加入hash碰撞、wmiiexec无回显命令执行

common/Parse.go

@@ -2,8 +2,10 @@ package common
 
 import (
 	"bufio"
+	"encoding/hex"
 	"flag"
 	"fmt"
+	"net/url"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -137,7 +139,7 @@ func ParseInput(Info *HostInfo) {
 	}
 
 	if TmpOutputfile != "" {
-		if !strings.Contains(Outputfile, "/") && !strings.Contains(Outputfile, `\`) {
+		if !strings.Contains(TmpOutputfile, "/") && !strings.Contains(TmpOutputfile, `\`) {
 			Outputfile = getpath() + TmpOutputfile
 		} else {
 			Outputfile = TmpOutputfile
@@ -174,9 +176,52 @@ func ParseInput(Info *HostInfo) {
 		Passwords = RemoveDuplicate(Passwords)
 	}
 	if Socks5Proxy != "" && !strings.HasPrefix(Socks5Proxy, "socks5://") {
-		Socks5Proxy = "socks5://" + Socks5Proxy
+		if !strings.Contains(Socks5Proxy, ":") {
+			Socks5Proxy = "socks5://127.0.0.1" + Socks5Proxy
+		} else {
+			Socks5Proxy = "socks5://" + Socks5Proxy
+		}
+	}
+	if Socks5Proxy != "" {
+		fmt.Println("Socks5Proxy:", Socks5Proxy)
+		_, err := url.Parse(Socks5Proxy)
+		if err != nil {
+			fmt.Println("Socks5Proxy parse error:", err)
+			os.Exit(0)
+		}
 		NoPing = true
 	}
+	if Proxy != "" {
+		if Proxy == "1" {
+			Proxy = "http://127.0.0.1:8080"
+		} else if Proxy == "2" {
+			Proxy = "socks5://127.0.0.1:1080"
+		} else if !strings.Contains(Proxy, "://") {
+			Proxy = "http://127.0.0.1:" + Proxy
+		}
+		fmt.Println("Proxy:", Proxy)
+		if !strings.HasPrefix(Proxy, "socks") && !strings.HasPrefix(Proxy, "http") {
+			fmt.Println("no support this proxy")
+			os.Exit(0)
+		}
+		_, err := url.Parse(Proxy)
+		if err != nil {
+			fmt.Println("Proxy parse error:", err)
+			os.Exit(0)
+		}
+	}
+
+	if Hash != "" && len(Hash) != 32 {
+		fmt.Println("[-] Hash is error,len(hash) must be 32")
+		os.Exit(0)
+	} else {
+		var err error
+		HashBytes, err = hex.DecodeString(Hash)
+		if err != nil {
+			fmt.Println("[-] Hash is error,hex decode error")
+			os.Exit(0)
+		}
+	}
 }
 
 func ParseScantype(Info *HostInfo) {
@@ -186,8 +231,16 @@ func ParseScantype(Info *HostInfo) {
 	}
 	if Scantype != "all" && Info.Ports == DefaultPorts+","+Webport {
 		switch Scantype {
-		case "rdp":
-			Info.Ports = "3389"
+		case "wmiexec":
+			Info.Ports = "135"
+		case "wmiinfo":
+			Info.Ports = "135"
+		case "smbinfo":
+			Info.Ports = "445"
+		case "hostname":
+			Info.Ports = "135,137,139,445"
+		case "smb2":
+			Info.Ports = "445"
 		case "web":
 			Info.Ports = Webport
 		case "webonly":

common/config.go

@@ -1,6 +1,6 @@
 package common
 
-var version = "1.8.1"
+var version = "1.8.2"
 var Userdict = map[string][]string{
 	"ftp":        {"ftp", "admin", "www", "web", "root", "db", "wwwroot", "data"},
 	"mysql":      {"root", "mysql"},
@@ -32,7 +32,10 @@ var PORTList = map[string]int{
 	"ms17010":     1000001,
 	"cve20200796": 1000002,
 	"web":         1000003,
-	"webonly":     10000031,
+	"webonly":     1000003,
+	"webpoc":      1000003,
+	"smb2":        1000004,
+	"wmiexec":     1000005,
 	"all":         0,
 	"portscan":    0,
 	"icmp":        0,
@@ -65,8 +68,8 @@ var (
 	Username      string
 	Password      string
 	Proxy         string
-	Timeout       int64
-	WebTimeout    int64
+	Timeout       int64 = 3
+	WebTimeout    int64 = 5
 	TmpOutputfile string
 	TmpSave       bool
 	NoPing        bool
@@ -95,10 +98,14 @@ var (
 	LiveTop       int
 	Socks5Proxy   string
 	Hash          string
+	HashBytes     []byte
 	HostPort      []string
+	IsWmi         bool
 )
 
 var (
+	UserAgent  = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36"
+	Accept     = "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9"
 	DnsLog     bool
 	PocNum     int
 	PocFull    bool

common/flag.go

@@ -42,7 +42,7 @@ func Flag(Info *HostInfo) {
 	flag.StringVar(&UserAdd, "usera", "", "add a user base DefaultUsers,-usera user")
 	flag.StringVar(&PassAdd, "pwda", "", "add a password base DefaultPasses,-pwda password")
 	flag.StringVar(&NoPorts, "pn", "", "the ports no scan,as: -pn 445")
-	flag.StringVar(&Command, "c", "", "exec command (ssh)")
+	flag.StringVar(&Command, "c", "", "exec command (ssh|wmiexec)")
 	flag.StringVar(&SshKey, "sshkey", "", "sshkey file (id_rsa)")
 	flag.StringVar(&Domain, "domain", "", "smb domain")
 	flag.StringVar(&Username, "user", "", "username")
@@ -79,5 +79,6 @@ func Flag(Info *HostInfo) {
 	flag.BoolVar(&DnsLog, "dns", false, "using dnslog poc")
 	flag.IntVar(&PocNum, "num", 20, "poc rate")
 	flag.StringVar(&SC, "sc", "", "ms17 shellcode,as -sc add")
+	flag.BoolVar(&IsWmi, "wmi", false, "start wmi")
 	flag.Parse()
 }