Sybase ASA Client Connection Broadcast Remote Information Disc

#!/usr/bin/env python3
"""
check_sqlanywhere_broadcast.py
Determine whether a local SQL Anywhere / Adaptive Server Anywhere instance
appears to answer client connection broadcasts.

Exit codes:
  0 = PATCHED
  1 = VULNERABLE
  2 = UNKNOWN
"""
import os
import platform
import re
import subprocess
import sys

SAFE_PATTERNS = [
    re.compile(r'(^|\s)-sb\s*0(\s|$)', re.I),
    re.compile(r'broadcastlistener\s*=\s*(no|0)', re.I),
    re.compile(r'(^|\s)-x\s+none(\s|$)', re.I),
]
RISKY_HINTS = [
    re.compile(r'(^|\s)-sb\s*1(\s|$)', re.I),
    re.compile(r'(^|\s)-x\s+.*tcpip', re.I),
    re.compile(r'dbsrv\d+|dbeng\d+', re.I),
]
PROC_NAME_RE = re.compile(r'dbsrv\d+|dbeng\d+|dbsrv|dbeng', re.I)


def run(cmd):
    try:
        return subprocess.check_output(cmd, stderr=subprocess.DEVNULL, text=True, shell=isinstance(cmd, str))
    except Exception:
        return ""


def get_processes():
    system = platform.system().lower()
    procs = []

    if system == 'windows':
        ps = run(['powershell', '-NoProfile', '-Command',
                  "Get-CimInstance Win32_Process | Select-Object ProcessId,Name,CommandLine | ConvertTo-Csv -NoTypeInformation"])
        for line in ps.splitlines()[1:]:
            parts = []
            cur = ''
            in_q = False
            for ch in line:
                if ch == '"':
                    in_q = not in_q
                elif ch == ',' and not in_q:
                    parts.append(cur)
                    cur = ''
                else:
                    cur += ch
            parts.append(cur)
            if len(parts) >= 3:
                name = parts[1].strip('"')
                cmd = parts[2].strip('"')
                if PROC_NAME_RE.search(name) or PROC_NAME_RE.search(cmd):
                    procs.append((name, cmd))
        return procs

    if os.path.isdir('/proc'):
        for pid in os.listdir('/proc'):
            if not pid.isdigit():
                continue
            cmdline_path = os.path.join('/proc', pid, 'cmdline')
            try:
                raw = open(cmdline_path, 'rb').read().replace(b'\x00', b' ').decode(errors='ignore').strip()
            except Exception:
                continue
            if raw and PROC_NAME_RE.search(raw):
                name = raw.split()[0]
                procs.append((name, raw))
        return procs

    ps = run(['ps', '-axo', 'command='])
    for line in ps.splitlines():
        if PROC_NAME_RE.search(line):
            name = line.split()[0] if line.split() else 'unknown'
            procs.append((name, line.strip()))
    return procs


def udp_2638_listener_present():
    outputs = [
        run(['ss', '-lunp']),
        run(['netstat', '-anu']),
        run(['lsof', '-nP', '-iUDP']),
        run(['powershell', '-NoProfile', '-Command', 'Get-NetUDPEndpoint | Format-Table -HideTableHeaders LocalPort'])
    ]
    for out in outputs:
        if re.search(r'(^|\D)2638(\D|$)', out):
            return True
    return False


def main():
    procs = get_processes()
    if not procs:
        print('UNKNOWN - no local dbsrv/dbeng process found')
        sys.exit(2)

    hardened = []
    risky = []

    for name, cmd in procs:
        cmd_norm = ' ' + cmd.strip() + ' '
        if any(p.search(cmd_norm) for p in SAFE_PATTERNS):
            hardened.append((name, cmd))
        elif any(p.search(cmd_norm) for p in RISKY_HINTS):
            risky.append((name, cmd))
        else:
            # Default server behavior in documented builds is to answer broadcasts unless disabled.
            risky.append((name, cmd))

    listener = udp_2638_listener_present()

    if risky and listener:
        print('VULNERABLE - SQL Anywhere process found without broadcast hardening and UDP/2638 listener detected')
        sys.exit(1)

    if risky and not listener:
        print('UNKNOWN - SQL Anywhere process found without explicit broadcast hardening, but UDP/2638 listener was not confirmed')
        sys.exit(2)

    if hardened:
        print('PATCHED - SQL Anywhere process appears hardened with -sb 0, BroadcastListener=NO, or local-only networking')
        sys.exit(0)

    print('UNKNOWN - unable to determine effective broadcast listener state')
    sys.exit(2)


if __name__ == '__main__':
    main()