root/framework3/trunk/modules/auxiliary/scanner/http/frontpage.rb

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##


require 'msf/core'

module Msf

class Auxiliary::Scanner::Http::FrontPage < Msf::Auxiliary
        
        include Exploit::Remote::HttpClient
        include Auxiliary::Scanner

        def initialize
                super(
                        'Name'        => 'FrontPage Server Extensions Detection',
                        'Version'     => '$Revision$',
                        'Description' => 'Display version information about FPSE.',
                        'References'  =>
                                [
                                        ['URL', 'http://en.wikipedia.org/wiki/Microsoft_FrontPage'],
                                ],
                        'Author'      => 'Matteo Cantoni <goony[at]nothink.org>',
                        'License'     => MSF_LICENSE
                )
        
                register_options(
                        [
                                Opt::RPORT(80),
                                OptString.new('UserAgent', [ true, "The HTTP User-Agent sent in the request", 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)' ])
                        ], self.class)
        end

        def run_host(target_host)
        
                res = send_request_raw({
                        'uri'     => '/_vti_inf.html',
                        'method'  => 'GET',
                        'headers' =>
                        {
                                'User-Agent' => datastore['UserAgent'],
                        }
                }, 20)

                if (res.code >= 200)
                        if (res.headers['Server'])
                                print_status("http://#{target_host}:#{rport} is running #{res.headers['Server']}")
                        end
                        if (fpversion = res.body.match(/FPVersion="(.*)"/))
                                fpversion = $1
                                print_status("FrontPage Version: #{fpversion}")
                                if (fpauthor = res.body.match(/FPAuthorScriptUrl="([^"]*)/))
                                        fpauthor = $1
                                        print_status("FrontPage Author: http://#{target_host}/#{fpauthor}")
                                end
                        else
                                print_status("FrontPage not found on http://#{target_host}:#{rport} [#{res.code} #{res.message}]")
                        end
                end
        end
end
end