#!/usr/bin/perl # pubcam: Extract any attachments from SirCam from a UNIX mbox file, # and produce an index.php listing the files and who's address # they came from. # # requires MIME::Base64 module from CPAN. # # public domain, do what you like with it. I suggest you change the text # in sub html_(head|tail) before publishing HTML generated by this. # If you fancy making it posher (e.g. sort the list) go ahead. ## output slightly modified by pgl@yoyo.org use warnings; use strict; use MIME::Base64; my $mbox = shift; open MBOX, $mbox or die "Could not open $mbox: $!"; my %culprits=(); my %dates=(); my $sircam = 0; my $address = "Unknown"; my $date = "Unknown"; my $boundary = "none"; while(my $line=) { $line =~ m/^From: *(.*)/i and $address = $1; $line =~ m/^Date: *(.*)/i and $date = $1; # detect sircamness, you may need to add more of these lines, e.g. # for the spanish version, which I have not seen $line =~ m/Hi! How are you/ and $sircam = 1; if($line =~ m/^Content-Type: multipart\/mixed; *boundary="(.*)"/i) { $boundary=$1; } if($line =~ m/^Content-Disposition: attachment; *filename=(.*)/i and $sircam ) { my $filename = $1; $filename =~ s/"//g; $filename =~ s/\s/_/g; $filename =~ s/\.[^\.]*$//; # lose last extension $culprits{$filename} = &html_escape(&cowardify_address($address)); $dates{$filename} = $date; # read on to start of base64 while($line=) { chomp $line; last if $line eq ""; } &extractfile($filename); $sircam = 0; # reset for next time } } print "Writing index.php\n"; open HTML, ">index.php" or die "Could not open index.php for writing: $!"; print HTML &html_head; print HTML ""; foreach my $fn (keys %culprits) { print HTML "\n"; } print HTML "
FilenameFromDate
$fn$culprits{$fn}$dates{$fn}
\n"; print HTML &html_tail; close HTML; sub extractfile { my $fn = shift; my $tmp_fn = "/tmp/$fn.tmp.$$"; my $ac_len = 0; # accumlated length of decoded b64 my $sc_len = 512*268; # length of sircam virus print "Writing $tmp_fn\n"; open OUT, ">$tmp_fn" or die "Could not open $tmp_fn for writing: $!"; while() { last if $_ =~ /^\s*$/; print OUT decode_base64($_); } close OUT; print "Stripping virus and writing to $fn\n"; system("dd bs=512 skip=268 if=$tmp_fn of=$fn && rm $tmp_fn"); } sub html_escape { my $in=shift; $in =~ s//>/g; return $in; } sub cowardify_address { my $in=shift; #$in =~ s/@[^>]*/@\.\.\./; return $in; } sub html_head { return " things sircam has sent me

Things SirCam has sent me

[ other stuff ]

I found out about this script on ntk and downloaded it from http://www.hartnup.net/pubcam/pubcam. this guy has his own page up that's been produced by this script: http://www.hartnup.net/sircam/.

there's a few small changes made to the script, mostly affecting the output. also, the script originally removed the last part of each email address to save the sender's privacy, but I commented that bit out; I've never heard of any of the people that sent me an email with a sircam virus attached, so how on earth did I get in to their address book unless I was on one of their spam lists?

the modified copy of the script can be found here: pubcam.pl

to \"lisaS\" (real name \"laura selby\", I think): I hope she got it all sorted with lee.

"; } sub html_tail { return "
If you have the SirCam virus, do yourself a favour:
  1. Configure your mail reader so it doesn't hide double extensions. SirCam sends things called (e.g.)\"my secrets.doc.exe\". Your mail reader might hide the \".exe\" so you think it's just \"my secrets.doc\", and open it.
  2. Think carefully before opening attachments anyway
  3. Get an antivirus program, and run it. And keep running it regularly.
"; }