp_scan = 'ver\\r\\nQUIT\\r\\n';
$tcpports = '48 555 1243 6711 6776 6969 7597 7626 12345 16959 20034 21554 23456 27374 30100 30102 31785';
$udpports = '2140 3150 10067 10167 31337 31789 31791';

$| = 1; 

if ($firewall_flag) {
  $command = "$TCP_SCAN -f $fw_timeout -l $fw_loadlimit -bs \"$input_tcp_scan\" $target $tcpports";
} else { 
  $command = "$TCP_SCAN -bs \"$input_tcp_scan\" $target $tcpports";
}
print "$command\n" if $opt_v;

open(TCP_SCAN, "$command|")
	|| die "$0: cannot run $TCP_SCAN";

while(<TCP_SCAN>) {
	if (defined($opt_v)) {
	    print;
	}
	chop;
	if ((/^12345:/ && /NetBus/i) || /^20034:/ ) { $netbus = 1; }
	if ( /^48:/ ) { $drat = 1; }
	if ( /^7626:/ ) { $glacier = 1; }
	if ((/^30100:/ || /^30102:/) && /NetSphere/i ) { $netsphere = 1; }
	if ( /^6969:/ && /GateCrasher/i ) { $gatecrasher = 1; }
	if ( /^7597:/ ) { $qazworm = 1; }
	if ( /^21554:/ && /GirlFriend/i ) { $girlfriend = 1; }
	if ( /^31785:/ && /host/ ) { $hackatack = 1; }
	if ( /^23456:/ && /EvilFTP/i ) { $evilftp = 1; }
	if ( /^555:/ && /phAseZero/i ) { $phasezero = 1; }
	if ((/^1243:/ && /connected/i) ||
	    (/^16959:/ && /PWD/i) ||
	     /^27374:/ || /^6776:/ || /^6711:/) { $subseven = 1; }
}

$command = "$UDP_SCAN $target $udpports";
print "$command\n" if $opt_v;

open(UDP_SCAN, "$command|")
	|| die "$0: cannot run $UDP_SCAN";

while(<UDP_SCAN>) {
	if (defined($opt_v)) {
	    print;
	}
	chop;
	if ( /^31337:/ ) { $backorifice = 1; }
	if ( /^2140:/ || /^3150:/ ) { $deepthroat = 1; }
	if ( /^10067:/ || /^10167:/ ) { $portalofdoom = 1; }
	if ( /^31789:/ || /^31791:/ ) { $hackatack = 1; }
}

$status = "a";
$service = "backdoor";
$severity = "ht";
$trusted = "ANY\@$target" ;
$trustee = "ANY\@$target" ;
$service_output = "backdoor found";

if ($backorifice) {
	$text = "Possible Back Orifice backdoor found";
	&saint_print();
}
if ($netbus) {
	$text = "Possible NetBus backdoor found";
	&saint_print();
}
if ($drat) {
	$text = "Possible Drat backdoor found";
	&saint_print();
}
if ($glacier) {
	$text = "Possible Glacier backdoor found";
	&saint_print();
}
if ($deepthroat) {
	$text = "Possible DeepThroat backdoor found";
	&saint_print();
}
if ($netsphere) {
	$text = "NetSphere backdoor found";
	&saint_print();
}
if ($gatecrasher) {
	$text = "GateCrasher backdoor found";
	&saint_print();
}
if ($portalofdoom) {
	$text = "Possible Portal of Doom backdoor found";
	&saint_print();
}
if ($girlfriend) {
	$text = "GirlFriend backdoor found";
	&saint_print();
}
if ($hackatack) {
	$text = "Hack A Tack backdoor found";
	&saint_print();
}
if ($evilftp) {
	$text = "EvilFTP backdoor found";
	&saint_print();
}
if ($phasezero) {
	$text = "phAseZero backdoor found";
	&saint_print();
}
if ($subseven) {
	$text = "Possible SubSeven backdoor found";
	&saint_print();
}
if ($qazworm) {
	$text = "Possible Qaz trojan/worm backdoor found";
	&saint_print();
}
