/* Yet Another Wingate Scanner (YAWS) Version 0.1
   (C) 1999 by tempus fugit, tempusf@gmx.net
   URL: tf.darpa.org
   You can freely distribute this stuff, but
   please let the copyright information intact
   and don't alter the code.

   Feel free to send my any comments or suggestions

   Features:
   - can read the hosts to check from a file
   - can scan subnets (class b and c)
   - has an extra flag to prevent intrusion detection systems from being activated
   - logs the results
   - logs successes in an extra file
   - you can enter the number of subprocesses
   - you can specify a timeout

   compile with gcc yaws.c -o yaws

*/

#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <time.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <sys/wait.h>
#include <unistd.h>
#include <signal.h>
#include <netdb.h>
#include <stdlib.h>
#include <arpa/inet.h>
#include <ctype.h>
#include <getopt.h>
#include <fcntl.h>

#define wgateport 23

void CheckForWingate (char *,int);
void init_rand ();
void DoLog (char *);
void LogSuccess (char *);
void usage ();
int sock, timeout=5;
char *logfile="yaws.log", *suclogfile="yaws.suc", *progname;

int main (int argc, char **argv) {
	static int forked=0;
	int forks=1, i, pid, dummy, scanned=0, toscan=0, j, k, extra=0, rnumber;
	char c, network[64]="none", class[]="z", inputfile[64]="", host[100];
	FILE *input;
	typedef char target[100];
	target *mytarget;
	progname=argv[0];
	while ((c = getopt (argc, argv, "vef:l:n:c:i:t:s:")) != -1) {
		switch (c) {
			case 'f': forks = atoi (optarg);
				  break;
			case 'e': extra = 1;
				  break;
			case 'l': logfile = optarg;
				  break;
			case 'n': strncpy (network, optarg, 64);
				  break;
			case 'c': strncpy (class, optarg, 1);
				  break;	
			case 'i': strncpy (inputfile, optarg, 64);
				  break;
			case 't': timeout = atoi (optarg);
				  break;
			case 's': suclogfile = optarg;
				  break;
			case 'v': usage ();
			case '?': usage ();
		}
	}
	
	if (argc < 2) {
		fprintf (stderr, "To few argumtens.\n");
		usage ();
	}
	
	if (forks < 1) {
		fprintf (stderr, "To little number of forks.\n");
		usage ();
	}
	
	DoLog ("YAWS 1999 by tempus fugit\n\n");
	
	if ((strcmp (network, "none")) && (strcmp (class, "z"))) {
		if ((!strcmp (class, "b")) && (extra == 0)) {	
			for (j=1; j<255; j++) {
				for (k=1; k<255; k++) {
					snprintf (host, 100, "%s.%d.%d", network, j, k);
					if ((pid = fork ()) == 0) {
						CheckForWingate (host, wgateport);
						kill(getpid(),9);
					}
					if (pid != 0) {
						forked++;
						if (forked >= forks) {
							wait (&dummy);
							forked--;
						}
					}
				}
			}
		}
		else if ((!strcmp(class, "c")) && (extra == 0)) {
			for (j=1; j<255; j++) {
				snprintf (host, 100, "%s.%d", network, j);
				if ((pid = fork ()) == 0) {
					CheckForWingate (host, wgateport);
					kill(getpid(),9);
				}
				if (pid != 0) {
					forked++;
					if (forked >= forks) {
						wait (&dummy);
						forked--;
					}
				}
						
			}
		}
		else if ((!strcmp(class, "b")) && (extra == 1)) {
			init_rand();
			mytarget = malloc ((254*254) * (sizeof (target)));
			if (mytarget == NULL) {
				fprintf (stderr, "Cannot allocate memory.\n");
				exit (1);
			}
			fprintf (stdout, "I am computing the random IPs, this may take a while.\n");			
			for (j=1; j<255; j++) {
				for (k=1; k<255; k++) {
				        marke:					
					rnumber = (int) ((254.0*254.0)*rand()/(RAND_MAX+1.0));
					if (strlen ((mytarget+rnumber)) > 1) goto marke;				
					snprintf ((mytarget+rnumber), 100, "%s.%d.%d", network, j, k);
					
				}
			}
			for (j=0; j<=(254*254); j++) {
				if ((pid = fork ()) == 0) {
					CheckForWingate ((mytarget+j), wgateport);
					kill(getpid(),9);
				}
				if (pid != 0) {
					forked++;
					if (forked >= forks) {
						wait (&dummy);
						forked--;
					}
				}
						
			}
		}
		
		else if ((!strcmp(class, "c")) && (extra == 1)) {
			init_rand();
			mytarget = malloc ((255) * (sizeof (target)));
			if (mytarget == NULL) {
				fprintf (stderr, "Cannot allocate memory.\n");
				exit (1);
			}
			for (j=1; j<255; j++) {
				        marke2:					
					rnumber = 1+(int) ((254.0)*rand()/(RAND_MAX+1.0));
					if (strlen ((mytarget+rnumber)) > 1) goto marke2;				
					snprintf ((mytarget+rnumber), 100, "%s.%d", network, j);						                   										
				
			}
			for (j=1; j<255; j++) {
				if ((pid = fork ()) == 0) {
					CheckForWingate ((mytarget+j), wgateport);
					kill(getpid(),9);
				}
				if (pid != 0) {
					forked++;
					if (forked >= forks) {
						wait (&dummy);
						forked--;
					}
				}			
			}
		}
			
		else
		{
			if ((class != "b") && (class != "c")) {
				printf ("You entered an unknown class or no network.\n");
				return 1;
			}
		}
	for (i=1; i <= forked; i++) wait (&dummy);
	return 0;
	}
		
	input = fopen (inputfile, "r");
	if (input == NULL) {
		fprintf (stderr, "Cannot open input file.\n");
		return 1;
	}
		
	while ((fscanf (input, "%s\n", host)) != EOF) {
		if ((pid = fork ()) == 0) {
			CheckForWingate (host, wgateport);
			kill(getpid(),9);
		}
		if (pid != 0) {
			forked++;
			if (forked >= forks) {
				wait (&dummy);
				forked--;
			}
		}
			
	}
	fclose (input);
	for (i=1; i <= forked; i++) wait (&dummy);

}

void alarm_handler (int sig) {
	close (sock);
	return;
}

void CheckForWingate (char *host, int port)
{
	int ret, conn, sel;
	char buffer[128], logmsg[1024];
	struct sockaddr_in sin;
	fd_set fd;
	struct timeval tv;
	struct hostent *he;
	
	if ((strlen (host)) == 0) exit (1);
	
	if (!(sock = socket (AF_INET, SOCK_STREAM, 0))) {
		fprintf (stderr, "Cannot create a socket.\n");
		exit (1);
	}
	
	if (inet_addr (host) == -1) {
		if ((he=gethostbyname (host)) == NULL) {
			snprintf (logmsg, 1024, "The host %s cannot be resolved.\n", host);
			DoLog (logmsg);
			return;
		} 		
		memcpy (&sin.sin_addr, he->h_addr,he->h_length);
	}
	else if ((sin.sin_addr.s_addr = inet_addr (host)) == -1) {
		snprintf (logmsg, 1024, "IP %s cannot be identified.\n", host);
		DoLog (logmsg);
		return;
	}
	sin.sin_family = AF_INET;
	sin.sin_port = htons (port);
	signal (SIGALRM, alarm_handler);
	alarm (timeout);
	conn = connect (sock, (struct sockaddr*)&sin, sizeof (sin));
	if (conn < 0) {
		snprintf (logmsg, 1024, "Cannot connect to host %s on port %d.\n", host, port);
		DoLog (logmsg);
		close (sock);
		return;
	}
	FD_ZERO (&fd);
	FD_SET (sock, &fd);
	tv.tv_sec = timeout;
	tv.tv_usec = 0;
	sel = select (sock+1, &fd, NULL, NULL, &tv);
	if (sel > 0) {
		if ((ret = recv (sock, buffer, 128, 0)) > 0) {
			if (!strcmp (buffer, "WinGate>")) {
				snprintf (logmsg, 1024, "Host %s is a wingate.\n", host);
				DoLog (logmsg);
				LogSuccess (logmsg);
			}
			else {
				snprintf (logmsg, 1024, "Host %s is no wingate.\n", host);
				DoLog (logmsg);
			}
		}
		
	}
	if (!sel) {
		snprintf (logmsg, 1024, "Host %s time out by search.\n", host);
		DoLog (logmsg);
	}
	if (sel == -1) {
		fprintf (stderr, "Select Error.\n");
		exit (1);
	}
	close (sock);
	return;
}

void init_rand() {
        int fd;
        unsigned n;
        fd = open("/dev/random", O_RDONLY);
        read(fd, &n, sizeof(n));
        close(fd);
        srand(n);
}

void DoLog (char *message) {
	FILE *file;
	file = fopen (logfile, "a");
	if (file == NULL) {
		fprintf (stderr, "File Error.\n");
		exit (1);
	}
	fprintf (file,"%s", message);
	fclose (file);
}

void LogSuccess (char *message) {
	FILE *file;
	file = fopen (suclogfile, "a");
	if (file == NULL) {
		fprintf (stderr, "File Error.\n");
		exit (1);
	}
	fprintf (file, "** SUCCESS: **  ");
	fprintf (file, "%s", message);
	fclose (file);
}

void usage () {
	printf ("[YAWS] Yet Another Wingate Scanner Version 0.1 1999 by tempus fugit\n");
	printf ("mail: tempusf@gmx.net\n");
	printf ("URL: http://tf.darpa.org\n\n");
	printf ("Usage: %s -v -l <logfile> -f <forks> -t <timeout> -n <network> -c <network-class> -i <input file> -s <success-logfile>\n", progname);
	printf ("\tlogfile: the name of the file where the scanning results are stored.\n");
	printf ("\tforks  : the number of forks the program is allowed to create.\n");
	printf ("\ttimeout: timeout of search-process in seconds.\n");
	printf ("\tnetwork: you can enter network that will be checked for wingates.\n");
	printf ("\tnetwork: can be <X.X> or <X.X.X> if class is\n");
	printf ("\t                  b   or    c\n");
	printf ("\tinput-file: you can specify an input-file from which the hosts to checked are extraced.\n");
	printf ("\tsuccess-logfile: success messages are written in this file.\n");
	printf ("\tif you choose an input-file, the network and class options are ignored.\n");
	printf ("Example: %s -l mylogs -n 200.10 -c b -s wow\n", progname);
	exit (0);
}