#!/usr/bin/perl

#
# Copyright (c) 2005,2006 by Matteo Cantoni (nothink.org)
#
# snmpcheck is a tool to get information via SNMP protocols on Windows, Linux,
# Cisco, HP-UX, SunOS, AIX and other platforms that supports a SNMP agent.
# snmpcheck has been tested on GNU/Linux, *BSD and Windows (Cygwin and ActivePerl) systems.
# snmpcheck is distributed under GPL license and based on "Athena-2k" script by jshaw. 
#
# Note: "TCP connections enumeration" can be very long, beyond 60 seconds. Use -d flag to disable it.  
#

use strict;
use Getopt::Std;
use IO::Socket;
use Net::SNMP;
use Number::Bytes::Human qw(format_bytes);
use Time::HiRes qw( usleep ualarm gettimeofday tv_interval );

my $name        = "snmpcheck.pl";
my $version     = "v1.6";
my $description = "snmp enumerator";
my $copyright   = "Copyright (c) 2005,2006";
my $author      = "Matteo Cantoni (nothink.org)";

#####################################################################################################
# MIBs Involved 
my $mibDescr                       = "1.3.6.1.2.1.1.1.0";            # System Description
my $mibNTDomain                    = "1.3.6.1.4.1.77.1.4.1.0";       # NT Primary Domain
my $mibUptime                      = "1.3.6.1.2.1.1.3.0";            # System Uptime
my $mibContact                     = "1.3.6.1.2.1.1.4.0";            # System Contact
my $mibName                        = "1.3.6.1.2.1.1.5.0";            # System Name
my $mibLocation                    = "1.3.6.1.2.1.1.6.0";            # System Location
my $mibServices                    = "1.3.6.1.4.1.77.1.2.3.1.1";     # Services (add to it)
my $mibAccounts                    = "1.3.6.1.4.1.77.1.2.25";        # User Accounts
my $mibMemSize                     = "1.3.6.1.2.1.25.2.2.0";         # Total System Memory
my $mibMotd                        = "1.3.6.1.4.1.42.3.1.3.0";       # Motd (Solaris)
# Devices
my $mibDevice                      = "1.3.6.1.2.1.25.3.2.1.3";       # Devices list
my $mibDevStatus                   = "1.3.6.1.2.1.25.3.2.1.5";       # Devices status
# Processs
my $mibProcesses                   = "1.3.6.1.2.1.25.1.6.0";         # System Processes 
my $mibRunIndex                    = "1.3.6.1.2.1.25.4.2.1.1";       # Running PIDs 
my $mibRunName                     = "1.3.6.1.2.1.25.4.2.1.2";       # Running Programs
my $mibRunPath                     = "1.3.6.1.2.1.25.4.2.1.4";       # Processes Path
my $mibRunParameters               = "1.3.6.1.2.1.25.4.2.1.5";       # Processes Parameters
my $mibRunType                     = "1.3.6.1.2.1.25.4.2.1.6";       # Processes Type
my $mibRunStatus                   = "1.3.6.1.2.1.25.4.2.1.7";       # Processes Status
my $mibProName                     = "1.3.6.1.4.1.42.3.12.1.1.10";   # Running Process Name (Solaris)
my $mibProPid                      = "1.3.6.1.4.1.42.3.12.1.1.1";    # Running Process Pid (Solaris)
my $mibProUser                     = "1.3.6.1.4.1.42.3.12.1.1.8";    # Running Process User (Solaris)
# Storage
my $mibSDType                      = "1.3.6.1.2.1.25.2.3.1.2";       # Storage Device Type
my $mibStorDescr                   = "1.3.6.1.2.1.25.2.3.1.3";       # Storage Description
my $mibStoreUnits                  = "1.3.6.1.2.1.25.2.3.1.4";       # Storage Units 
my $mibStorSize                    = "1.3.6.1.2.1.25.2.3.1.5";       # Storage Total Size
my $mibStorUsed                    = "1.3.6.1.2.1.25.2.3.1.6";       # Storage Used
my $mibStoreHP                     = "1.3.6.1.4.1.11.2.3.1.2";       # Storage Description (HP-UX)
my $mibPtype                       = "1.3.6.1.2.1.25.3.8.1.4";       # Partition Type
# Network
my $mibInt                         = "1.3.6.1.2.1.2.2.1.2";          # Network Interfaces
my $mibIntMTU                      = "1.3.6.1.2.1.2.2.1.4";          # Net Int MTU Size
my $mibIntSpeed                    = "1.3.6.1.2.1.2.2.1.5";          # Net Int Speed
my $mibIntBytesIn                  = "1.3.6.1.2.1.2.2.1.10";         # Net Int Octets In
my $mibIntBytesOut                 = "1.3.6.1.2.1.2.2.1.16";         # Net Int Octects Out
my $mibIntPhys                     = "1.3.6.1.2.1.2.2.1.6";          # Int MAC addr
my $mibAdminStat                   = "1.3.6.1.2.1.2.2.1.7";          # Int up/down?
my $mibIPForward                   = "1.3.6.1.2.1.4.1.0";            # IP Forwarding?
my $mibIPAddr                      = "1.3.6.1.2.1.4.20.1.1";         # Int IP Address
my $mibNetmask                     = "1.3.6.1.2.1.4.20.1.3";         # Int IP Netmask
# Software
my $mibInstalled                   = "1.3.6.1.2.1.25.6.3.1.2";       # Installed Programs
# IIS
my $http_totalBytesSentLowWord     = "1.3.6.1.4.1.311.1.7.3.1.2.0";  # totalBytesSentLowWord
my $http_totalBytesReceivedLowWord = "1.3.6.1.4.1.311.1.7.3.1.4.0";  # totalBytesReceivedLowWord
my $http_totalFilesSent            = "1.3.6.1.4.1.311.1.7.3.1.5.0";  # totalFilesSent
my $http_currentAnonymousUsers     = "1.3.6.1.4.1.311.1.7.3.1.6.0";  # currentAnonymousUsers
my $http_currentNonAnonymousUsers  = "1.3.6.1.4.1.311.1.7.3.1.7.0";  # currentNonAnonymousUsers
my $http_totalAnonymousUsers       = "1.3.6.1.4.1.311.1.7.3.1.8.0";  # totalAnonymousUsers
my $http_totalNonAnonymousUsers    = "1.3.6.1.4.1.311.1.7.3.1.9.0";  # totalNonAnonymousUsers
my $http_maxAnonymousUsers         = "1.3.6.1.4.1.311.1.7.3.1.10.0"; # maxAnonymousUsers
my $http_maxNonAnonymousUsers      = "1.3.6.1.4.1.311.1.7.3.1.11.0"; # maxNonAnonymousUsers
my $http_currentConnections        = "1.3.6.1.4.1.311.1.7.3.1.12.0"; # currentConnections
my $http_maxConnections            = "1.3.6.1.4.1.311.1.7.3.1.13.0"; # maxConnections
my $http_connectionAttempts        = "1.3.6.1.4.1.311.1.7.3.1.14.0"; # connectionAttempts
my $http_logonAttempts	           = "1.3.6.1.4.1.311.1.7.3.1.15.0"; # logonAttempts
my $http_totalGets	           = "1.3.6.1.4.1.311.1.7.3.1.16.0"; # totalGets
my $http_totalPosts	           = "1.3.6.1.4.1.311.1.7.3.1.17.0"; # totalPosts
my $http_totalHeads	           = "1.3.6.1.4.1.311.1.7.3.1.18.0"; # totalHeads
my $http_totalOthers	           = "1.3.6.1.4.1.311.1.7.3.1.19.0"; # totalOthers
my $http_totalCGIRequests          = "1.3.6.1.4.1.311.1.7.3.1.20.0"; # totalCGIRequests
my $http_totalBGIRequests          = "1.3.6.1.4.1.311.1.7.3.1.21.0"; # totalBGIRequests
my $http_totalNotFoundErrors       = "1.3.6.1.4.1.311.1.7.3.1.22.0"; # totalNotFoundErrors
# Shares
my $mibShareName                   = "1.3.6.1.4.1.77.1.2.27.1.1";    # Reports Share Names
my $mibSharePath                   = "1.3.6.1.4.1.77.1.2.27.1.2";    # Reports Share Path
my $mibShareComm                   = "1.3.6.1.4.1.77.1.2.27.1.3";    # Reports Share Comments
# Routing Info
my $mibRouteDest                   = "1.3.6.1.2.1.4.21.1.1";         # Route Destinations
my $mibRouteMetric                 = "1.3.6.1.2.1.4.21.1.3";         # Route Metric
my $mibRouteNHop                   = "1.3.6.1.2.1.4.21.1.7";         # Route Next Hop 
my $mibRouteMask                   = "1.3.6.1.2.1.4.21.1.11";        # Route Mask
# TCP Connections
my $mibTCPState                    = "1.3.6.1.2.1.6.13.1.1";         # TCP Connect State
my $mibTCPLAddr                    = "1.3.6.1.2.1.6.13.1.2";         # TCP Local Address
my $mibTCPLPort                    = "1.3.6.1.2.1.6.13.1.3";         # TCP Local Port
my $mibTCPRAddr                    = "1.3.6.1.2.1.6.13.1.4";         # TCP Remote Address
my $mibTCPRPort                    = "1.3.6.1.2.1.6.13.1.5";         # TCP Remote Port
# UDP Listening
my $mibUDPLAddr                    = "1.3.6.1.2.1.7.5.1.1";          # UDP Local Address
my $mibUDPLPort                    = "1.3.6.1.2.1.7.5.1.2";          # UDP Local Port
#####################################################################################################

my @hosts;
my $checksun  = 0;
my $webport   = 80;
my $localtime = localtime();
my ($status,$session,$error);

our ($opt_t,$opt_i,$opt_p,$opt_c,$opt_v,$opt_r,$opt_d,$opt_T,$opt_l,$opt_h);
getopts("t:i:p:c:v:r:dT:lh");

my $community = $opt_c || "public";
my $port      = $opt_p || 161;
my $snmpver   = $opt_v || 1;
my $retries   = $opt_r || 1;
my $timeout   = $opt_T || 45;

my $usage = "$name $version - $description\n$copyright by $author\n
 Usage ./$name -t <ip address> [-i] [-p] [-c] [-v] [-r] [-d] [-T] [-l] [-h]\n
\t-t : target host or ip address range;
\t-i : optional list of targets;
\t-p : snmp port; default port is $port;
\t-c : snmp community; default is $community;
\t-v : snmp version; default is $snmpver;
\t-r : request retries; default is $retries;
\t-d : disable \"TCP connections\" enumeration!
\t-T : timeout; default is $timeout. Max is 60;
\t-l : enable logging;
\t-h : show help menu;\n\n Example: ./$name -t 192.168.0.1\n\n";

die $usage if  $opt_h;
die $usage if !$opt_t && !$opt_i;
die $usage if  $opt_t &&  $opt_i;
die " [-] Error: max timeout value is 60 seconds!\n" if $timeout > 60;

$|=1;

$SIG{INT} = sub {
	close LOG if $opt_l;
	exit(1);
};

print "$name $version - $description\n$copyright by $author\n\n";

{ my $flip = "|"; sub wheel { print $flip = { reverse split //, '|/\|-\/-|', -1 }->{ $flip }, "\b"; } }

if ($opt_t){
	push @hosts,$opt_t;
}

if ($opt_i){
	open(IPLIST, "<$opt_i") || die " [-] Error: cannot open the ip address list file: $!\n";
		chomp (@hosts = <IPLIST>);
	close (IPLIST);
}

my $n = $#hosts + 1;
print " [*] $n host/s to scan\n [*] starting...\n";

foreach(@hosts){

	my $pid = fork();

	die "\n [-] Error: fork() failed: $!" unless defined $pid;

	if($pid>0){
		wait();
		next;
	}else{
		local $SIG{ALRM} = sub { exit(0); };
		alarm $timeout;
		Connect($_);
		alarm 0;
		exit(0);
	}
}

print "\n";

exit(0);

sub Connect {

	my $target = shift;
	for ($target) { s/^\s+//; s/\s+$//; }

	my $logfile = "snmpcheck-log-$target.txt";

	if ($opt_l){
		open (LOG, ">$logfile") || die " [-] Error: cannot open the log file $logfile: $!\n";
	}

	$SIG{ALRM} = sub {
		close LOG if $opt_l;	
		print "\n [-] $target, connection timeout! Use -T flag to increase timeout.";
		exit(0);
	};

	($session,$error) = Net::SNMP->session(
		Hostname  => $target,
		Community => $community,
		Domain    => 'udp',
		Port      => $port,
		Version   => $snmpver,
		Timeout   => $timeout,
		Retries   => $retries
	);

	if ($session){

		my $start_time = [gettimeofday];

		my $hostname  = getrequest($mibName);
		my $descr     = getrequest($mibDescr);
		my $uptime    = getrequest($mibUptime);
		my $ntdomain  = getrequest($mibNTDomain);
		my $contact   = getrequest($mibContact);
		my $location  = getrequest($mibLocation);
		my $motd      = getrequest($mibMotd);

		if ($descr){
			chomp $descr;
			for ($descr){s/^\s+//; s/\s+$//;}
		}

		chomp $motd if $motd;
	
		$checksun = 1 if $descr =~ /^Sun/;

		printer("\n [x] $target, connecting... starting check at $localtime\n\n");

		printer(" Hostname        : $hostname\n") if $hostname;
		printer(" Description     : $descr\n")    if $descr;
		printer(" Uptime (snmpd)  : $uptime\n")   if $uptime;
		printer(" Domain          : $ntdomain\n") if $ntdomain;
		printer(" Contact         : $contact\n")  if $contact;
		printer(" Location        : $location\n") if $location;
		printer(" Motd            : $motd\n")     if $motd;
	
		if ($descr !~ /^Sun|^-|^Fibre|^Cisco/){
	
			my @stordescr = gettable($mibStorDescr);
			my @storsize  = gettable($mibStorSize); 
			my @storused  = gettable($mibStorUsed); 
			my @storunits = gettable($mibStoreUnits); 
			my @sdtype    = gettable($mibSDType);
			my @ptype     = gettable($mibPtype);

			if ($#stordescr > 0){
				printer("\n [*] Hardware and storage informations\n"); border();
		
				my $a = 0;
				foreach(@stordescr){
	
					my %storagetypes = (
						'1.3.6.1.2.1.25.2.1.1'  => 'Other',
						'1.3.6.1.2.1.25.2.1.2'  => 'Ram',
						'1.3.6.1.2.1.25.2.1.3'  => 'VirtualMemory',
						'1.3.6.1.2.1.25.2.1.4'  => 'FixedDisk',
						'1.3.6.1.2.1.25.2.1.5'  => 'RemovableDisk',
						'1.3.6.1.2.1.25.2.1.6'  => 'FloppyDisk',
						'1.3.6.1.2.1.25.2.1.7'  => 'CompactDisc',
						'1.3.6.1.2.1.25.2.1.8'  => 'RamDisk',
						'1.3.6.1.2.1.25.2.1.9'  => 'FlashMemory',
						'1.3.6.1.2.1.25.2.1.10' => 'NetworkDisk'
					);

					my %fstypes = (
						'1.3.6.1.2.1.25.3.9.1'  => 'Other',
						'1.3.6.1.2.1.25.3.9.2'  => 'Unknown',
						'1.3.6.1.2.1.25.3.9.3'  => 'BerkeleyFFS',
						'1.3.6.1.2.1.25.3.9.4'  => 'Sys5FS',
						'1.3.6.1.2.1.25.3.9.5'  => 'Fat',
						'1.3.6.1.2.1.25.3.9.6'  => 'HPFS',
						'1.3.6.1.2.1.25.3.9.7'  => 'HFS',
						'1.3.6.1.2.1.25.3.9.8'  => 'MFS',
						'1.3.6.1.2.1.25.3.9.9'  => 'NTFS',
						'1.3.6.1.2.1.25.3.9.10' => 'VNode',
						'1.3.6.1.2.1.25.3.9.11' => 'Journaled',
						'1.3.6.1.2.1.25.3.9.12' => 'iso9660',
						'1.3.6.1.2.1.25.3.9.13' => 'RockRidge',
						'1.3.6.1.2.1.25.3.9.14' => 'NFS',
						'1.3.6.1.2.1.25.3.9.15' => 'Netware',
						'1.3.6.1.2.1.25.3.9.16' => 'AFS',
						'1.3.6.1.2.1.25.3.9.17' => 'DFS',
						'1.3.6.1.2.1.25.3.9.18' => 'Appleshare',
						'1.3.6.1.2.1.25.3.9.19' => 'RFS',
						'1.3.6.1.2.1.25.3.9.20' => 'DGCFS',
						'1.3.6.1.2.1.25.3.9.21' => 'BFS'
					);
	
					printer(" $_\n");
					printer("\tDevice type     : $storagetypes{$sdtype[$a]}\n") if $storagetypes{$sdtype[$a]};

					if ($ptype[$a]){
						if ($fstypes{$ptype[$a]}){
							printer("\tFilesystem type : $fstypes{$ptype[$a]}\n");
						} else{
							printer("\tFilesystem type : unknown\n");
						}
					} else{
						printer("\tFilesystem type : unknown\n");
					}

					if ($storunits[$a]){
						printer("\tDevice units    : $storunits[$a]\n");

						if ($storsize[$a]){
							$storsize[$a] = ($storsize[$a] * $storunits[$a]);
							my $s = format_bytes($storsize[$a]);
							printer("\tMemory size     : $s\n");
						}
					
						if ($storused[$a]){
							$storused[$a] = $storused[$a] * $storunits[$a];
							my $s = format_bytes($storused[$a]);
							printer("\tMemory used     : $s\n");
						}
				
						if ($storsize[$a] && $storused[$a]){
							my $free = $storsize[$a] - $storused[$a];
							$free = format_bytes($free);
							printer("\tMemory free     : $free\n");
						}
					}
	
					printer("\n");
					$a++;
				}
			}
		}

		Mountpoints()    if $descr !~ /^-|^Hardware|^Fibre|^Cisco/;
		Devices()        if $descr !~ /^-|^Cisco|^Fibre|^Sun/; 
		Accounts()       if $descr !~ /^-|^Cisco|^Fibre|^Linux|^Sun/; 
		Processes()      if $descr !~ /^-|^Cisco|^Fibre|^Sun/;
		Netinfo();
		Routinginfo();
		Netservices();
		Tcpconnections() if !$opt_d;
		Udpports();
		IIS($target)     if $descr =~ /^Hardware/;
		Software()       if $descr !~ /^-|^Cisco|^Fibre|^Sun/;
		Shares()         if $descr !~ /^-|^Cisco|^Fibre|^Linux/;

		$session->close;
		
		my $end_time = [gettimeofday];
		my $elapsed = tv_interval($start_time,$end_time);
		printer("\n [x] $target, log file $logfile created") if $opt_l;
		printer("\n [x] $target, finished! Scanned in $elapsed seconds\n");
		
		close LOG if $opt_l;
	}else{
		printer(" [-] Error: $target, timeout while connecting to server!");
	}
}	

sub Devices {

	my @deviceslist  = gettable($mibDevice);
	my @devicestatus = gettable($mibDevStatus);

	if ($#deviceslist > 0){
		printer("\n [*] Devices\n"); border();

		printf     " %5s   Name\n\n", "Status";
		printf LOG " %5s   Name\n\n", "Status" if $opt_l;

		my $a = 0;
		foreach(@deviceslist){
			
			$status = "unknown";
	
			if ($devicestatus[$a] eq '1'){
				$status = "unknown";
			}elsif($devicestatus[$a] eq '2'){
				$status = "running";
			}elsif($devicestatus[$a] eq '3'){
				$status = "warning";
			}elsif($devicestatus[$a] eq '4'){
				$status = "testing";
			}elsif($devicestatus[$a] eq '5'){
				$status = "down";
			}

			printf     " %7s  $_\n", $status if $_;
			printf LOG " %7s  $_\n", $status if $_ && $opt_l;
			$a++;
		}	
	}
}

sub Accounts {

	my @accounts = gettable($mibAccounts);

	if ($#accounts > 0){
		printer("\n\n [*] User accounts\n"); border();

		@accounts = sort @accounts;
		foreach(@accounts){
			printer(" $_\n");
		}
	}
}

sub Processes {

	if ($checksun == 1){
	
		# Solaris
		my @runproid    = gettable("1.3.6.1.4.1.42.3.12.1.1.1");  # psProcessID 
		my @runparid    = gettable("1.3.6.1.4.1.42.3.12.1.1.2");  # psParentProcessID
		my @runprosize  = gettable("1.3.6.1.4.1.42.3.12.1.1.3");  # psProcessSize
		my @runcputime  = gettable("1.3.6.1.4.1.42.3.12.1.1.4");  # psProcessCpuTime
		my @runstate    = gettable("1.3.6.1.4.1.42.3.12.1.1.5");  # psProcessState
		my @runtty      = gettable("1.3.6.1.4.1.42.3.12.1.1.7");  # psProcessTTY
		my @runusername = gettable("1.3.6.1.4.1.42.3.12.1.1.8");  # psProcessUserName
		my @runuserid   = gettable("1.3.6.1.4.1.42.3.12.1.1.9");  # psProcessUserID
		my @runname     = gettable("1.3.6.1.4.1.42.3.12.1.1.10"); # psProcessName
		my @runstatus   = gettable("1.3.6.1.4.1.42.3.12.1.1.11"); # psProcessStatus
	
		if ($#runproid > 0){
			printer("\n\n [*] Processes\n"); border();

			print "   Pid    Ppid    Size Cputime  State      TTY     Username   Uid          Name    Status\n\n";
			for (my $a = 0; $a < $#runproid; $a++){
				printf     " %6s %6s %6s %6s %6s %10s %10s %6s %15s %6s\n", $runproid[$a],$runparid[$a],$runprosize[$a],$runcputime[$a],$runstate[$a],$runtty[$a],$runusername[$a],$runuserid[$a],$runname[$a],$runstatus[$a];
				printf LOG " %6s %6s %6s %6s %6s %10s %10s %6s %15s %6s\n", $runproid[$a],$runparid[$a],$runprosize[$a],$runcputime[$a],$runstate[$a],$runtty[$a],$runusername[$a],$runuserid[$a],$runname[$a],$runstatus[$a] if $opt_l;
			}
		}
	} else{
		# Other
		my $processes = getrequest($mibProcesses);
		my @runindex  = gettable($mibRunIndex);
		my @runname   = gettable($mibRunName);
		my @runpath   = gettable($mibRunPath);
		my @runtype   = gettable($mibRunType);
		my @runstatus = gettable($mibRunStatus);
	
		if ($#runindex > 0){
			printer("\n\n [*] Processes\n"); border();

			printer(" Total processes : $processes\n\n") if $processes;
			printer(" Process type    : 1 unknown, 2 operating system, 3 device driver, 4 application\n"); 
			printer(" Process status  : 1 running, 2 runnable, 3 not runnable, 4 invalid\n\n"); 

			printf " %10s %25s %13s %15s  Process path\n\n", "Process id","Process name","Process type","Process status";
			printf LOG " %10s %25s %13s %15s  Process path\n\n", "Process id","Process name","Process type","Process status" if $opt_l;

			for (my $a = 0; $a < $#runindex; $a++){
				if ($runname[$a] ne " System Idle Process"){
					printf     " %10s %25s %13s %15s  $runpath[$a]\n", $runindex[$a],$runname[$a],$runtype[$a],$runstatus[$a];
					printf LOG " %10s %25s %13s %15s  $runpath[$a]\n", $runindex[$a],$runname[$a],$runtype[$a],$runstatus[$a] if $opt_l;
				}
			}
		}
	}
}

sub Netinfo {

	my @int         = gettable($mibInt);
	my @mtu         = gettable($mibIntMTU);
	my @intspeed    = gettable($mibIntSpeed);
	my @intbytesin  = gettable($mibIntBytesIn);
	my @intbytesout = gettable($mibIntBytesOut);
	my @intphys     = gettable($mibIntPhys);
	my @ipaddr      = gettable($mibIPAddr);
	my @netmask     = gettable($mibNetmask);
	my @adminstat   = gettable($mibAdminStat);
	my $ipforward   = getrequest($mibIPForward);

	if ($ipforward eq "0" || $ipforward eq "2") { $ipforward = "no"; }

	if ($#int > 0){ 
		printer("\n\n [*] Network interfaces\n"); border();
		printer(" IP Forwarding Enabled   : $ipforward\n\n");

		$#int++;
		for (my $a = 0; $a < $#int; $a++){

			chomp $int[$a];

			if ($adminstat[$a] eq "0"){
				$adminstat[$a] = "down";
			} else {
				$adminstat[$a] = "up";
			}

			if ($intspeed[$a] !~ /-/){
				$intspeed[$a] = $intspeed[$a] / 1000000;
				printer(" Interface               : [ $adminstat[$a] ] $int[$a]\n");
				printer("\tHardware Address : $intphys[$a]\n")       if $intphys[$a];
				printer("\tInterface Speed  : $intspeed[$a] Mbps\n") if $intspeed[$a];
				printer("\tIP Address       : $ipaddr[$a]\n")        if $ipaddr[$a];
				printer("\tNetmask          : $netmask[$a]\n")       if $ipaddr[$a];
				printer("\tMTU              : $mtu[$a]\n")           if $mtu[$a];

				if ($intbytesin[$a]){
					printer("\tBytes In         : $intbytesin[$a]");
					$intbytesin[$a] = format_bytes($intbytesin[$a]);
					printer(" ($intbytesin[$a])\n"); 
				}

				if ($intbytesout[$a]){
					printer("\tBytes Out        : $intbytesout[$a]");
					$intbytesout[$a] = format_bytes($intbytesout[$a]);
					printer(" ($intbytesout[$a])\n");
				}
	
				printer("\n");
			}
		}
	}
}

sub Netservices {

	my @services = gettable($mibServices);

	if ($#services > 0){
		printer("\n\n [*] Network services\n"); border();

		@services = sort @services;
		foreach(@services){
			printer(" $_\n");
		}
	}
}
	
sub Routinginfo {

	my @routedest	= gettable($mibRouteDest);
	my @routenhop	= gettable($mibRouteNHop);
	my @routemask	= gettable($mibRouteMask);
	my @routemetric	= gettable($mibRouteMetric);

	if ($#routedest > 0){
		printer("\n [*] Routing information\n"); border();
		printer("      Destination\t  Next Hop\t       Mask\tMetric\n\n");

		for (my $a = 0; $a < $#routedest; $a++){
			printf     "%17s%17s%17s%9s\n", $routedest[$a], $routenhop[$a], $routemask[$a], $routemetric[$a];
			printf LOG "%17s%17s%17s%9s\n", $routedest[$a], $routenhop[$a], $routemask[$a], $routemetric[$a] if $opt_l;
		}
	}
}

sub Tcpconnections {

	my @tcpstate = gettable($mibTCPState);
	my @tcpladdr = gettable($mibTCPLAddr); 
	my @tcplport = gettable($mibTCPLPort);
	my @tcpraddr = gettable($mibTCPRAddr);
	my @tcprport = gettable($mibTCPRPort);

	if ($#tcpstate > 0){
		printer("\n\n [*] TCP connections\n"); border();
		printer("   Local Address   Port      Remote Address   Port       State\n\n");

		for (my $a = 0; $a < $#tcpstate; $a++){
			if ($tcpstate[$a] eq "1")  { $tcpstate[$a] = "(closed)";       }
			if ($tcpstate[$a] eq "2")  { $tcpstate[$a] = "(listening)";    }
			if ($tcpstate[$a] eq "3")  { $tcpstate[$a] = "(syn sent)";     }
			if ($tcpstate[$a] eq "4")  { $tcpstate[$a] = "(syn received)"; }
			if ($tcpstate[$a] eq "5")  { $tcpstate[$a] = "(established)";  }
			if ($tcpstate[$a] eq "6")  { $tcpstate[$a] = "(fin wait1)";    }
			if ($tcpstate[$a] eq "7")  { $tcpstate[$a] = "(fin wait2)";    }
			if ($tcpstate[$a] eq "8")  { $tcpstate[$a] = "(close wait)";   }
			if ($tcpstate[$a] eq "9")  { $tcpstate[$a] = "(last ack)";     }
			if ($tcpstate[$a] eq "10") { $tcpstate[$a] = "(closing)";      } 
			if ($tcpstate[$a] eq "11") { $tcpstate[$a] = "(time wait)";    }
			if ($tcpstate[$a] eq "12") { $tcpstate[$a] = "(delete tcb)";   }

			printf     " %15s %6s   %17s %6s %15s\n", $tcpladdr[$a], $tcplport[$a], $tcpraddr[$a], $tcprport[$a], $tcpstate[$a];
			printf LOG " %15s %6s   %17s %6s %15s\n", $tcpladdr[$a], $tcplport[$a], $tcpraddr[$a], $tcprport[$a], $tcpstate[$a] if $opt_l;
		}
	}
}

sub Udpports {

	my @udpladdr = gettable($mibUDPLAddr);
	my @udplport = gettable($mibUDPLPort);

	if ($#udpladdr > 0){
		printer("\n\n [*] Listening UDP ports\n"); border();
		printer("   Local Address   Port\n\n");

		for (my $a = 0; $a < $#udpladdr; $a++){
			printf     " %15s %6s\n", $udpladdr[$a], $udplport[$a];
			printf LOG " %15s %6s\n", $udpladdr[$a], $udplport[$a] if $opt_l;
		}
	}
}

sub Software {

	my @installed = gettable($mibInstalled);

	if ($#installed > 0){
		printer("\n\n [*] Software components\n"); border();
		my @soft;
		for (my $a = 0; $a < $#installed; $a++){
			push @soft, "$installed[$a]";
		}

		@soft = sort @soft;
		foreach(@soft){
			printer(" $_\n");
		}
	}
}

sub IIS {

	my $target = shift;
		
	my $http_totalBytesSentLowWord     = getrequest($http_totalBytesSentLowWord); 
	my $http_totalBytesReceivedLowWord = getrequest($http_totalBytesReceivedLowWord); 
	my $http_totalFilesSent            = getrequest($http_totalFilesSent);
	my $http_currentAnonymousUsers     = getrequest($http_currentAnonymousUsers);
	my $http_currentNonAnonymousUsers  = getrequest($http_currentNonAnonymousUsers);
	my $http_totalAnonymousUsers       = getrequest($http_totalAnonymousUsers);
	my $http_totalNonAnonymousUsers    = getrequest($http_totalNonAnonymousUsers);
	my $http_maxAnonymousUsers         = getrequest($http_maxAnonymousUsers);
	my $http_maxNonAnonymousUsers      = getrequest($http_maxNonAnonymousUsers);
	my $http_currentConnections        = getrequest($http_currentConnections);
	my $http_maxConnections            = getrequest($http_maxConnections);
	my $http_connectionAttempts        = getrequest($http_connectionAttempts);
	my $http_logonAttempts             = getrequest($http_logonAttempts);
	my $http_totalGets                 = getrequest($http_totalGets);
	my $http_totalPosts                = getrequest($http_totalPosts);
	my $http_totalHeads                = getrequest($http_totalHeads);
	my $http_totalOthers               = getrequest($http_totalOthers);
	my $http_totalCGIRequests          = getrequest($http_totalCGIRequests);
	my $http_totalBGIRequests          = getrequest($http_totalBGIRequests );
	my $http_totalNotFoundErrors       = getrequest($http_totalNotFoundErrors);

	if ($http_totalFilesSent){
		printer("\n\n [*] Web server informations\n"); border();
	}

	if ($http_totalBytesSentLowWord){
		if ($http_totalBytesSentLowWord =~ /\d+/){
			$http_totalBytesSentLowWord = format_bytes($http_totalBytesSentLowWord);
			printer(" totalBytesSentLowWord     : $http_totalBytesSentLowWord\n");
		} else {
			printer(" totalBytesSentLowWord     : -\n");
		}
	}
			
	if ($http_totalBytesReceivedLowWord){
		if ($http_totalBytesReceivedLowWord =~ /\d+/){
			$http_totalBytesReceivedLowWord = format_bytes($http_totalBytesReceivedLowWord);
			printer(" totalBytesReceivedLowWord : $http_totalBytesReceivedLowWord\n");
		} else {
			printer(" totalBytesReceivedLowWord : -\n");
		}
	}

	printer(" totalFilesSent            : $http_totalFilesSent\n")           if $http_totalFilesSent;
	printer(" currentAnonymousUsers     : $http_currentAnonymousUsers\n")    if $http_currentAnonymousUsers;
	printer(" currentNonAnonymousUsers  : $http_currentNonAnonymousUsers\n") if $http_currentNonAnonymousUsers;
	printer(" totalAnonymousUsers       : $http_totalAnonymousUsers\n")      if $http_totalAnonymousUsers;
	printer(" totalNonAnonymousUsers    : $http_totalNonAnonymousUsers\n")   if $http_totalNonAnonymousUsers;
	printer(" maxAnonymousUsers         : $http_maxAnonymousUsers\n")        if $http_maxAnonymousUsers;
	printer(" maxNonAnonymousUsers      : $http_maxNonAnonymousUsers\n")     if $http_maxNonAnonymousUsers;
	printer(" currentConnections        : $http_currentConnections\n")       if $http_currentConnections;
	printer(" maxConnections            : $http_maxConnections\n")           if $http_maxConnections;
	printer(" connectionAttempts        : $http_connectionAttempts\n")       if $http_connectionAttempts;
	printer(" logonAttempts             : $http_logonAttempts\n")            if $http_logonAttempts;
	printer(" totalGets                 : $http_totalGets\n")                if $http_totalGets;
	printer(" totalPosts                : $http_totalPosts\n")               if $http_totalPosts;
	printer(" totalHeads                : $http_totalHeads\n")               if $http_totalHeads;
	printer(" totalOthers               : $http_totalOthers\n")              if $http_totalOthers;
	printer(" totalCGIRequests          : $http_totalCGIRequests\n")         if $http_totalCGIRequests;
	printer(" totalBGIRequests          : $http_totalBGIRequests\n")         if $http_totalBGIRequests;
	printer(" totalNotFoundErrors       : $http_totalNotFoundErrors\n")      if $http_totalNotFoundErrors;
}

sub Mountpoints {
	
	my @StorDescr = gettable($mibStorDescr);

	if ($#StorDescr > 0){
		printer("\n [*] Mountpoints\n"); border();
		
		for (my $a = 0; $a < $#StorDescr; $a++){
			printer(" $StorDescr[$a]\n") if (grep(/\//,$StorDescr[$a]));
		}
	}
}

sub Shares {

	my @ShareName = gettable($mibShareName);
	my @SharePath = gettable($mibSharePath);
	my @ShareComm = gettable($mibShareComm);

	if ($#ShareName > 0){
		printer("\n\n [*] Non-administrative shares\n"); border();

		for (my $a = 0; $a < $#ShareName; $a++){
			printer(" Share Name : $ShareName[$a]\n");
			printer(" Path       : $SharePath[$a]\n");
			printer(" Comments   : $ShareComm[$a]\n\n");
		}
	}
}

sub getrequest {

	my $response = "";
	
	if (!($response = $session->get_request($_[0]))){
		return "-";
	} else {
		my $Return = $response->{$_[0]};
		return $Return;
	}
}

sub gettable {

	my @Return;
	my $response = "";

	if (!($response = $session->get_table($_[0]))){
		return "-";
	}

	my $x = 0;
	my $key;

	foreach $key (sort keys %$response){
		if ($$response{$key} ne " Virtual Memory"){
			$Return[$x] = $$response{$key};
			$x++;
		}
	}

	return @Return;
}

sub border {
	if ($opt_l){
		print     " "; print     "-" x 95; print     "\n\n";
		print LOG " "; print LOG "-" x 95; print LOG "\n\n";
	} else {
		print " "; print "-" x 95; print "\n\n";
	}
}

sub printer {
	my @string = @_;

	if ($opt_l){
		print @string;
		print LOG @string;
	} else {
		print @string;
	}
}