app.go

package main

import (
	"flag"
	"fmt"
	"io"
	"log"
	"net"
	"os"
	"sync"
	"time"

	"golang.org/x/crypto/ssh"
)

type Config struct {
	User      string
	Targets   []string
	PublicKey string
	Timeout   time.Duration
	Workers   int
}

type Result struct {
	Target   string
	Accepted bool
	Err      error
}

func main() {
	cfg := parseFlags()

	pubKey, err := parsePublicKey(cfg.PublicKey)
	if err != nil {
		log.Fatalf("invalid public key: %v", err)
	}

	results := runScanner(cfg, pubKey)

	printResults(results)
}

func parseFlags() Config {
	var (
		user    = flag.String("user", "root", "SSH username")
		target  = flag.String("target", "", "Target (ip:port) or comma-separated list")
		pubKey  = flag.String("pubkey", "", "Public key (authorized_keys format)")
		timeout = flag.Duration("timeout", 5*time.Second, "Connection timeout")
		workers = flag.Int("workers", 10, "Number of concurrent workers")
	)

	flag.Parse()

	if *target == "" || *pubKey == "" {
		fmt.Println("Usage: ghostkey-ssh -target ip:22 -pubkey 'ssh-ed25519 ...'")
		os.Exit(1)
	}

	return Config{
		User:      *user,
		Targets:   splitTargets(*target),
		PublicKey: *pubKey,
		Timeout:   *timeout,
		Workers:   *workers,
	}
}

func splitTargets(input string) []string {
	var targets []string
	for _, t := range splitAndTrim(input, ",") {
		targets = append(targets, t)
	}
	return targets
}

func splitAndTrim(s, sep string) []string {
	raw := make([]string, 0)
	for _, v := range split(s, sep) {
		if v != "" {
			raw = append(raw, v)
		}
	}
	return raw
}

func split(s, sep string) []string {
	return append([]string{}, func() []string {
		var res []string
		for _, v := range splitManual(s, sep) {
			res = append(res, v)
		}
		return res
	}()...)
}

func splitManual(s, sep string) []string {
	var result []string
	current := ""
	for i := 0; i < len(s); i++ {
		if string(s[i]) == sep {
			result = append(result, current)
			current = ""
			continue
		}
		current += string(s[i])
	}
	result = append(result, current)
	return result
}

func runScanner(cfg Config, pubKey ssh.PublicKey) []Result {
	var wg sync.WaitGroup
	jobs := make(chan string)
	results := make(chan Result)

	for i := 0; i < cfg.Workers; i++ {
		wg.Add(1)
		go worker(cfg, pubKey, jobs, results, &wg)
	}

	go func() {
		for _, t := range cfg.Targets {
			jobs <- t
		}
		close(jobs)
	}()

	var out []Result
	go func() {
		wg.Wait()
		close(results)
	}()

	for r := range results {
		out = append(out, r)
	}

	return out
}

func worker(cfg Config, pubKey ssh.PublicKey, jobs <-chan string, results chan<- Result, wg *sync.WaitGroup) {
	defer wg.Done()

	for target := range jobs {
		results <- probeTarget(cfg, pubKey, target)
	}
}

func probeTarget(cfg Config, pubKey ssh.PublicKey, target string) Result {
	signer := NewDummySigner(pubKey)

	clientConfig := &ssh.ClientConfig{
		User: cfg.User,
		Auth: []ssh.AuthMethod{
			ssh.PublicKeysCallback(func() ([]ssh.Signer, error) {
				return []ssh.Signer{signer}, nil
			}),
		},
		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
		Timeout:         cfg.Timeout,
	}

	err := dialSSH(target, clientConfig)

	return Result{
		Target:   target,
		Accepted: signer.Accepted,
		Err:      err,
	}
}

func dialSSH(addr string, config *ssh.ClientConfig) error {
	conn, err := net.DialTimeout("tcp", addr, config.Timeout)
	if err != nil {
		return fmt.Errorf("network error: %w", err)
	}

	c, chans, reqs, err := ssh.NewClientConn(conn, addr, config)
	if err != nil {
		return classifySSHError(err)
	}

	ssh.NewClient(c, chans, reqs).Close()
	return nil
}

func classifySSHError(err error) error {
	if err == io.EOF {
		return fmt.Errorf("connection closed (possible rejection)")
	}
	return err
}

func printResults(results []Result) {
	for _, r := range results {
		switch {
		case r.Accepted:
			fmt.Printf("[+] %s → ACCEPTED\n", r.Target)
		case r.Err != nil:
			fmt.Printf("[-] %s → ERROR: %v\n", r.Target, r.Err)
		default:
			fmt.Printf("[ ] %s → REJECTED\n", r.Target)
		}
	}
}

func parsePublicKey(key string) (ssh.PublicKey, error) {
	parsed, _, _, _, err := ssh.ParseAuthorizedKey([]byte(key))
	return parsed, err
}

type DummySigner struct {
	pubKey   ssh.PublicKey
	Accepted bool
}

func NewDummySigner(pub ssh.PublicKey) *DummySigner {
	return &DummySigner{pubKey: pub}
}

func (d *DummySigner) PublicKey() ssh.PublicKey {
	return d.pubKey
}

func (d *DummySigner) Sign(rand io.Reader, data []byte) (*ssh.Signature, error) {
	d.Accepted = true

	return &ssh.Signature{
		Format: d.pubKey.Type(),
		Blob:   []byte("ghost-signature"),
	}, nil
}