<?php
//
// $Id: portscan.php,v 1.3 2004/11/18 23:09:53 greg_k Exp $
//

/***********************************************************/
/* last update: 12.17.2002                                 */
/* --------------------------------------------------------*/
/*                    Inprotect                            */
/* --------------------------------------------------------*/
/* Copyright (C) 2002 Inprotect.com                        */
/*                                                         */
/* This program is free software; you can redistribute it  */
/* and/or modify it under the terms of version 2 of the    */
/* GNU General Public License as published by the Free     */
/* Software Foundation.                                    */
/* This program is distributed in the hope that it will be */
/* useful, but WITHOUT ANY WARRANTY; without even the      */
/* implied warranty of MERCHANTABILITY or FITNESS FOR A    */
/* PARTICULAR PURPOSE. See the GNU General Public License  */
/* for more details.                                       */
/*                                                         */
/* You should have received a copy of the GNU General      */
/* Public License along with this program; if not, write   */
/* to the Free Software Foundation, Inc., 59 Temple Place, */
/* Suite 330, Boston, MA 02111-1307 USA                    */
/*                                                         */
/* Contact Information:                                    */
/* Alex Zimin (alex@inprotect.com)                         */
/* http://www.inprotect.com                                */
/***********************************************************/
/* See the README.txt and/or help files for more           */
/* information on how to use & config.                     */
/* See the LICENSE.txt file for more information on the    */
/* License this software is distributed under.             */
/*                                                         */
/* This program is intended for use in an authorized       */
/* manner only, and the author can not be held liable for  */
/* anything done with this program, code, or items         */
/* discovered with this program's use.                     */
/***********************************************************/

include ('header.php');

include ('permissions.inc.php');

$acl=checkacl("nmap", $dbconn);


if ($acl=="Y") {



    $ipaddress = $_SERVER[REMOTE_ADDR];

    if ($allowscan==1){
        if ($hostname==""){
            $hostname=$_SERVER[REMOTE_ADDR];
        }
    }
    else {
        $hostname=$_SERVER[REMOTE_ADDR];
    };


    /*---CREATE-FORMBLOCK---------------------------------------------------*/
    $form_block = "
                  <h2>Nmap Port Scan</h2><br>
                  <form method=\"post\" action=\"portscan.php\">
                  <table summary=\"Portscan Details\" border=\"0\">
                  <tr>
                  <td><B>Email Address</B></td>
                  <td><input type=\"text\" name=\"useremail\" value=\"$useremail\" size=40></td>
                  </tr>
                  <tr>
                  <td><B>Hostname or IP Address to scan:</B></td>";
    if ($allowscan==1) {
        $form_block = $form_block . "<td><INPUT type=\"text\" NAME=\"hostname\" VALUE=\"$hostname\" SIZE=40></td>";
    }
    else
    {
        $form_block=$form_block."<td>$hostname</td>";
    };

    $form_block=$form_block."</tr>
                <tr>
                <td><B>Port Types:</B></td>
                <td>
                <input type=\"radio\" name=\"porttype\" value=\"T\" checked>TCP<br>
                <input type=\"radio\" name=\"porttype\" value=\"U\">UDP<br>
                <input type=\"radio\" name=\"porttype\" value=\"B\">Both
                </td>
                </tr>
                <tr>
                <td><B>Scan Type:</B></td>
                <td><input type=\"radio\" name=\"scantype\" value=\"Y\" checked>Scan common ports<BR>
                <input type=\"radio\" name=\"scantype\" value=\"N\">Scan port range<BR>
                </td>
                </tr>
                <tr>
                <td><B>Port range</B> (if selected)</td>
                <td>Start&nbsp;<input type=\"text\" name=\"portstart\" value=\"1\">&nbsp;End&nbsp;
                <input type=\"text\" name=\"portend\" value=\"65535\">
                </td>
                </tr>
                <tr>
                <td><b>Additional options:</b></td>
                <td><input type=\"checkbox\" name=\"nopinghost\" value=\"Y\" checked>Do not ping remote host(s)</td>
                </tr>
                <tr>
                <td></td><td>
                <input type=\"checkbox\" name=\"versioncheck\" value=\"Y\">Use Nmap's version detection (require Nmap > 3.45)
                </td>
                </tr>
                </table>
                <INPUT type=\"hidden\" name=\"opi\" value=\"ds\"><BR>
                <INPUT TYPE=\"submit\" NAME=\"submit\" VALUE=\"Submit\">
                </FORM><br><br>";
    /*---END-CREATE-FORMBLOCK-----------------------------------------------*/
    /*---SHOW-EMPTY-FORM----------------------------------------------------*/
    if ($opi != "ds")
    {
        echo "$form_block";
    }
    /*---SEND-FORM----------------------------------------------------------*/
    else if ($opi == "ds")
    {
        $send="yes";
        //		if( !eregi( "^" .
        //            "[a-z0-9]+([_\\.-][a-z0-9]+)*" .    //user
        //            "@" .
        //            "([a-z0-9]+([\.-][a-z0-9]+)*)+" .   //domain
        //            "\\.[a-z]{2,}" .                    //sld, tld
        //            "$", $useremail, $regs)
        //		)

        //		{
        //			$send="no";
        //			$form_err="<LI>Email address isn't a valid mail address.";
        //		}

        //		$atlocation=strpos($useremail,"@")+1;
        //		if ($atlocation===false) {
        //			$send="no";
        //			$form_err="<LI>Email address isn't a valid mail address.";
        //		}
        //		else
        //		{
        //			$usermaildomain=substr($useremail,$atlocation);
        //			if (!getmxrr( $usermaildomain, $mxrecords)){

        //				$send="no";
        //				$form_err="<LI>Email address isn't a valid mail address.";
        //			}
        //		}


        if ($allowscan<>1){
            if ($hostname <> $_SERVER[REMOTE_ADDR]) {

                $send="no";
                $form_err .="<LI>You are trying to scan not your IP address.";
            };
        };


        //		$testhostaddress=validate_ip($hostname,$enableprivate);
        //		if ($testhostaddress==0 or $testhostaddress==10){
        //			if ( gethostbyname($hostname) == $hostname) {
        //  			$send="no";
        //				$form_err .= "<LI>Test host is incorrect.";
        //			}
        //			else {
        //			$testhostaddress=validate_ip(gethostbyname($hostname),$enableprivate);
        //			if ($testhostaddress==11) {
        //				$send="no";
        //				$form_err .= "<LI>IP address is in invalid range.";
        //			};
        //			};
        //		}
        //		elseif ($testhostaddress==11){
        //				$send="no";
        //				$form_err .= "<LI>IP address is in invalid range.";
        //		}

        $result=$dbconn->Execute("select scanip from portscan where scancomplete='N' and username='$username'");
        list($submittedip) = $result->fields;
        $result->Close();
        if ($submittedip==$hostname) {
            $send="no";
            $form_err .= "<LI>This IP - $hostname was already submitted for scan, please wait till scan completes.";

        };


        $resultdb=$dbconn->Execute("select count(proxyip) as proxycount from proxy where proxyip='$hostname'");
        list($proxycount) = $resultdb->fields;
        if ($proxycount>0) {

            $msg="Attempted proxy scan of $hostname by $username - $useremail.";
            $to="root@localhost";
            $mailheaders="From: root@localhost\n";
            $mailheaders.="Reply-To: root@localhost\n\n";
            $subject="Warning - attempted proxy scan";
            mail($to, $subject, $msg, $mailheaders);


            $msg="Attempted proxy scan of $hostname by $username - $useremail.";
            $to=$useremail;
            $mailheaders="From: root@localhost\n";
            $mailheaders.="Reply-To: root@localhost\n\n";
            $subject="Warning - attempted proxy scan";
            mail($to, $subject, $msg, $mailheaders);


            $send="no";
            $form_err .= "<LI>Attempted proxy scan.";
        };
        $result->Close();




        $portrange="valid";

        if (!is_numeric($portstart)) {
            $send="no";
            $form_err .="<LI>Port start value should be numeric 1 -65535.";
            $portrange="notvalid";
        }
        elseif (!($portstart>=1 and $portstart<=65535)){
            $send="no";
            $form_err .="<LI>Port start value is out of range.";
            $portrange="notvalid";
        }

        if (!is_numeric($portend)) {
            $send="no";
            $form_err .="<LI>Port end value should be numeric 1 -65535.";
            $portrange="notvalid";
        }
        elseif (!($portend>=1 and $portend<=65535)){
            $send="no";
            $form_err .="<LI>Port end value is out of range.";
            $portrange="notvalid";
        }

        if ($portrange=="valid") {
            if (!($portstart<=$portend)) {
                $send="no";
                $form_err .="<LI>Port start value should be less or equal port end value.";
            };
        }
        $options="";

        if ($nopinghost=="Y") {
            $options=" -P0";
        }

        if($versioncheck=="Y") {

            $options.=" -sV";
        }


        if ($send != "no")
        {

            $result=$dbconn->Execute("insert into portscan (username, userip, scanip, email, ports, portstart, portend, common, options) values ('".$username."','".$ipaddress."','".$hostname."','".$useremail."','".$porttype."',".$portstart.",".$portend.",'".$scantype."','$options')");

            echo "<CENTER>Hostname: ".$hostname." will be scanned shortly.<BR>";
            echo "";
            //echo "$form_block";
            //			echo "<BR>Scanned $portscancount hosts";
        }
        else if ($send == "no")
        {
            echo "$form_err";
            echo "$form_block";
        }
    }
    $result=$dbconn->Execute("select count(id) as portscancount from portscan where scancomplete='Y' or scancomplete='F'");
    list($portscancount) = $result->fields;
    $result->Close();
    $result=$dbconn->Execute("select count(id) as portscancount from portscan where scancomplete='N'");
    list($queuecount) = $result->fields;
    $result->Close();
    echo "<BR><BR>Scanned $portscancount hosts";
    echo "<BR>Currently there are $queuecount scans waiting in a queue or running";

}
else {

    echo "Access Denied!!!<br>";
}






include("footer.php");

function validate_ip ($ip, $enableprivate) {
    $ipok = 0;
    $flag = 0;
    if (ereg('^([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})$',$ip,$r)) {
        for ($i=1; $i <= 4; $i++) {
            $r[$i] = intval($r[$i]);

            switch ($i){
            case 1:
                    if ($r[$i]>=1 && $r[$i]<=255) $ipok++;
                break;
            case 2:
                if ($r[$i]>=0 && $r[$i]<=255) $ipok++;
                break;
            case 3:
                if ($r[$i]>=0 && $r[$i]<=255) $ipok++;
                break;
            case 4:
                if ($r[$i]>=1 && $r[$i]<=254) $ipok++;
                break;
            }
            //echo "r=$r[$i] ipok=$ipok<BR>" ;
            //if ($r[$i] <= 255) $ipok++;
        }

        if ($enableprivate<>1){
            if ($ipok==4) {
                if ($r[1]==127 or $r[1]==10 or $r[1]==172) $flag=10;
                if ($r[1]==192 && $r[2]==168) {
                    $flag=10;
                };
            }
        };
    }
    ($ipok == 4) ? $ip = 1+$flag : $ip = 0+$flag;

    return $ip;
}

?>
