#!/usr/bin/perl
#
# Coded by Loni - loni@securityforest.com
# Created:  19/11/2004
# Updated:  26/12/2004 (no changing directory into ExploitTree)
# Updated:  24/01/2005 (added exploit finding feature)
#
# Search Utility for the ExploitTree CVS Repository Tree from SecurityForest.com
# This is a really lame script (only uses bids.txt), but the Real Search Engine is on its way...

$ver = "v0.31";
$name = "xsearch.pl";

$winexe = "no"; #Only applicable when distributed as an exe with binary unix utilities
if ($winexe eq "yes") { 
	$name = "xsearch.exe"; 
	$dir = $0; $dir =~ s/\\$name//;
	$ENV{'PATH'} = "$dir\\bin;$ENV{'PATH'}";
}

&master();

sub master {
	print "\nXsearch engine for ExploitTree $ver\n----------------------------------------\n\n";
	print "1\) Search via BID (bid_db)\n"; 
	print "2\) Search via exploit name (bid_db)\n";
	print "3\) Search via keyword (bid_db)\n";
	print "4\) Search via exploit name\\keyword (ExploitTree Itself)\n";
	print "+---------------------------------------\nq\) Quit\n\n> ";
	chomp($choice = <STDIN>);
	if ($choice == 1) { &searchbid(); &master();}
	if ($choice == 2) { &searchname(); &master();}
	if ($choice == 3) { &searchkey(); &master();}
	if ($choice == 4) { &searchnametree(); &master();}
	elsif ($ch_list == "q") { print "Quitting...\n"; exit(1); }    
}

sub searchxdetails {
	my ($searchstr) = @_;
	$xdetails=`grep $searchstr bids.txt`; chomp($xdetails);
	@xdetails=split /:/, $xdetails; 
	print "\nBID: $xdetails[1]\n";
	print "Description: $xdetails[2]\n";
	print "Exploit: $xdetails[3]\n";
	&searchxpath($xdetails[3]);
}

sub searchxpath {
	my ($exploitstr) = @_;
	if ($exploitstr ne "") {
		print "Searching...\n\n";
		$xpath=`find -iname $exploitstr\*`;
		#should check if the exploit exists more than once...
		#if ($bidtxtsearch == 1) { $xpath=~s/$exploitstr//; }
		$xpath=~s/\//\\/g; 	$xpath=~s/\.\\//g;
		print "$xpath\n";
		#chdir $xpath or die "Can't chdir to $xpath:$!\n" if $xpath; - Doesn't work because it is local to the script.
	} else {
		print "Currently, there is no exploit for this bid. If you feel this is an error or are aware of more recent information, please mail us at: exploittree@securityforest.com\n";
	}
}

sub searchbid {
	print "BID> "; chomp($choicetext = <STDIN>);
	$searchstr = ":$choicetext:";
	&searchxdetails($searchstr);
}

sub searchname {
	print "Exploit Name> "; chomp($choicetext = <STDIN>);
	$searchstr = ":$choicetext";
	&searchxdetails($searchstr);
}

sub searchnametree {
	print "Exploit Name\\Keyword> "; chomp($choicetext = <STDIN>);
	$searchstr = "$choicetext";
	&searchxpath($searchstr);
}

sub searchkey {
	print "KeyWord> "; chomp($choicetext = <STDIN>);
	system("grep $choicetext bids.txt");
}

#EOF

