/*

   [ http://www.rootshell.com/ ]

   Black Angel proudly presents :
   ------------------------------

   TOOLTALK-RPC Scanner V1.1

   Syntax :

   ./toolscan 195.3.90.2 196.0.0.0 [1]

   ^          ^          ^
   |          |          |
   Start-IP   End-IP  ToolTalk-RPC Version

   If you don't specify any version number, the program will scan for any 
   version. I really don't know whether there are any versions beside the vulnerable
   version 1, so I included this little feature (sorry for this lack of knowledge).

   What it does :

   Concerning 'CERT CA-98.11 tooltalk' there is a overflow in the tooltalk database
   server - runing root, which allows an attacker to gain access. This little scanner
   scans for this RPC-service.


   Have fun !


   PS : Use this program at your own risk.
 */

#include <sys/types.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <netdb.h>
#include <stdio.h>
#include <getopt.h>
#include <string.h>
#include <rpc/rpc.h>
#include <rpc/pmap_clnt.h>
#include <arpa/inet.h>
#include <utmp.h>
#include <stdlib.h>

#define TOOLTALK_RPC 100083


main (int argc, char *argv[])
{
  long counter;
  struct in_addr addr;
  unsigned long start;
  unsigned long end;


  int version = -1;


  printf ("Black Angel's ToolTalk RPC Scanner V1.1 9/1998 :\n");
  printf ("See CERT CA-98.11 tooltalk for more information\n");
  printf ("E-Mail : b_angel98@yahoo.com - [ http://www.rootshell.com/ ]\n\n");


  if (argc == 4)
    {
      version = atoi (argv[3]);
    }
  else
    {
      if (argc != 3)
	{
	  printf ("\nusage : %s start-ip-address  end-ip-address [RPC_VERSION]\n\n", argv[0]);
	  exit (0);
	}
    }

  start = inet_addr (argv[1]);
  end = inet_addr (argv[2]);

  for (counter = ntohl (start); counter <= ntohl (end); counter++)
    {
      if ((counter & 0xff) == 255)
	counter++;
      if ((counter & 0xff) == 0)
	counter++;

      addr.s_addr = htonl (counter);

      if (version == -1)
	{
	  if (callrpc (inet_ntoa (addr), TOOLTALK_RPC, version, 0,
		       (xdrproc_t) xdr_void, (caddr_t) NULL,
		       (xdrproc_t) xdr_void, (caddr_t) NULL) == 9)
	    {

	      fprintf (stdout, "Found ToolTalk : %s\n", inet_ntoa (addr));
	      fflush (stdout);
	    }
	}
      else
	{
	  if (callrpc (inet_ntoa (addr), TOOLTALK_RPC, version, 0,
		       (xdrproc_t) xdr_void, (caddr_t) NULL,
		       (xdrproc_t) xdr_void, (caddr_t) NULL) == 0)
	    {

	      fprintf (stdout, "Found ToolTalk Version %d : %s\n", version, inet_ntoa (addr));
	      fflush (stdout);
	    }
	}
    }
}