# perl
# --------------------------------------------------------
# LICENCE
# This software is under GNU GENERAL PUBLIC LICENSE
# The detail could be found in the file LICENCE include
# in the same directory than isme.pl
# --------------------------------------------------------

use LWP::UserAgent; # http://search.cpan.org/~gaas/libwww-perl-6.03/lib/LWP/UserAgent.pm
use HTTP::Request::Common; #http://search.cpan.org/~gaas/HTTP-Message-6.02/lib/HTTP/Request/Common.pm
use Net::Ping; # http://search.cpan.org/~smpeters/Net-Ping-2.36/lib/Net/Ping.pm
use Net::Netmask; # http://search.cpan.org/dist/Net-Netmask/
use Net::Subnets;
use Tk; # http://search.cpan.org/~srezic/Tk/pod/UserGuide.pod
use Tk::Radiobutton;
use Tk::PNG;


# Declaring functions for network analyzing stuff. Thus no argument passing for function. Its all full available variable.
$p=Net::Ping->new("icmp");


# Variable for web brute forcer
my $Web_ScanToBruteForce = "";
my $WebScanType = "scan";
my $IpAddress = "";
my $SubnetToScan = "";

my $Results = "";
	
my $subweb_mw = MainWindow->new(
						-title => 'Test default SoundPoint Login/Password');

my $menu_bar = $subweb_mw->Frame(
				-relief => 'groove',
				-borderwidth => 3,
				-width => 40,
				)-> pack(
					-side=>'top',
					-fill => 'x'
					);
my $file_mb = $menu_bar->Menubutton(
				-text => 'File',
				)->pack(-side=>'left');
		
$file_mb->command(
		-label=>'Launch brute force attack',
		-command => 
			sub 
			{
				if ($WebScanType =~ /single/)
				{
					&BRUTEFORCESINGLE;	
				}
				elsif ($WebScanType =~ /scan/)
				{
					&BRUTEFORCESUBNET;
				}
			}
		);
$file_mb->command(
			-label=>"Save scan results",
			-command => sub {&SAVERESULTS}
			);
$file_mb->command(
	-label=>'Exit',
	-command => [$subweb_mw => 'destroy']
	);
		

#----------
my $FrameTOP = $subweb_mw -> Frame ();
my $rdb_scan = $FrameTOP  -> Radiobutton(-text=>"Scan  a subnet",
												-value=>"scan",
												-variable=>\$WebScanType);
$rdb_scan -> pack (-side => 'left');
$FrameTOP -> pack (-side => 'top', -anchor => 'w');
#----------	
my $FrameMIDDLE1 = $subweb_mw -> Frame ();

$FrameMIDDLE1->Label(
	-text => 'Subnet to scan:     '
	)->pack(-side => 'left');
my $TextLabel = $FrameMIDDLE1 -> Entry(
	-textvariable => \$SubnetToScan,
	- width => 59,
	)->pack(-side => 'left');
$FrameMIDDLE1 -> pack (-side => 'top', -anchor => 'w');

#----------	
my $FrameMIDDLE2 = $subweb_mw -> Frame ();
my $rdb_single = $FrameMIDDLE2 -> Radiobutton(-text=>"Single IP Phone",  
												-value=>"single",  
												-variable=>\$WebScanType);
$rdb_single -> pack (-side => 'left');
$FrameMIDDLE2 -> pack (-side => 'top', -anchor => 'w');
#----------	
my $FrameMIDDLE3 = $subweb_mw -> Frame ();
$FrameMIDDLE3->Label(
	-text => 'IP address to scan:'
	)->pack(-side => 'left');
my $TextLabel_single = $FrameMIDDLE3 -> Entry(
	-textvariable => \$IpAddress,
	- width => 59,
	)->pack(-side => 'left');
$FrameMIDDLE3 -> pack (-side => 'top', -anchor => 'w');
#-------------
my $FrameMIDDLE4 = $subweb_mw -> Frame (-width => 40, -height => 20);

my $TextWidget = $FrameMIDDLE4  -> Text(); 
$TextWidget->configure(-height => 20);
my $scrollbar = $FrameMIDDLE4 ->Scrollbar(-command => ['yview', $TextWidget]);
$TextWidget->configure(-yscrollcommand => ['set', $scrollbar]);

$TextWidget->pack(-side => 'left', -fill => 'both', -expand => 1);
$scrollbar->pack(-side => 'right', -fill => 'y');
$FrameMIDDLE4 -> pack (-side => 'top', -anchor => 'w');
#-------------


#------------ LAUNCHING THE MAIN LOOP --------
MainLoop;
#------------ END OF THE GUI INTERFACE DEFINITION STUFF -------------------------------------



sub BRUTEFORCESINGLE
{
	$Results = "";
	if ($IpAddress =~ /[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}/)
    {
		$TextWidget -> delete('0.0', 'end');
		$TextWidget -> insert("end", "-------------------------------------------------------------------------------\n");
		$TextWidget -> insert("end", "Starting to test $IpAddress for default SoundPoint Log/Pass\n");
		$TextWidget -> insert("end", "-------------------------------------------------------------------------------\n");
		$TextWidget  -> update ();	
		$TextWidget  -> see ('end');
		$Results = $Results."-------------------------------------------------------------------------------\n";
		$Results = $Results."Starting to test $IpAddress for default SoundPoint Log/Pass\n";
		$Results = $Results."-------------------------------------------------------------------------------\n";
						
		# This url does appear to have a systematic authentication. Good for default login/Password test.
		my $url_SPPhone = "http://".$IpAddress."/netConf.htm";
		# This url is not authenticated by default.
		my $url2_SPPhone = "http://".$IpAddresss;


		my $ua = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0 });
		my $request0 = HTTP::Request->new(GET => $url_SPPhone);
		$request0->authorization_basic('Polycom', '456');
		my $answer0=$ua->request($request0);	
		my $content0 = $answer0->content();
		
		my $request1 = HTTP::Request->new(GET => $url2_SPPhone);
		my $answer1=$ua->request($request1);	
		my $content1 = $answer1->content();

		#Welcome to Your Phone
	    if ($content1 =~ /Welcome to the SoundPoint IP Configuration/)
	    {
	    	$TextWidget -> insert ("end","$IpAddress: No login/password set to access the main web gui - WARNING\n");
	    	$Results = $Results."$IpAddress: No login/password set to access the main web gui - WARNING\n";
	    }
	    if ($content0 =~ /Network Configuration/)
	    {
	    	$TextWidget -> insert ("end","$IpAddress: Test Polycom/456 - WARNING => used\n");
	    	$Results = $Results."$IpAddress: Test Polycom/456 - WARNING => used\n";

	    }
#	    elsif ($content0 =~ /HTTP 401 Unauthorized/)
#	    {
#	    	$TextWidget -> insert ("end","$IpAddress: Test Polycom/456 => not used :-)\n");
#	    }
#		else #all the other cases.
#		{
#		   	$TextWidget -> insert ("end","$IpAddress: Test Polycom/456 => not used :-)\n");
#		}	    

   		$TextWidget -> insert ("end", "\n");					    
   		$TextWidget -> insert ("end", "------------------------ END --------------------------------------------------\n");					    
		$TextWidget  -> update ();	
		$TextWidget  -> see ('end');
    	$Results = $Results."\n";
    	$Results = $Results."------------------------ END --------------------------------------------------\n";
    } 
    else
	{
    	$subweb_mw->Dialog(-title => 'WARNING', 	
					-text => 'Bad IP address syntax !',
					)->Show( );		
    }   	
}

sub BRUTEFORCESUBNET
{
	$Results = "";
	if ($SubnetToScan =~ /[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}\/[0-9]{1,2}/)
	{

		$TextWidget -> delete('0.0', 'end');
		$TextWidget -> insert("end", "-------------------------------------------------------------------------------\n");
		$TextWidget -> insert("end", "Starting to test $SubnetToScan for default SoundPoint Log/Pass\n");
		$TextWidget -> insert("end", "-------------------------------------------------------------------------------\n");
		$TextWidget  -> update ();	
		$TextWidget  -> see ('end');
    	$Results = $Results."-------------------------------------------------------------------------------\n";
    	$Results = $Results."Starting to test $SubnetToScan for default SoundPoint Log/Pass\n";
    	$Results = $Results."-------------------------------------------------------------------------------\n";
		#---- Creating a table with all the IP adresses -------
		my $sn = Net::Subnets->new;
	   	my ( $lowipref, $highipref ) = $sn->range( \$SubnetToScan );
	    my $lowIP = $$lowipref;
		my $highIP = $$highipref;
		my $listref = $sn->list( \( $lowIP, $highIP ) );

		foreach my $scan_address ( @{ $listref } ) 
		{

			if ($p->ping($scan_address)) 
			{
		    	$TextWidget -> insert ("end","------- Testing $scan_address\n");
				$Results = $Results."------- Testing $scan_address\n";

				# This url does appear to have a systematic authentication. Good for default login/Password test.
				my $url_SPPhone = "http://".$scan_address."/netConf.htm";
				# This url is not authenticated by default.
				my $url2_SPPhone = "http://".$scan_address;
		
				my $ua = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0 });
				my $request0 = HTTP::Request->new(GET => $url_SPPhone);
				$request0->authorization_basic('Polycom', '456');
				my $answer0=$ua->request($request0);	
				my $content0 = $answer0->content();
				
				my $request1 = HTTP::Request->new(GET => $url2_SPPhone);
				my $answer1=$ua->request($request1);	
				my $content1 = $answer1->content();
		
			    if ($content1 =~ /Welcome to the SoundPoint IP Configuration/)
			    {
			    	$TextWidget -> insert ("end","$scan_address: No login/password set to access the main web gui - WARNING\n");
			    	$Results = $Results."$scan_address: No login/password set to access the main web gui - WARNING\n";
			    }
			    if ($content0 =~ /Network Configuration/)
			    {
			    	$TextWidget -> insert ("end","$scan_address: Test Polycom/456 - WARNING => used\n");
			    	$Results = $Results."$scan_address: Test Polycom/456 - WARNING => used";
			    }
#			    elsif ($content0 =~ /HTTP 401 Unauthorized/)
#			    {
#			    	$TextWidget -> insert ("end","$scan_address: Test Polycom/456 => not used :-)\n");
#			    }
#				else #all the other cases.
#				{
#				   	$TextWidget -> insert ("end","$scan_address: Test Polycom/456 => not used :-)\n");
#				}	    
				
#				$TextWidget -> insert ("end","------- END     $scan_address\n");
			}
			else
			{
			   	$TextWidget -> insert ("end","------- Testing $scan_address\n");
			   	$Results = $Results."------- Testing $scan_address\n";
			}			

			$TextWidget  -> update ();	
			$TextWidget  -> see ('end');
		}
   		$TextWidget -> insert ("end", "\n");					    
   		$TextWidget -> insert ("end", "------------------------ END --------------------------------------------------\n");					    
		$TextWidget  -> update ();	
		$TextWidget  -> see ('end');
		$Results = $Results."\n";
		$Results = $Results."------------------------ END --------------------------------------------------\n";

	}
	else
	{
		$mw->Dialog(-title => 'WARNING', 	
						-text => 'Bad IP Subnet syntax !',
					)->Show( );
   	}
}
sub SAVERESULTS
{
	my $FileToSave = $subweb_mw->getSaveFile(
							-defaultextension => '.txt',
                            -initialdir => "user_data"
                              );

	open (TOSAVE, ">>$FileToSave");
	print TOSAVE $Results;
	close (TOSAVE);
	
}	