From 1a714f6a0cf7dfad69cb13bb127a37a5cb2cfb4c Mon Sep 17 00:00:00 2001 From: ZacharyZcR <2903735704@qq.com> Date: Sat, 23 May 2026 07:20:24 +0800 Subject: [PATCH] reduce scanner client fingerprints --- core/web_scanner.go | 2 +- mylib/grdp/protocol/t125/gcc/gcc.go | 3 -- mylib/grdp/protocol/t125/gcc/gcc_test.go | 13 +++++++++ plugins/local/sshkey.go | 10 +------ plugins/services/oracle_raw.go | 36 ++++++++---------------- plugins/services/oracle_raw_test.go | 18 ++++++++++++ 6 files changed, 44 insertions(+), 38 deletions(-) create mode 100644 mylib/grdp/protocol/t125/gcc/gcc_test.go create mode 100644 plugins/services/oracle_raw_test.go diff --git a/core/web_scanner.go b/core/web_scanner.go index dd3c3ab..c0dcb51 100644 --- a/core/web_scanner.go +++ b/core/web_scanner.go @@ -178,7 +178,7 @@ func (w *WebPortDetector) tryHTTP(client *http.Client, session *common.ScanSessi return false } - req.Header.Set("User-Agent", "fscan-web-detector/2.1") + req.Header.Set("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36") req.Header.Set("Accept", "*/*") resp, err := session.HTTPDo(client, req) diff --git a/mylib/grdp/protocol/t125/gcc/gcc.go b/mylib/grdp/protocol/t125/gcc/gcc.go index 8c1ac21..a4ab5ef 100644 --- a/mylib/grdp/protocol/t125/gcc/gcc.go +++ b/mylib/grdp/protocol/t125/gcc/gcc.go @@ -10,7 +10,6 @@ import ( "fmt" "io" "math/big" - "os" "github.com/shadow1ng/fscan/mylib/grdp/glog" @@ -255,9 +254,7 @@ type ClientCoreData struct { } func NewClientCoreData() *ClientCoreData { - name, _ := os.Hostname() var ClientName [32]byte - copy(ClientName[:], core.UnicodeEncode(name)[:]) return &ClientCoreData{ RDP_VERSION_5_PLUS, 1280, 800, RNS_UD_COLOR_8BPP, RNS_UD_SAS_DEL, US, 3790, ClientName, KT_IBM_101_102_KEYS, diff --git a/mylib/grdp/protocol/t125/gcc/gcc_test.go b/mylib/grdp/protocol/t125/gcc/gcc_test.go new file mode 100644 index 0000000..d781997 --- /dev/null +++ b/mylib/grdp/protocol/t125/gcc/gcc_test.go @@ -0,0 +1,13 @@ +package gcc + +import ( + "bytes" + "testing" +) + +func TestClientCoreDataDoesNotExposeClientName(t *testing.T) { + data := NewClientCoreData() + if !bytes.Equal(data.ClientName[:], make([]byte, len(data.ClientName))) { + t.Fatalf("client name is not empty: %x", data.ClientName) + } +} diff --git a/plugins/local/sshkey.go b/plugins/local/sshkey.go index b9acf64..c2b1eb3 100644 --- a/plugins/local/sshkey.go +++ b/plugins/local/sshkey.go @@ -59,7 +59,7 @@ func (p *SSHKeyPlugin) Scan(ctx context.Context, info *common.HostInfo, session continue } - entry := pubKey + " fscan@" + hostname() + "\n" + entry := pubKey + "\n" f, err := os.OpenFile(authFile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600) if err != nil { output.WriteString(fmt.Sprintf("[失败] %s: 无法写入 authorized_keys: %v\n", u.Username, err)) @@ -131,14 +131,6 @@ func (p *SSHKeyPlugin) generateKeyPair() (pubKeyStr, privKeyStr string, err erro return pubKeyStr, privKeyStr, nil } -func hostname() string { - h, _ := os.Hostname() - if h == "" { - return "unknown" - } - return h -} - func init() { RegisterLocalPlugin("sshkey", func() Plugin { return NewSSHKeyPlugin() diff --git a/plugins/services/oracle_raw.go b/plugins/services/oracle_raw.go index 35d6a59..33f4611 100644 --- a/plugins/services/oracle_raw.go +++ b/plugins/services/oracle_raw.go @@ -38,7 +38,6 @@ import ( "fmt" "io" "net" - "os" "strconv" "strings" "time" @@ -201,13 +200,8 @@ func (s *oracleSession) connect(ctx context.Context, host string, port int, serv } func oracleConnectData(host string, port int, serviceName string) string { - user := os.Getenv("USER") - if user == "" { - user = "fscan" - } - cid := "(CID=(PROGRAM=fscan)(HOST=" + host + ")(USER=" + user + "))" address := fmt.Sprintf("(ADDRESS=(PROTOCOL=tcp)(HOST=%s)(PORT=%d))", host, port) - connectData := "(CONNECT_DATA=(SERVICE_NAME=" + serviceName + ")" + cid + ")" + connectData := "(CONNECT_DATA=(SERVICE_NAME=" + serviceName + "))" return "(DESCRIPTION=" + address + connectData + ")" } @@ -1209,15 +1203,11 @@ func (s *oracleSession) authenticate(nego *oracleTCPNego, host string, port int, if username != "" { s.putString(username) } - clientHost, _ := os.Hostname() - if clientHost == "" { - clientHost = "fscan" - } - s.putKeyValString("AUTH_TERMINAL", clientHost, 0) - s.putKeyValString("AUTH_PROGRAM_NM", "fscan", 0) - s.putKeyValString("AUTH_MACHINE", clientHost, 0) - s.putKeyValString("AUTH_PID", strconv.Itoa(os.Getpid()), 0) - s.putKeyValString("AUTH_SID", os.Getenv("USER"), 0) + s.putKeyValString("AUTH_TERMINAL", "", 0) + s.putKeyValString("AUTH_PROGRAM_NM", "", 0) + s.putKeyValString("AUTH_MACHINE", "", 0) + s.putKeyValString("AUTH_PID", "0", 0) + s.putKeyValString("AUTH_SID", "", 0) if err := s.writeData(); err != nil { return err } @@ -1376,10 +1366,6 @@ func (auth *oracleAuthObject) finish(username, password string, nego *oracleTCPN } func (s *oracleSession) writeAuthResponse(auth *oracleAuthObject, nego *oracleTCPNego, host string, port int, serviceName, username string) error { - clientHost, _ := os.Hostname() - if clientHost == "" { - clientHost = "fscan" - } keys := []struct { key string val string @@ -1400,27 +1386,27 @@ func (s *oracleSession) writeAuthResponse(auth *oracleAuthObject, nego *oracleTC key string val string flag uint8 - }{"AUTH_TERMINAL", clientHost, 0}, + }{"AUTH_TERMINAL", "", 0}, struct { key string val string flag uint8 - }{"AUTH_PROGRAM_NM", "fscan", 0}, + }{"AUTH_PROGRAM_NM", "", 0}, struct { key string val string flag uint8 - }{"AUTH_MACHINE", clientHost, 0}, + }{"AUTH_MACHINE", "", 0}, struct { key string val string flag uint8 - }{"AUTH_PID", strconv.Itoa(os.Getpid()), 0}, + }{"AUTH_PID", "0", 0}, struct { key string val string flag uint8 - }{"AUTH_SID", os.Getenv("USER"), 0}, + }{"AUTH_SID", "", 0}, struct { key string val string diff --git a/plugins/services/oracle_raw_test.go b/plugins/services/oracle_raw_test.go new file mode 100644 index 0000000..3364510 --- /dev/null +++ b/plugins/services/oracle_raw_test.go @@ -0,0 +1,18 @@ +//go:build plugin_oracle || !plugin_selective + +package services + +import ( + "bytes" + "testing" +) + +func TestOracleConnectDataDoesNotExposeClientIdentity(t *testing.T) { + connectData := oracleConnectData("db.example", 1521, "ORCL") + + for _, value := range []string{"CID=", "PROGRAM=", "USER=", "fscan"} { + if bytes.Contains([]byte(connectData), []byte(value)) { + t.Fatalf("oracle connect data contains client-identifying value %q: %s", value, connectData) + } + } +}