DistCC Detection

#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(12638);
  script_version("1.21");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/09/29");

  script_name(english:"DistCC Detection");

  script_set_attribute(attribute:"synopsis", value:
"A distributed compiler is listening on the remote port.");
  script_set_attribute(attribute:"description", value:
"The remote host is running distcc, a distributed GCC compiler.  distcc
allows a user to use the resources several hosts to compile his
programs more quickly. 

As distcc allows anyone to execute arbitrary commands on the remote
host, it should be configured to only accept connections from a
restricted set of IP addresses, otherwise an attacker can use it to
obtain an interactive shell on the remote host with the privileges of
the distcc daemon (usually 'distccd').");
  script_set_attribute(attribute:"see_also", value:"http://distcc.samba.org/security.html");
  script_set_attribute(attribute:"solution", value:
"Filter incoming traffic to this port, or use the '-a' option switch to
restrict the set of IP addresses distcc will accept.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");

  script_set_attribute(attribute:"plugin_publication_date", value:"2004/07/07");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"asset_inventory", value:"True");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:distcc:distcc");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Service detection");

  script_copyright(english:"This script is Copyright (C) 2005-2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("find_service2.nasl");
  script_require_ports("Services/unknown");

  exit(0);
}

include 'hex.inc';

argv = make_list("id",  "root", "#", "-c", "main.c", "-o", "main.o");
req  = "DIST00000001ARGC0000000" + max_index(argv);
n    = 0;
foreach arg (argv)
{
  req += "ARGV0000000" + strlen(arg) + arg;
}

req += 'DOTI00000001x\n';


if ( thorough_tests && ! get_kb_item("global_settings/disable_service_discovery")  )
{
  port = get_unknown_svc(3632);
  if ( ! port ) exit(0);
  if ( silent_service(port) ) exit(0);
}
else port = 3632;

if ( ! get_port_state(port) ) exit(0);
soc = open_sock_tcp(port);
if ( ! soc ) exit(0);
send(socket:soc, data:req);
while ( TRUE )
{
  msg = recv(socket:soc, length:4);
  if ( ! msg ) exit(0);
  if ( msg == "DONE"  || msg == "STAT" ) msg += recv(socket:soc, length:8);
  else if ( msg == "SERR"  || msg == "SOUT" ) 
	{
    msg_l = recv(socket:soc, length:8);
    if ( strlen(msg_l) != 8 ) exit(0);
    l = hex2dec(xvalue:msg_l);
    data = recv(socket:soc, length:l);
    if ( msg == "SOUT" && "uid=" >< data )
    {
      report = '\n' + 
      'It was possible to execute the command "id root", which produces :\n\n' + data;
      register_service(port:port, proto:"distcc");
      security_hole(port:port,extra:report);
      exit(0);
    }
	}
  else exit(0);
}