/*

 This scanner scans an entire class C address, and does it with no bull. Enter the
 starting IP address, then the one you want to to stop on, and it will scan each box for
 the 3 parts of the bug.

 complies on HP-UX, Linux, *BSD

 to compile:
 luser$ gcc manlove.c -o quickie

 to run:
 luser$ ./manlove 123.123.123.2 123.123.123.254 >> somelog &

       shout outz : H4G1S/BoW/ROTShB/HERT/SOB/LOD/M0D/MLF
 cl00lbagz galore : Bronc Buster & all of LoU

 k0aded by Stuart Manlove -- LEG10NZ of GAYNEZZ [LoG]
 May 1999

*/


#include <stdio.h>
#include <signal.h>
#include <stdlib.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>
#define TOUT 2 

void phalse(int signo);
int connect_time(int sockfd, struct sockaddr *saptr, int salen, int nsec);
void clean(char b[1024]);

int main(int argc, char **argv)
{
    char *temp;
    char *ip_ptr;
    char buff[1024];
    int f1,f2,f3,f4;
    int l1,l2,l3,l4;
    int i, tmp, n, lame;
    int sock;
    struct sockaddr_in target;
    char *coldf[4];
    char *dis[4];

    dis[1] = "openfile.cfm";
    dis[2] = "exprcalc.cfm";
    dis[3] = "displayopenedfile.cfm";

    coldf[1] = "GET /cfdocs/expelval/openfile.cfm HTTP/1.0\n\n";
    coldf[2] = "GET /cfdocs/expelval/exprcalc.cfm HTTP/1.0\n\n";
    coldf[3] = "GET /cfdocs/expelval/displayopenedfile.cfm HTTP/1.0\n\n";


    if(argc<2) exit(printf("\nUsage: %s start_ip ending_ip\n",argv[0]));

    printf("\n** A fast coldfusion exploit finder **");
    printf("\ncoded by Stuart Manlove -- LEG10NZ of GAYNEZZ [LoG] - May 99\n");

    temp=argv[1];
    ip_ptr=(char *)strtok(temp,"."); /* get first field and look for . */
    f1=atoi(ip_ptr);
    ip_ptr=(char *)strtok(NULL,"."); /* null pointer set, get next field */
    f2=atoi(ip_ptr);
    ip_ptr=(char *)strtok(NULL,"."); /* null pointer set, get next field */
    f3=atoi(ip_ptr);
    ip_ptr=(char *)strtok(NULL,"."); /* null pointer set, get next field */
    f4=atoi(ip_ptr);

    temp=argv[2];
    ip_ptr=(char *)strtok(temp,"."); /* get first field and look for . */
    l1=atoi(ip_ptr);
    ip_ptr=(char *)strtok(NULL,"."); /* null pointer set, get next field */
    l2=atoi(ip_ptr);
    ip_ptr=(char *)strtok(NULL,"."); /* null pointer set, get next field */
    l3=atoi(ip_ptr);
    ip_ptr=(char *)strtok(NULL,"."); /* null pointer set, get next field */
    l4=atoi(ip_ptr);

    if(f4<2 || l4>254)
    exit(printf("IP Numbers out of range\n"));

    for (i=f4;i<=l4;i++)
    {
        sprintf(temp,"%d.%d.%d.%d",f1,f2,f3,i);

        bzero(&target,sizeof(target));
        target.sin_addr.s_addr=inet_addr(temp);
        target.sin_family=AF_INET;
        target.sin_port=htons(80); 

        for(lame=1;lame;lame--)
        {
            printf("\nChecking %s:",temp);
            for(n=1;n<4;n++)
            {
                sock=socket(AF_INET,SOCK_STREAM,0);
                if(sock<0) exit(printf("Error getting socket - socket()\n"));
                if(connect_time(sock,(struct sockaddr *)&target,sizeof(target),TOUT)==-1)
                {
                    close(sock);  
                    printf("\n  no HTTPD responce");
                }
                else 
                {
                    printf("\n  checking for %s - ",dis[n]);
                    send(sock,coldf[n],strlen(coldf[n]),0);
                    recv(sock, buff, sizeof(buff),0);
                    if(strstr(buff,"200"))
                    {
                        close(sock);
                        clean(buff);
                        printf(" FOUND",dis[n]);
                    }
                    else
                    {
                        close(sock);
                        clean(buff);
                        printf(" not found",dis[n]);
                    }
                }
            }
        }
    }

    printf("\n\nScan finished!\n");
    printf("Have fun kiddies!\n");
    return 0;
}

void phalse(int signo)
{
    return;
}

/* ripped from mscan!@# */
int connect_time(int sockfd, struct sockaddr *saptr, int salen, int nsec)
{
    int s;
    alarm(0);
    signal(SIGALRM,phalse);
    alarm(nsec);

    if((s=connect(sockfd,(struct sockaddr *)saptr,salen))<0)
    {
        close(sockfd);
        if(errno==EINTR);
        errno=ETIMEDOUT;
    }
    alarm(0);
    signal(SIGALRM, SIG_DFL);
    return (s);
}

void clean(char b[1024])
{
    int i;
    for(i=0;i<=strlen(b);i++) b[i]=NULL;
}