/* 
Cold Fusion Exploit Scanner v0.1
            written by iCeR

Usage:
        $ gcc -o cf cf.c -w 
        $ ./cf www.yourserver.com > tinylog.txt
        
I wrote this program to let network admins check there security.
Only use this on your own server. Icer takes no responsibility 
for your actions.

Greetz to IC3D Inc., UHA1.com, Prognosisx.com, #webfringe, AcidBurn, Pr0gen and so on.



 */

#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
void main(int argc, char *argv[]){int sockfd;struct sockaddr_in host;
struct hostent *he;int port = 80;char *gets[4];char getbuff[1000];char *check;
gets[1] = "GET /cfdocs/expelval/openfile.cfm HTTP/1.0\n\n";
gets[2] = "GET /cfdocs/expelval/exprcalc.cfm HTTP/1.0\n\n";
gets[3] = "GET /cfdocs/expelval/displayopenedfile.cfm HTTP/1.0\n\n";
system("clear");
printf("\t\tCold Fusion Vulnerability Scanner\n");                 
 printf("\t\tBy iCeR -- UHA1.COM Time to get Cold\n");if (argc != 2){
        printf("\nUsage: %s [host]\n", argv[0]);        exit(0);}
if ((he=gethostbyname(argv[1])) == NULL){        perror("getting hostname");
        exit(0);}sockfd=socket(AF_INET, SOCK_STREAM, 0);
bcopy(he->h_addr, (char *)&host.sin_addr, he->h_length); 
host.sin_family=AF_INET;host.sin_port=htons(port);
if (connect(sockfd, (struct sockaddr*)&host, sizeof(host)) < 0){
        perror("connect");}printf("connected\n");
send(sockfd, gets[1],strlen(gets[1]),0);
recv(sockfd, getbuff, sizeof(getbuff),0);check = strstr(getbuff,"200");
if(check != NULL){        printf("openfile.cfm found\n");}else{
        printf("openfile.cfm wasn't found, so we are gunna exit\n");
        close(sockfd);        exit(0);}close(sockfd);
sockfd=socket(AF_INET, SOCK_STREAM, 0);host.sin_family=AF_INET;
host.sin_port=htons(port);
if (connect(sockfd, (struct sockaddr*)&host, sizeof(host)) < 0){    
        perror("connect");}send(sockfd, gets[2],strlen(gets[2]),0);
recv(sockfd, getbuff, sizeof(getbuff),0);check = strstr(getbuff,"200");
if(check != NULL){              printf("exprcalc.cfm found\n");}close(sockfd);
sockfd=socket(AF_INET, SOCK_STREAM, 0);host.sin_family=AF_INET;
host.sin_port=htons(port);
if (connect(sockfd, (struct sockaddr*)&host, sizeof(host)) < 0){
        perror("connect");}send(sockfd, gets[3],strlen(gets[3]),0);
recv(sockfd, getbuff, sizeof(getbuff),0);check = strstr(getbuff,"200");
if(check != NULL){        printf("displayopenedfile.cfm found\n");}
close(sockfd);printf("\nAll done. Enjoy.\n");}