# perl
# --------------------------------------------------------
# LICENCE
# This software is under GNU GENERAL PUBLIC LICENSE
# The detail could be found in the file LICENCE include
# in the same directory than isme.pl
# --------------------------------------------------------

use LWP::UserAgent; # http://search.cpan.org/~gaas/libwww-perl-6.03/lib/LWP/UserAgent.pm
use HTTP::Request::Common; #http://search.cpan.org/~gaas/HTTP-Message-6.02/lib/HTTP/Request/Common.pm
use Net::Ping; # http://search.cpan.org/~smpeters/Net-Ping-2.36/lib/Net/Ping.pm
use Net::Netmask; # http://search.cpan.org/dist/Net-Netmask/
use Net::Subnets;
use Tk; # http://search.cpan.org/~srezic/Tk/pod/UserGuide.pod
use Tk::Radiobutton;
use Tk::PNG;

#----------------------------------------------------------
# SUB FUNCTIONS LIST:
#----------------------------------------------------------
# 
# sub WEB_SELECTSCANFILE
#----------------------------------------------------------


# Variable for web brute forcer
my $Web_ScanToBruteForce = "";
my $WebScanType = "scan";
my $Web_ipaddress = "";
my $Results = "";
my $Subnet_to_scan = "";


# Declaring functions for network analyzing stuff. Thus no argument passing for function. Its all full available variable.
$p=Net::Ping->new("icmp");

my $subweb_mw = MainWindow->new(
						-title => 'Test default MITEL Login/Password');

my $menu_bar = $subweb_mw->Frame(
				-relief => 'groove',
				-borderwidth => 3,
				-width => 40,
				)-> pack(
					-side=>'top',
					-fill => 'x'
					);
my $file_mb = $menu_bar->Menubutton(
				-text => 'File',
				)->pack(-side=>'left');
	
$file_mb->command(
			-label=>"Vulnerability details",
			-command => sub {&EXPLANATION}
			);	
					
$file_mb->command(
		-label=>'Launch brute force attack',
		-command => 
			sub 
			{
				if ($WebScanType =~ /single/)
				{
					&WEBBRUTEFORCESINGLE;	
				}
				elsif ($WebScanType =~ /subnet/)
				{
					&WEBBRUTEFORCEFULLSUBNET;
				}
			}
		);

$file_mb->command(
			-label=>"Save scan results",
			-command => sub {&SAVERESULTS}
			);

$file_mb->command(
	-label=>'Exit',
	-command => [$subweb_mw => 'destroy']
	);
		


#----------	
my $FrameMIDDLE2 = $subweb_mw -> Frame ();
my $rdb_single = $FrameMIDDLE2 -> Radiobutton(-text=>"Single IP Phone",  
												-value=>"single",  
												-variable=>\$WebScanType);
$rdb_single -> pack (-side => 'left');
$FrameMIDDLE2 -> pack (-side => 'top', -anchor => 'w');
#----------	
my $FrameMIDDLE3 = $subweb_mw -> Frame ();
$FrameMIDDLE3->Label(
	-text => 'IP address to scan (192.168.0.154):'
	)->pack(-side => 'left');
my $TextLabel_single = $FrameMIDDLE3 -> Entry(
	-textvariable => \$Web_ipaddress,
	- width => 51,
	)->pack(-side => 'left');
$FrameMIDDLE3 -> pack (-side => 'top', -anchor => 'w');

#-------------
my $FrameMIDDLE5 = $subweb_mw -> Frame ();
my $rdb_single = $FrameMIDDLE5 -> Radiobutton(-text=>"Scan a subnet",  
												-value=>"subnet",  
												-variable=>\$WebScanType);
$rdb_single -> pack (-side => 'left');
$FrameMIDDLE5 -> pack (-side => 'top', -anchor => 'w');
#----------	
my $FrameMIDDLE7 = $subweb_mw -> Frame ();
$FrameMIDDLE7->Label(
	-text => 'Subnet to scan (192.168.0.0/24):    '
	)->pack(-side => 'left');
my $TextLabel_single = $FrameMIDDLE7 -> Entry(
	-textvariable => \$Subnet_to_scan,
	- width => 51,
	)->pack(-side => 'left');
$FrameMIDDLE7 -> pack (-side => 'top', -anchor => 'w');
#-------------
my $FrameMIDDLE4 = $subweb_mw -> Frame (-width => 40, -height => 20);

my $TextWidget = $FrameMIDDLE4  -> Text(); 
$TextWidget->configure(-height => 28);
my $scrollbar = $FrameMIDDLE4 ->Scrollbar(-command => ['yview', $TextWidget]);
$TextWidget->configure(-yscrollcommand => ['set', $scrollbar]);

$TextWidget->pack(-side => 'left', -fill => 'both', -expand => 1);
$scrollbar->pack(-side => 'right', -fill => 'y');
$FrameMIDDLE4 -> pack (-side => 'top', -anchor => 'w');

#------------ LAUNCHING THE MAIN LOOP --------
&EXPLANATION;
MainLoop;
#------------ END OF THE GUI INTERFACE DEFINITION STUFF -------------------------------------



sub WEBBRUTEFORCESINGLE
{
	$Results = "";

	if ($Web_ipaddress =~ /[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}/)
    {
		if ($p->ping($Web_ipaddress))
		{
			$TextWidget -> delete('0.0', 'end');
			$TextWidget -> insert("end", "-------------------------------------------------------------------------------\n");
			$TextWidget -> insert("end", "Starting to test $Web_ipaddress for default MITEL Login/Password.\n");	
			$TextWidget -> insert("end", "-------------------------------------------------------------------------------\n\n");
			$TextWidget  -> update ();	
			$TextWidget  -> see ('end');
					
			$Results = $Results."-------------------------------------------------------------------------------\n";
			$Results = $Results."Starting to test $Web_ipaddress for default MITEL Login/Password.\n";
			$Results = $Results."-------------------------------------------------------------------------------\n";
			
			my $url_MITELPhone = "http://".$Web_ipaddress;
	
			my $ua = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0 });
			my $request = HTTP::Request->new(GET => $url_MITELPhone);
			
			$request->authorization_basic('admin', '5212');# Default SNOM login: administrator default password: 0000				
			my $answer1=$ua->request($request);
			my $content1 = $answer1->content();
		
			$request->authorization_basic('admin', '5215');# Default SNOM login: administrator default password: 0000							
			my $answer2=$ua->request($request);
			my $content2 = $answer2->content();
		
			$request->authorization_basic('admin', '5220');# Default SNOM login: administrator default password: 0000							
			my $answer3=$ua->request($request);
			my $content3 = $answer3->content();
				
			$request->authorization_basic('admin', '5320');# Default SNOM login: administrator default password: 0000				
			my $answer4=$ua->request($request);
			my $content4 = $answer4->content();
		
			$request->authorization_basic('admin', '5330');# Default SNOM login: administrator default password: 0000							
			my $answer5=$ua->request($request);
			my $content5 = $answer5->content();
		
			$request->authorization_basic('admin', '5340');# Default SNOM login: administrator default password: 0000							
			my $answer6=$ua->request($request);
			my $content6 = $answer6->content();
	
	
			if ($content1 =~ /SIP Phone Configuration Tool/)
			{
			   	$TextWidget -> insert ("end","$Web_ipaddress: test admin/5212 - WARNING => used\n");
			   	$Results = $Results."$Web_ipaddress: test admin/5212 - WARNING => used\n";
			}	
			elsif ($content2 =~ /SIP Phone Configuration Tool/)
			{
			   	$TextWidget -> insert ("end","$Web_ipaddress: test admin/5215 - WARNING => used\n");
			   	$Results = $Results."$Web_ipaddress: test admin/5215 - WARNING => used\n";
			}		    
			elsif ($content3 =~ /SIP Phone Configuration Tool/)
			{
			   	$TextWidget -> insert ("end","$Web_ipaddress: test admin/5220 - WARNING => used\n");
			   	$Results = $Results."$Web_ipaddress: test admin/5220 - WARNING => used\n";
			}
			elsif ($content4 =~ /SIP Phone Configuration Tool/)
			{
			   	$TextWidget -> insert ("end","$Web_ipaddress: test admin/5320 - WARNING => used\n");
			   	$Results = $Results."$Web_ipaddress: test admin/5320 - WARNING => used\n";
			}	
			elsif ($content5 =~ /SIP Phone Configuration Tool/)
			{
			   	$TextWidget -> insert ("end","$Web_ipaddress: test admin/5330 - WARNING => used\n");
			   	$Results = $Results."$Web_ipaddress: test admin/5330 - WARNING => used\n";
			}		    
			elsif ($content6 =~ /SIP Phone Configuration Tool/)
			{
			   	$TextWidget -> insert ("end","$Web_ipaddress: test admin/5340 - WARNING => used\n");
			   	$Results = $Results."$Web_ipaddress: test admin/5340 - WARNING => used\n";
			}	    
			else
			{
			   	$TextWidget -> insert ("end","$Web_ipaddress: No default login/password used.\n");
			   	$Results = $Results."$Web_ipaddress: No default login/password used.\n";
			}		
			    
	   		$TextWidget -> insert ("end", "\n");					    
	   		$TextWidget -> insert ("end", "------------------------ END --------------------------------------------------\n");
			$TextWidget  -> update ();	
			$TextWidget  -> see ('end');   		
	   		$Results = $Results."\n";
	   		$Results = $Results."------------------------ END --------------------------------------------------\n";					    
		}
    } 
    else
	{
    	$subweb_mw->Dialog(-title => 'WARNING', 	
					-text => 'Bad IP address syntax !',
					)->Show( );		
    }   	
}


sub WEBBRUTEFORCEFULLSUBNET
{
	$Results = "";
	
	if ($Subnet_to_scan =~ /[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}\/[0-9]{1,2}/)
	{
		$TextWidget -> delete('0.0', 'end');
		$TextWidget -> insert("end", "-------------------------------------------------------------------------------\n");
		$TextWidget -> insert("end", "Starting to test $Subnet_to_scan for default MITEL Login/Password\n");
		$TextWidget -> insert("end", "-------------------------------------------------------------------------------\n");
		$TextWidget  -> update ();	
		$TextWidget  -> see ('end');
    	$Results = $Results."-------------------------------------------------------------------------------\n";
    	$Results = $Results."Starting to test $Subnet_to_scan for default MITEL Login/Password\n";
    	$Results = $Results."-------------------------------------------------------------------------------\n";

		#---- Creating a table with all the IP adresses -------
		my $sn = Net::Subnets->new;
	   	my ( $lowipref, $highipref ) = $sn->range( \$Subnet_to_scan );
	    my $lowIP = $$lowipref;
		my $highIP = $$highipref;
		my $listref = $sn->list( \( $lowIP, $highIP ) );

		foreach my $scan_address ( @{ $listref } ) 
		{
			if ($p->ping($scan_address))
		    {
		    	$TextWidget -> insert ("end","------- Testing $scan_address\n");
				$Results = $Results."------- Testing $scan_address\n";
			
				my $url_MITELPhone = "http://".$scan_address;
	
				my $ua = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0 });
				my $request = HTTP::Request->new(GET => $url_MITELPhone);
				
				$request->authorization_basic('admin', '5212');				
				my $answer1=$ua->request($request);
				my $content1 = $answer1->content();
			
				$request->authorization_basic('admin', '5215');							
				my $answer2=$ua->request($request);
				my $content2 = $answer2->content();
			
				$request->authorization_basic('admin', '5220');							
				my $answer3=$ua->request($request);
				my $content3 = $answer3->content();
					
				$request->authorization_basic('admin', '5320');				
				my $answer4=$ua->request($request);
				my $content4 = $answer4->content();
			
				$request->authorization_basic('admin', '5330');					
				my $answer5=$ua->request($request);
				my $content5 = $answer5->content();
			
				$request->authorization_basic('admin', '5340');							
				my $answer6=$ua->request($request);
				my $content6 = $answer6->content();
	
				if ($content1 =~ /SIP Phone Configuration Tool/)
				{
				   	$TextWidget -> insert ("end","$scan_address: test admin/5212 - WARNING => used\n");
				   	$Results = $Results."$scan_address: test admin/5212 - WARNING => used\n";
				}	
				elsif ($content2 =~ /SIP Phone Configuration Tool/)
				{
				   	$TextWidget -> insert ("end","$scan_address: test admin/5215 - WARNING => used\n");
				   	$Results = $Results."$scan_address: test admin/5215 - WARNING => used\n";
				}		    
				elsif ($content3 =~ /SIP Phone Configuration Tool/)
				{
				   	$TextWidget -> insert ("end","$scan_address: test admin/5220 - WARNING => used\n");
				   	$Results = $Results."$scan_address: test admin/5220 - WARNING => used\n";
				}
				elsif ($content4 =~ /SIP Phone Configuration Tool/)
				{
				   	$TextWidget -> insert ("end","$scan_address: test admin/5320 - WARNING => used\n");
				   	$Results = $Results."$scan_address: test admin/5320 - WARNING => used\n";
				}	
				elsif ($content5 =~ /SIP Phone Configuration Tool/)
				{
				   	$TextWidget -> insert ("end","$scan_address: test admin/5330 - WARNING => used\n");
				   	$Results = $Results."$scan_address: test admin/5330 - WARNING => used\n";
				}		    
				elsif ($content6 =~ /SIP Phone Configuration Tool/)
				{
				   	$TextWidget -> insert ("end","$scan_address: test admin/5340 - WARNING => used\n");
				   	$Results = $Results."$scan_address: test admin/5340 - WARNING => used\n";
				}	    
				else
				{
				   	$TextWidget -> insert ("end","$scan_address: No default login/password.\n");
				   	$Results = $Results."$scan_address: No default login/password.\n";
				}		
		    }
			else
			{
			   	$TextWidget -> insert ("end","------- Testing $scan_address\n");
			   	$TextWidget -> insert ("end","Unreachable\n");
			   	$Results = $Results."------- Testing $scan_address: Unreachable\n";
			   	$Results = $Results."Unreachable\n";
			}
   			$TextWidget  -> update ();	
			$TextWidget  -> see ('end'); 
		}
   		$TextWidget -> insert ("end", "\n");					    
   		$TextWidget -> insert ("end", "------------------------ END --------------------------------------------------\n");					    
		$TextWidget  -> update ();	
		$TextWidget  -> see ('end');
		$Results = $Results."\n";
		$Results = $Results."------------------------ END --------------------------------------------------\n";  	
	}
    else
	{
    	$subweb_mw->Dialog(-title => 'WARNING', 	
					-text => 'Bad subnet syntax !',
					)->Show( );		
    }
}


sub EXPLANATION
{
	$TextWidget -> delete('0.0', 'end');
	$TextWidget -> insert ("end", "-------------------------------------------------------------------------------\n");
	$TextWidget -> insert ("end", "Default login/Password of the following MITEL IP Phones are tested:\n");
	$TextWidget -> insert ("end", "-> 5212\n");
	$TextWidget -> insert ("end", "-> 5215\n");	
	$TextWidget -> insert ("end", "-> 5220\n");
	$TextWidget -> insert ("end", "-> 5320\n");
	$TextWidget -> insert ("end", "-> 5330\n");
	$TextWidget -> insert ("end", "-> 5340\n");
	$TextWidget -> insert ("end", "\n");
	$TextWidget -> insert ("end", "-------------------------------------------------------------------------------\n");
	$TextWidget  -> update ();	
	$TextWidget  -> see ('end'); 		
}


sub SAVERESULTS
{
	my $FileToSave = $subweb_mw->getSaveFile(
							-defaultextension => '.txt',
                            -initialdir => "user_data"
                              );

	open (TOSAVE, ">>$FileToSave");
	print TOSAVE $Results;
	close (TOSAVE);
	
}	
