Unnamed
public text v1 · immutable#!/usr/bin/perl -w
#
# a perl tool to make a exploit hunters life easier. looks through source code
# for possible exploits. the line found may not be an actual exploit, but it
# sure does spot possible ones faster than you could by hand. you can add
# functions that should be searched for yourself by editing the ifs in this
# file. also this tool has the ability to tail certain variables that you may
# find interesting. since sometimes you will find a possible exploit, but not
# able to figure out if the variable in the function is allready declared or
# not, you use this option to follow that variable and figure out if it is or
# not.
#
# $Id: audit.pl,v 0.1 2007/O2/17 08:21:00 varc Exp $
use strict;
use File::Find;
use Getopt::Long;
my ( $dir, $tail, $i );
my $options = { d => \$dir, t => \$tail };
GetOptions( $options, "d=s", "t:s" );
&usage unless $dir;
if ( !defined( $tail ) )
{
find( { wanted => \&scan, no_chdir => 1 }, $dir );
}
else
{
find( { wanted => \&tail, no_chdir => 1 }, $dir );
}
exit;
sub scan
{
my $fi = $File::Find::name;
if ( ( $fi =~ /\.php$/i ) ||
( $fi =~ /\.inc$/i ) ||
( $fi =~ /\.inc.php$/i) ||
( $fi =~ /\.php4$/i) )
{
my $i = 1;
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*include\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*include_once\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*require\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*require_once\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*exec\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*eval\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*system\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*passthru\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*popen\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*escapeshellcmd\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*pcntl_exec\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*fopen\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*extract\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*proc_open\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*proc_terminate\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*proc_get_status\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*proc_close\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*ini_restore\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*dl\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*mail\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*chroot\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*highlight_file\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*show_source\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*fsockopen\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*pfsockopen\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*gzopen\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*bzopen\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /\s*chroot\s*\(([^)]+)\)\s*;/ )
{
my $exp = $1;
if ( $exp =~ /\$/ )
{
print $fi . " [" . $exp . "] ". $line;
}
}
}
}
}
sub tail
{
my $fi = $File::Find::name;
if ( ( $fi =~ /\.php$/i ) ||
( $fi =~ /\.inc$/i ) ||
( $fi =~ /\.inc.php$/i) ||
( $fi =~ /\.php4$/i) )
{
open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
foreach my $line ( <FILY> )
{
if ( $line =~ /(\$*blah*)/ )
{
print $fi . " [" . $1 . "] " . $line;
}
}
}
}
sub usage
{
print "source code auditor\n";
print "usage: perl $0 -dt\n\n";
print " -d\t\tdirectory with the source code to scan\n";
print " -t\t\tvariable to tail (optional)\n";
exit;
}