HPAVC/HPAVC CD-ROM.iso/pc/SATAN11.ZIP/PERL/COPS2SAT.PL

Perl Script | 1995-04-11 | 5.6 KB | 211 lines

#!/usr/local/bin/perl5
#
#  An experimental script that will Convert a COPS warning report
# into SATAN rules.  Take stdin or a filename.  Uses the function
# "satan_print" to emit SATAN rules.
#

require "perl/hostname.pl";
require "perl/misc.pl";

# we're the target... nothing remote here
$target = &hostname();

#
# default value for satan_print(); everything we report is "available"
$status = "a";

# most things only affect users on the machine
$trusted = "ANY@$target";

# most things will be blank here, at least on my first shot at this...
$service_ouput = "";

# ok, process everything now:
while (<>) {

    # chow down on blank lines
    if ($_ =~ /^\s*$/) { next; }

    # top three lines look like:
    #
    # ATTENTION
    # Security Report for...
    # from host ...
    if ($_ =~ /from host/) { $start_processing = 1; next; }
    if (!$start_processing) { next; }

    # get the service, if possible --
    # assumes all checks print out something like:
    # "**** foo.chk ****"
    # when the verbose flag is true
    if ($_ =~ /^\*\*\*\*/) {
        ($service) = ($_ =~ /\*\*\*\* (\S+) /);
        next;
        }

    #  IMPORTANT - exception list!
    #
    #  Be very careful of regular expressions and other meta stuff...
    # ()'s, *'s, ?'s, /'s, etc. are all trouble.  Backquote if in doubt.
    #
    #  Sample list:
    #
    #  Hassled by mail warning?
    # next if (m@Warning!  /usr/spool/mail is _World_ writable!@);
    #
    #  Running an NIS-free machine but in an NIS environment?
    #  next if (/YG/);
    #  next if (/YP/);

    # if it doesn't start with "Warning!", then nuke the second
    # line; it's a multipart print
    next unless ($_ =~ /^Warning!/);

    #
    # START THE CHECKING
    #
    # level 0 checks -- the most serious
    #
    if ($_ =~ /A "+" entry in/) {
        $severity = "us";
        $trusted = "ANY@ANY";
        $trustee = "ANY@$target";
        $text = "+ in /etc/hosts.equiv file";
        }

    # Assume bugs are all bad -- some bugs are remote; need to
    # change this to recognize them...
    elsif (m@ould have a hole/bug@) {
        $severity = "rs";
        $trusted = "ANY@$target";
        $trustee = "root@$target";
        $text = "serious bug";
        }

    # kuang telling us we're in deep yoghurt, or something like that...
    elsif ($_ =~ /DO ANYTHING/) {
        $severity = "rs";
        $trusted = "ANY@$target";
        $trustee = "root@$target";
        $text = "kuang found a path to compromise root";
        }

    # writable password file really sucks:
    elsif ($_ =~ /\/etc\/passwd.*_World_/) {
        $severity = "rs";
        $trusted = "ANY@$target";
        $trustee = "root@$target";
        $text = "world-writable password file";
        }

    # this is easy root most of the time...
    elsif ($_ =~ /Directory.*is _World_ writable and in roots path!/) {
        $severity = "rs";
        $trusted = "ANY@$target";
        $trustee = "root@$target";
        $text = "world-writable file in root's path";
        }

    # level 1 checks:
    #
    elsif ($_ =~ /uudecode is suid!/) {
        $severity = "uw";    # cops should tell us *what* user, eh?
        $trusted = "ANY@$target";
        $trustee = "user@$target";
        $text = "uudecode is suid";
        }
    elsif ($_ =~ /rexd is enabled in/) {
        $severity = "us";
        $trusted = "ANY@ANY";
        $trustee = "user@$target";
        $text = "rexd is enabled";
        }
    elsif ($_ =~ /User.*mode/ && $_ !~ /is not a directory/) {
        $severity = "us";
        $trusted = "ANY@$target";
        $trustee = "user@$target";
        $text = "User home directory or startup file is writable";
        }
    elsif ($_ =~ /tftp is enabled on/) {
        $severity="nr";
        $trustee="nobody@$target";
        $trusted="ANY@ANY";
        $text="tftp is enabled";
        $text = "tftp is enabled on";
        &satan_print();
        # (OUTPUT TWICE)
        $severity="nw";
        $trustee="nobody@$target";
        $trusted="ANY@ANY";
        $text = "tftp is enabled on";
        }
    elsif ($_ =~ /uudecode is enabled in/) {
        $severity = "nw";
        $trustee="nobody@$target";
        $trusted="ANY@ANY";
        $text = "uudecode is enabled in/";
        }
    # unclear what ramifications are...
    # /Password file, line.*is blank/
    # /Password file, line.*nonnumeric user id:/
    elsif ($_ =~ /(in cron_file) is World writable!/) {
        $severity = "root";
        $trusted = "ANY@$target";
        $trustee = "root@$target";
        $status = "q"; # who knows if it really matters?
        $text = "File in cron_file is world writable";
        }
    elsif ($_ =~ /File.*(inside root executed file) is _World_ writable!/) {
        $severity = "root";
        $trusted = "ANY@$target";
        $trustee = "root@$target";
        $status = "q"; # who knows if it really matters?
        $text = "File inside root executed file is _World_ writable!";
        }
    elsif ($_ =~ /File.*(in .*) is _World_ writable!/) {
        $severity = "user";
        $trusted = "ANY@$target";
        $trustee = "root@$target";
        $status = "q"; # who knows if it really matters?
        $text = "File inside important command is _World_ writable!";
        }
    # this assumes anon-ftp is actually on!
    elsif ($_ =~ /ftp's home directory should not be/) {
        $severity = "nw";
        $trusted = "ANY@ANY";
        $trustee = "nobody@$target";
        $text = "ftp's home directory is /";
        &satan_print();
        # (OUTPUT TWICE)
        $severity = "nr";
        $trusted = "ANY@ANY";
        $trustee = "nobody@$target";
        $text = "ftp's home directory is /";
        }
    # this gives away password file; what do we do?
    # elsif (/and.*ass.*are the same/)
    # $text = "system password file and ~ftp/etc/passwd are the same";

    # unclear of ramifications; could be very bad or ok
    # elsif (/should be mode 555/)

    # rhosts entry in ftp...
    # elsif (/should be be empty/)

    #  PRINT *SOMETHING* if can't find anything... give it no
    # severity so it won't get counted...
    else  {
        $severity = "";
        $trusted = "";
        $trustee = "";
        $status = "a";
        ($text) = /Warning!\s+(.+)$/;
        # $text = "Unknown warning!";
        }


    &satan_print();
    }