#!/usr/bin/perl## netscan.pl (version .1) - Created by Defect (defect@thearmy.com).use Socket;require "ctime.pl";$protocol_id = getprotobyname('tcp');$protocol_id2 = "tcp";$connect_time  = 2;$loop = 1;$data = "";$http_port = "80";$http_string1 = "GET / HTTP/1.0\r\n\r\n";$cgi1 = "HEAD /cgi-bin/phf HTTP/1.0\r\n\r\n"; #PHF$cgi2 = "HEAD /cgi-bin/mylog.html HTTP/1.0\r\n\r\n"; #PHP$cgi3 = "HEAD /cgi-bin/wwwboard.pl HTTP/1.0\r\n\r\n"; #WWWboard$cgi4 = "HEAD /_vti_pvt/ HTTP/1.0\r\n\r\n"; #frontpage$cgi5 = "HEAD /cgi-bin/campas HTTP/1.0\r\n\r\n"; #campas$cgi6 = "HEAD /cgi-bin/webgais HTTP/1.0\r\n\r\n"; #webgais$cgi7 = "HEAD /cgi-bin/test-cgi HTTP/1.0\r\n\r\n"; #test-cgi$cgi8 = "HEAD /cgi-bin/info2www HTTP/1.0\r\n\r\n"; #info2www$cgi9 = "HEAD /cgi-bin/pfdispaly.cgi HTTP/1.0\r\n\r\n"; #pfdisplay$cgi10 = "HEAD /cgi-bin/view-source HTTP/1.0\r\n\r\n"; #view-source$cgi11 = "HEAD /cgi-bin/Count.cgi HTTP/1.0\r\n\r\n";  #count.cgi$cgi12 = "HEAD /cgi-bin/handler HTTP/1.0\r\n\r\n";  #handler$cgi13 = "HEAD /cgi-bin/websendmail HTTP/1.0\r\n\r\n";  #websendmail$cgi14 = "HEAD /cgi-bin/webdist.cgi HTTP/1.0\r\n\r\n";  #webdist.cgi$cgi15 = "HEAD /cgi-bin/faxsurvey HTTP/1.0\r\n\r\n";  #faxsurvey$cgi16 = "HEAD /cgi-bin/htmlscript HTTP/1.0\r\n\r\n";  #htmlscript$cgi17 = "HEAD /scripts/convert.bas/ HTTP/1.0\r\n\r\n";  #convert$cgi18 = "HEAD /cgi-bin/aglimpse/ HTTP/1.0\r\n\r\n";  #glimpse$cgi19 = "HEAD /cgi-bin/perl.exe HTTP/1.0\r\n\r\n";  #perl.exe$cgi20 = "HEAD /cgi-bin/textcounter.pl HTTP/1.0\r\n\r\n";  #textcounter.pl$cgi21 = "HEAD /cgi-bin/wrap HTTP/1.0\r\n\r\n";  #wrap$cgi_not_found = "Not Found";$echo_port = "7";$discard_port = "9";$chargen_port = "19";$ftp_port = "21";$ftp_login = "USER anonymous\r\n";$ftp_error = "530";$wuftp = "wu-2.4.2-academ";$ssh_port = "22";$ssh = "1.2.26";$smtp_port = "25";$smtp1 = "8.9.2";$smtp2 = "4.1";$smtp3 = "2.0/2.5";$smtp4 = "8.8.4";$smtp5 = "8.6.12";$smtp6 = "8.6.9";$smtp_expn = "EXPN postmaster\r\n";$smtp_no_error = "250";$finger_port = "79";$pop3_port = "110";$qpop = "QPOP";$qpop1 = "2.2-b5";$qpop2 = "2.4";$qpop3 = "2.2";$qpop4 = "2.41beta1";$qpop5 = "2.3";$qpop6 = "2.5";print "netscan.pl (version .1) - Created by Defect (defect\@thearmy.com).\n\n";print "Enter the host to scan: ";$host = <STDIN>;chop($host);print "Port scanning mode? (on/off): ";$pscan = <STDIN>;chop($pscan);if ($pscan eq "on" | $pscan eq "off") {} else {die "Error: input must be 'on' or 'off'.";}if ($pscan eq "on") {print "(Port scan) Enter start port: ";$pscan_start = <STDIN>;chop($pscan_start);print "(Port scan) Enter end port: ";$pscan_end = <STDIN>;chop($pscan_end);$m_pscan_end = $pscan_end + 1;print "(Port scan) Extra verbose mode? (on/off): ";$pscan_ver = <STDIN>;chop($pscan_ver);if ($pscan_ver eq "on" | $pscan_ver eq "off") {} else {die "Error: input must be 'on' or 'off'.";}if ($pscan_ver eq "on") {$verbose = 1;}}print "CGI scanning mode? (on/off): ";$cgiscan = <STDIN>;chop($cgiscan);if ($cgiscan eq "on" | $cgiscan eq "off") {} else {die "Error: input must be 'on' or 'off'.";}$h = "[netscan:$host]";$current_date = &ctime(time);chop($current_date);print "\n--------------> Scanning $host (";&resolve($host);print "). Scan started on $current_date.";if ($pscan eq "on") {print "\n$h Port scanning mode is on. Scanning TCP ports $pscan_start-->$pscan_end...\n";$addy = "$name2/$a.$b.$c.$d";for ($port = $pscan_start; $port < $m_pscan_end; $port++) {$SIG{"ALRM"}    = sub { close(SOCKET); };alarm $connect_time;socket(SOCKET, PF_INET, SOCK_STREAM, $protocol_id);$iaddr = inet_aton("$a.$b.$c.$d");$paddr = sockaddr_in($port, $iaddr);if (connect(SOCKET, $paddr)) {printf "$h %0s       %20s %14s %12s", $protocol_id2, $addy,$port;print "Connection accepted.\n";close(SOCKET);} else {if ($verbose) {printf "$h %0s       %20s %14s %12s", $protocol_id2, $addy,$port;print "Connection refused.\n";}}}print "$h Port scan complete.\n";}else {print "\n$h Skipping TCP port scan (port scanning mode is off).\n";}print "$h Scanning for a running web server...\n";$SIG{"ALRM"}    = sub { close(SOCKET); };alarm $connect_time;socket(SOCKET2, PF_INET, SOCK_STREAM, $protocol_id);$iaddr = inet_aton("$a.$b.$c.$d");$paddr = sockaddr_in($http_port, $iaddr);if (connect(SOCKET2, $paddr)) {send(SOCKET2,$http_string1, 0);$wserver = 1;print "$h Web server found. Printing web server information.\n";while (sysread(SOCKET2, $byte, 1) == 1 && $loop==1) {if ($byte eq "\n") {$byte = ""; $loop = 0; $data = "";}$data = "$data$byte";}$loop = 1;while (sysread(SOCKET2, $byte, 1) == 1 && $loop==1) {if ($byte eq "\n") {$byte = ""; print "$h  $data\n"; $loop = 0; $data = "";}$data = "$data$byte";}$loop = 1;while (sysread(SOCKET2, $byte, 1) == 1 && $loop==1) {if ($byte eq "\n") {$byte = ""; print "$h  $data"; $loop = 0; $data = "";}$data = "$data$byte";}$loop = 1;close(SOCKET2);} else {print "$h No web server is running.\n";}if ($wserver) {if ($cgiscan eq "on") {print "\n$h CGI scanning mode is on. Scanning for various CGI related security holes.\n";for $i (01..22) {if ($i==1) {print "$h (CGI:1/21) Scanning for PHF...\n";}if ($i==2) {print "$h (CGI:2/21) Scanning for PHP...\n";}if ($i==3) {print "$h (CGI:3/21) Scanning for WWWboard...\n";}if ($i==4) {print "$h (CGI:4/21) Scanning for frontpage...\n";}if ($i==5) {print "$h (CGI:5/21) Scanning for campas...\n";}if ($i==6) {print "$h (CGI:6/21) Scanning for webgais...\n";}if ($i==7) {print "$h (CGI:7/21) Scanning for test-cgi...\n";}if ($i==8) {print "$h (CGI:8/21) Scanning for info2www...\n";}if ($i==9) {print "$h (CGI:9/21) Scanning for pfdisplay...\n";}if ($i==10) {print "$h (CGI:10/21) Scanning for view-source...\n";}if ($i==11) {print "$h (CGI:11/21) Scanning for count.cgi...\n";}if ($i==12) {print "$h (CGI:12/21) Scanning for handler...\n";}if ($i==13) {print "$h (CGI:13/21) Scanning for websendmail...\n";}if ($i==14) {print "$h (CGI:14/21) Scanning for webdist.cgi...\n";}if ($i==15) {print "$h (CGI:15/21) Scanning for faxsurvey...\n";}if ($i==16) {print "$h (CGI:16/21) Scanning for htmlscript...\n";}if ($i==17) {print "$h (CGI:17/21) Scanning for convert...\n";}if ($i==18) {print "$h (CGI:18/21) Scanning for glimpse...\n";}if ($i==19) {print "$h (CGI:19/21) Scanning for perl.exe...\n";}if ($i==20) {print "$h (CGI:20/21) Scanning for textcounter.pl...\n";}if ($i==21) {print "$h (CGI:21/21) Scanning for wrap...\n";}if ($i==22) {print "$h CGI scan complete.\n";}socket(CGI_SOCKET, PF_INET, SOCK_STREAM, $protocol_id);$iaddr = inet_aton("$a.$b.$c.$d");$paddr = sockaddr_in($http_port, $iaddr);connect(CGI_SOCKET, $paddr);if ($i==1) {send(CGI_SOCKET,$cgi1, 0);while (sysread(CGI_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; $loop = 0;}$data = "$data$byte";}$loop = 1;if (index($data, $cgi_not_found)!=-1) {print "$h PHF not found.\n";} else {print "$h ---> VULNERABILITY FOUND: Description: '/cgi-bin/phf' (PHF), Type: CGI related.\n";}$data = "";close(CGI_SOCKET);}if ($i==2) {send(CGI_SOCKET,$cgi2, 0);while (sysread(CGI_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; $loop = 0;}$data = "$data$byte";}$loop = 1;if (index($data, $cgi_not_found)!=-1) {print "$h PHP not found.\n";} else {print "$h ---> VULNERABILITY FOUND: Description: '/cgi-bin/mylog.html' (PHP), Type: CGI related.\n";}$data = "";close(CGI_SOCKET);}if ($i==3) {send(CGI_SOCKET,$cgi3, 0);while (sysread(CGI_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; $loop = 0;}$data = "$data$byte";}$loop = 1;if (index($data, $cgi_not_found)!=-1) {print "$h WWWboard not found.\n";} else {print "$h ---> VULNERABILITY FOUND: Description: '/cgi-bin/wwwboard.pl' (WWWboard), Type: CGI related.\n";}$data = "";close(CGI_SOCKET);}if ($i==4) {send(CGI_SOCKET,$cgi4, 0);while (sysread(CGI_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; $loop = 0;}$data = "$data$byte";}$loop = 1;if (index($data, $cgi_not_found)!=-1) {print "$h Frontpage not found.\n";} else {print "$h ---> VULNERABILITY FOUND: Description: '/_vti_pvt/' (frontpage), Type: CGI related.\n";}$data = "";close(CGI_SOCKET);}if ($i==5) {send(CGI_SOCKET,$cgi5, 0);while (sysread(CGI_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; $loop = 0;}$data = "$data$byte";}$loop = 1;if (index($data, $cgi_not_found)!=-1) {print "$h Campas not found.\n";} else {print "$h ---> VULNERABILITY FOUND: Description: '/cgi-bin/campas' (campas), Type: CGI related.\n";}$data = "";close(CGI_SOCKET);}if ($i==6) {send(CGI_SOCKET,$cgi6, 0);while (sysread(CGI_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; $loop = 0;}$data = "$data$byte";}$loop = 1;if (index($data, $cgi_not_found)!=-1) {print "$h Webgais not found.\n";} else {print "$h ---> VULNERABILITY FOUND: Description: '/cgi-bin/webgais' (webgais), Type: CGI related.\n";}$data = "";close(CGI_SOCKET);}if ($i==7) {send(CGI_SOCKET,$cgi7, 0);while (sysread(CGI_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; $loop = 0;}$data = "$data$byte";}$loop = 1;if (index($data, $cgi_not_found)!=-1) {print "$h Test-cgi not found.\n";} else {print "$h ---> VULNERABILITY FOUND: Description: '/cgi-bin/test-cgi' (test-cgi), Type: CGI related.\n";}$data = "";close(CGI_SOCKET);}if ($i==8) {send(CGI_SOCKET,$cgi8, 0);while (sysread(CGI_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; $loop = 0;}$data = "$data$byte";}$loop = 1;if (index($data, $cgi_not_found)!=-1) {print "$h Info2www not found.\n";} else {print "$h ---> VULNERABILITY FOUND: Description: '/cgi-bin/info2www' (info2www), Type: CGI related.\n";}$data = "";close(CGI_SOCKET);}if ($i==9) {send(CGI_SOCKET,$cgi9, 0);while (sysread(CGI_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; $loop = 0;}$data = "$data$byte";}$loop = 1;if (index($data, $cgi_not_found)!=-1) {print "$h Pfdisplay not found.\n";} else {print "$h ---> VULNERABILITY FOUND: Description: '/cgi-bin/pfdispaly.cgi' (pfdisplay), Type: CGI related.\n";}$data = "";close(CGI_SOCKET);}if ($i==10) {send(CGI_SOCKET,$cgi10, 0);while (sysread(CGI_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; $loop = 0;}$data = "$data$byte";}$loop = 1;if (index($data, $cgi_not_found)!=-1) {print "$h View-source not found.\n";} else {print "$h ---> VULNERABILITY FOUND: Description: '/cgi-bin/view-source' (view-source), Type: CGI related.\n";}$data = "";close(CGI_SOCKET);}if ($i==11) {send(CGI_SOCKET,$cgi11, 0);while (sysread(CGI_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; $loop = 0;}$data = "$data$byte";}$loop = 1;if (index($data, $cgi_not_found)!=-1) {print "$h Count.cgi not found.\n";} else {print "$h ---> VULNERABILITY FOUND: Description: '/cgi-bin/Count.cgi' (count.cgi), Type: CGI related.\n";}$data = "";close(CGI_SOCKET);}if ($i==12) {send(CGI_SOCKET,$cgi12, 0);while (sysread(CGI_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; $loop = 0;}$data = "$data$byte";}$loop = 1;if (index($data, $cgi_not_found)!=-1) {print "$h Handler not found.\n";} else {print "$h ---> VULNERABILITY FOUND: Description: '/cgi-bin/handler' (handler), Type: CGI related.\n";}$data = "";close(CGI_SOCKET);}if ($i==13) {send(CGI_SOCKET,$cgi13, 0);while (sysread(CGI_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; $loop = 0;}$data = "$data$byte";}$loop = 1;if (index($data, $cgi_not_found)!=-1) {print "$h Websendmail not found.\n";} else {print "$h ---> VULNERABILITY FOUND: Description: '/cgi-bin/websendmail' (websendmail), Type: CGI related.\n";}$data = "";close(CGI_SOCKET);}if ($i==14) {send(CGI_SOCKET,$cgi14, 0);while (sysread(CGI_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; $loop = 0;}$data = "$data$byte";}$loop = 1;if (index($data, $cgi_not_found)!=-1) {print "$h Webdist.cgi not found.\n";} else {print "$h ---> VULNERABILITY FOUND: Description: '/cgi-bin/webdist.cgi' (webdist.cgi), Type: CGI related.\n";}$data = "";close(CGI_SOCKET);}if ($i==15) {send(CGI_SOCKET,$cgi15, 0);while (sysread(CGI_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; $loop = 0;}$data = "$data$byte";}$loop = 1;if (index($data, $cgi_not_found)!=-1) {print "$h Faxsurvey not found.\n";} else {print "$h ---> VULNERABILITY FOUND: Description: '/cgi-bin/faxsurvey' (faxsurvey), Type: CGI related.\n";}$data = "";close(CGI_SOCKET);}if ($i==16) {send(CGI_SOCKET,$cgi16, 0);while (sysread(CGI_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; $loop = 0;}$data = "$data$byte";}$loop = 1;if (index($data, $cgi_not_found)!=-1) {print "$h Htmlscript not found.\n";} else {print "$h ---> VULNERABILITY FOUND: Description: '/cgi-bin/htmlscript' (htmlscript), Type: CGI related.\n";}$data = "";close(CGI_SOCKET);}if ($i==17) {send(CGI_SOCKET,$cgi17, 0);while (sysread(CGI_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; $loop = 0;}$data = "$data$byte";}$loop = 1;if (index($data, $cgi_not_found)!=-1) {print "$h Convert not found.\n";} else {print "$h ---> VULNERABILITY FOUND: Description: '/scripts/convert.bas/' (convert), Type: CGI related.\n";}$data = "";close(CGI_SOCKET);}if ($i==18) {send(CGI_SOCKET,$cgi18, 0);while (sysread(CGI_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; $loop = 0;}$data = "$data$byte";}$loop = 1;if (index($data, $cgi_not_found)!=-1) {print "$h Glimpse not found.\n";} else {print "$h ---> VULNERABILITY FOUND: Description: '/cgi-bin/aglimpse/' (glimpse), Type: CGI related.\n";}$data = "";close(CGI_SOCKET);}if ($i==19) {send(CGI_SOCKET,$cgi19, 0);while (sysread(CGI_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; $loop = 0;}$data = "$data$byte";}$loop = 1;if (index($data, $cgi_not_found)!=-1) {print "$h Perl.exe not found.\n";} else {print "$h ---> VULNERABILITY FOUND: Description: '/cgi-bin/perl.exe' (perl.exe), Type: CGI related.\n";}$data = "";close(CGI_SOCKET);}if ($i==20) {send(CGI_SOCKET,$cgi20, 0);while (sysread(CGI_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; $loop = 0;}$data = "$data$byte";}$loop = 1;if (index($data, $cgi_not_found)!=-1) {print "$h Textcounter.pl not found.\n";} else {print "$h ---> VULNERABILITY FOUND: Description: '/cgi-bin/textcounter.pl' (textcounter.pl), Type: CGI related.\n";}$data = "";close(CGI_SOCKET);}if ($i==21) {send(CGI_SOCKET,$cgi21, 0);while (sysread(CGI_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; $loop = 0;}$data = "$data$byte";}$loop = 1;if (index($data, $cgi_not_found)!=-1) {print "$h Wrap not found.\n";} else {print "$h ---> VULNERABILITY FOUND: Description: '/cgi-bin/wrap' (wrap), Type: CGI related.\n";}$data = "";close(CGI_SOCKET);}}} else {print "\n$h Skipping CGI scan (CGI scanning mode is off).\n";}}print "$h Scanning for active debugging services...\n";$SIG{"ALRM"}    = sub { close(ESOCKET); };alarm $connect_time;socket(ESOCKET, PF_INET, SOCK_STREAM, $protocol_id);$iaddr = inet_aton("$a.$b.$c.$d");$paddr = sockaddr_in($echo_port, $iaddr);if (connect(ESOCKET, $paddr)) {print "$h ---> VULNERABILITY FOUND: Description: 'TCP port 7' (echo), Type: Debugging port.\n";close(ESOCKET);} else {print "$h Echo is not active.\n";}$SIG{"ALRM"}    = sub { close(DSOCKET); };alarm $connect_time;socket(DSOCKET, PF_INET, SOCK_STREAM, $protocol_id);$iaddr = inet_aton("$a.$b.$c.$d");$paddr = sockaddr_in($discard_port, $iaddr);if (connect(DSOCKET, $paddr)) {print "$h ---> VULNERABILITY FOUND: Description: 'TCP port 9' (discard), Type: Debugging port.\n";close(DSOCKET);} else {print "$h Discard is not active.\n";}$SIG{"ALRM"}    = sub { close(CSOCKET); };alarm $connect_time;socket(CSOCKET, PF_INET, SOCK_STREAM, $protocol_id);$iaddr = inet_aton("$a.$b.$c.$d");$paddr = sockaddr_in($chargen_port, $iaddr);if (connect(CSOCKET, $paddr)) {print "$h ---> VULNERABILITY FOUND: Description: 'TCP port 19' (chargen), Type: Debugging port.\n";close(CSOCKET);} else {print "$h Chargen is not active.\n";}print "$h Scan complete.\n";print "$h Scanning for a running FTP server...\n";$SIG{"ALRM"}    = sub { close(FTP_SOCKET); };alarm $connect_time;socket(FTP_SOCKET, PF_INET, SOCK_STREAM, $protocol_id);$iaddr = inet_aton("$a.$b.$c.$d");$paddr = sockaddr_in($ftp_port, $iaddr);if (connect(FTP_SOCKET, $paddr)) {print "$h FTP server found. Printing FTP server information.\n";while (sysread(FTP_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\n") {$byte = ""; chomp($data); print "$h  $data\n"; $loop = 0;}$data = "$data$byte";}$loop = 1;close(FTP_SOCKET);if (index($data, $wuftp)!=-1) {print "$h ---> VULNERABILITY FOUND: Description: 'vuln. version of WU-FTPd running' (root buffer overflow), Type: FTPd.\n";} else {print "$h FTPd version looks OK.\n";}$data = "";print "$h Checking if anonymous FTP login is allowed...\n";socket(FTP_SOCKET2, PF_INET, SOCK_STREAM, $protocol_id);$iaddr = inet_aton("$a.$b.$c.$d");$paddr = sockaddr_in($ftp_port, $iaddr);connect(FTP_SOCKET2, $paddr);while (sysread(FTP_SOCKET2, $byte, 1) == 1 && $loop==1) {if ($byte eq "\n") {$byte = ""; $loop = 0;}}$loop = 1;send(FTP_SOCKET2,$ftp_login, 0);read(FTP_SOCKET2,$data,3);close(FTP_SOCKET2);if (index($data, $ftp_error)!=-1) {print "$h Anonymous FTP login IS NOT allowed.\n";} else {print "$h Anonymous FTP login IS allowed.\n";}$data = "";} else {print "$h No FTP server is running.\n";}print "$h Scanning for a running SSH service...\n";$SIG{"ALRM"}    = sub { close(SSH_SOCKET); };alarm $connect_time;socket(SSH_SOCKET, PF_INET, SOCK_STREAM, $protocol_id);$iaddr = inet_aton("$a.$b.$c.$d");$paddr = sockaddr_in($ssh_port, $iaddr);if (connect(SSH_SOCKET, $paddr)) {print "$h SSH service found. Printing SSH service information.\n";while (sysread(SSH_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; chomp($data); print "$h  Version: $data\n"; $loop = 0;}$data = "$data$byte";}$loop = 1;close(SSH_SOCKET);if (index($data, $ssh)!=-1) {print "$h ---> VULNERABILITY FOUND: Description: 'vuln. version of SSH running' (buffer overflow), Type: SSHd.\n";} else {print "$h SSHd version looks OK.\n";}$data = "";} else {print "$h No SSH service is running.\n";}print "$h Scanning for a running SMTP...\n";$SIG{"ALRM"}    = sub { close(SMTP_SOCKET); };alarm $connect_time;socket(SMTP_SOCKET, PF_INET, SOCK_STREAM, $protocol_id);$iaddr = inet_aton("$a.$b.$c.$d");$paddr = sockaddr_in($smtp_port, $iaddr);if (connect(SMTP_SOCKET, $paddr)) {print "$h SMTP found. Printing SMTP information.\n";while (sysread(SMTP_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; chomp($data); print "$h  $data\n"; $loop = 0;}$data = "$data$byte";}$loop = 1;close(SMTP_SOCKET);if (index($data, $smtp1)!=-1) {print "$h ---> VULNERABILITY FOUND: Description: 'vuln. version of sendmail running' (sendmail 8.9.2 DoS), Type: SMTP.\n";} elsif (index($data, $smtp2)!=-1) {print "$h ---> VULNERABILITY FOUND: Description: 'vuln. version of sendmail running' (SunOS buffer overflow), Type: SMTP.\n";}elsif (index($data, $smtp3)!=-1) {print "$h ---> VULNERABILITY FOUND: Description: 'vuln. version of sendmail running' (MetaInfo sendmail bug), Type: SMTP.\n";}elsif (index($data, $smtp4)!=-1) {print "$h ---> VULNERABILITY FOUND: Description: 'vuln. version of sendmail running' (sendmail 8.8.4 bug), Type: SMTP.\n";}elsif (index($data, $smtp5)!=-1) {print "$h ---> VULNERABILITY FOUND: Description: 'vuln. version of sendmail running' (sendmail 8.6.12 for FreeBSD 2.1.0 bug), Type: SMTP.\n";}elsif (index($data, $smtp6)!=-1) {print "$h ---> VULNERABILITY FOUND: Description: 'vuln. version of sendmail running' (sendmail 8.6.9 bug), Type: SMTP.\n";}else {print "$h SMTP version looks OK.\n";}$data = "";print "$h Checking if sendmail will 'EXPN' accounts...\n";socket(SMTP_SOCKET2, PF_INET, SOCK_STREAM, $protocol_id);$iaddr = inet_aton("$a.$b.$c.$d");$paddr = sockaddr_in($smtp_port, $iaddr);connect(SMTP_SOCKET2, $paddr);while (sysread(SMTP_SOCKET2, $byte, 1) == 1 && $loop==1) {if ($byte eq "\n") {$byte = ""; $loop = 0;}}$loop = 1;send(SMTP_SOCKET2,$smtp_expn, 0);read(SMTP_SOCKET2,$data,3);close(SMTP_SOCKET2);if (index($data, $smtp_no_error)!=-1) {print "$h Sendmail WILL 'EXPN' accounts.\n";} else {print "$h Sendmail WILL NOT 'EXPN' accounts.\n";}$data = "";} else {print "$h No SMTP is running.\n";}print "$h Scanning for a running FINGERd...\n";$SIG{"ALRM"}    = sub { close(FIN_SOCKET); };alarm $connect_time;socket(FIN_SOCKET, PF_INET, SOCK_STREAM, $protocol_id);$iaddr = inet_aton("$a.$b.$c.$d");$paddr = sockaddr_in($finger_port, $iaddr);if (connect(FIN_SOCKET, $paddr)) {print "$h FINGERd found.\n";} else {print "$h No FINGERd is running.\n";}print "$h Scanning for a running POP3 service...\n";$SIG{"ALRM"}    = sub { close(POP_SOCKET); };alarm $connect_time;socket(POP_SOCKET, PF_INET, SOCK_STREAM, $protocol_id);$iaddr = inet_aton("$a.$b.$c.$d");$paddr = sockaddr_in($pop3_port, $iaddr);if (connect(POP_SOCKET, $paddr)) {print "$h POP3 service found. Printing POP3 service information.\n";while (sysread(POP_SOCKET, $byte, 1) == 1 && $loop==1) {if ($byte eq "\r") {$byte = ""; chomp($data); print "$h  $data\n"; $loop = 0;}$data = "$data$byte";}$loop = 1;close(POP_SOCKET);if (index($data, $qpop)!=-1) {if (index($data, $qpop1)!=-1) {print "$h ---> VULNERABILITY FOUND: Description: 'vuln. version of QPOP running' (root buffer overflow), Type: POP3 service.\n";}elsif (index($data, $qpop2)!=-1) {print "$h ---> VULNERABILITY FOUND: Description: 'vuln. version of QPOP running' (root buffer overflow), Type: POP3 service.\n";}elsif (index($data, $qpop3)!=-1) {print "$h ---> VULNERABILITY FOUND: Description: 'vuln. version of QPOP running' (root buffer overflow), Type: POP3 service.\n";}elsif (index($data, $qpop4)!=-1) {print "$h ---> VULNERABILITY FOUND: Description: 'vuln. version of QPOP running' (root buffer overflow), Type: POP3 service.\n";}elsif (index($data, $qpop5)!=-1) {print "$h ---> VULNERABILITY FOUND: Description: 'vuln. version of QPOP running' (root buffer overflow), Type: POP3 service.\n";}elsif (index($data, $qpop6)!=-1) {print "$h ---> VULNERABILITY FOUND: Description: 'vuln. version of QPOP running' (root buffer overflow), Type: POP3 service.\n";}} else {print "$h POP3 service version looks OK.\n";}$data = "";} else {print "$h No POP3 service is running.\n";}sub resolve {local($name) = @_;if ($name =~ /[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/) {($a,$b,$c,$d) = split(/\./, $name);@ip = ($a,$b,$c,$d);($name) = gethostbyaddr(pack("C4", @ip), &AF_INET);}else {($name, $aliases, $type, $len, @ip) = gethostbyname($name);($a,$b,$c,$d) = unpack('C4',$ip[0]);}if ($name && @ip) {print "$name/$a.$b.$c.$d";$name2 = $name;}else { print "unable to resolve address"; }}sub AF_INET {2;}