#!/usr/bin/perl -w
#
# a perl tool to make a exploit hunters life easier. looks through source code
# for possible exploits. the line found may not be an actual exploit, but it
# sure does spot possible ones faster than you could by hand. you can add
# functions that should be searched for yourself by editing the ifs in this 
# file. also this tool has the ability to tail certain variables that you may
# find interesting. since sometimes you will find a possible exploit, but not
# able to figure out if the variable in the function is allready declared or
# not, you use this option to follow that variable and figure out if it is or
# not.
#
# $Id: audit.pl,v 0.1 2007/02/17 08:21:00 varc Exp $
 
use strict;
use File::Find;
use Getopt::Long;
 
my ( $dir, $tail, $i, @functions );
my $options = { d => \$dir, t => \$tail };
GetOptions( $options, "d=s", "t:s" );

@functions = ( "include", "include_once", "require", "require_once", "exec",
		 "eval", "system", "passthru", "popen", "escapeshellcmd",
		 "pcntl_exec", "fopen", "extract", "proc_open", "proc_terminate",
		 "proc_get_status", "proc_close", "ini_restore", "dl", "mail",
		 "chroot", "highlight_file", "show_source", "fsockopen",
		 "pfsockopen", "gzopen", "bzopen" );
 
&usage unless $dir;
 
if ( !defined( $tail ) )
{
        find( { wanted => \&scan, no_chdir => 1 }, $dir );
}
else
{
        find( { wanted => \&tail, no_chdir => 1 }, $dir );
}
 
exit;
 
sub scan
{
        my $fi = $File::Find::name;
 
        if ( ( $fi =~ /\.php$/i ) ||
             ( $fi =~ /\.inc$/i ) ||
             ( $fi =~ /\.inc.php$/i) ||
             ( $fi =~ /\.php4$/i) )
        {
                my $i = 1;
                open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
                foreach my $line ( <FILY> )
                {
			foreach my $f ( @functions )
			{
                        	if ( $line =~ /\s*$f\s*\(([^)]+)\)\s*;/ )
                        	{
                                	my $exp = $1;
                                	if ( $exp =~ /\$/ )
                                	{
                                        	print $fi . " [" . $exp . "] ". $line;
                                	}
                        	}
                	}
 		}
	}
}
 
sub tail
{
        my $fi = $File::Find::name;
 
        if ( ( $fi =~ /\.php$/i ) ||
             ( $fi =~ /\.inc$/i ) ||
             ( $fi =~ /\.inc.php$/i) ||
             ( $fi =~ /\.php4$/i) )
        {
                open( FILY, "$fi" ) or warn "Failed to open $fi - $!";
                foreach my $line ( <FILY> )
                {
                        if ( $line =~ /(\$$tail)/ )
                        {
                                print $fi . " [\$" . $tail . "] " . $line;
                        }
                }
        }
}
 
sub usage
{
        print "source code auditor\n";
        print "usage: perl $0 -dt\n\n";
        print "  -d\t\tdirectory with the source code to scan\n";
        print "  -t\t\tvariable to tail (optional)\n";
        exit;
}