archive/fscan
1
0
Fork 0
mirror of https://github.com/shadow1ng/fscan.git synced 2026-09-25 12:41:53 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

更新mod库、编码、poc等

Browse Source
This commit is contained in:
shadow1ng
2021-05-06 11:37:29 +08:00
parent 7294051b44
commit 402add56c7
31 changed files with 388 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Plugins/NetBIOS.go
+8 -2
View File
@@ -137,6 +137,9 @@ func NetBIOS1(info *common.HostInfo) (nbname NbnsName, err error) {
nbname.msg += "-------------------------------------------\n"
nbname.msg += msg1 + "\n"
start := bytes.Index(ret, []byte("NTLMSSP"))
if len(ret) < start+45 {
return
}
num1, err = bytetoint(ret[start+40 : start+41][0])
if err != nil {
return
@@ -151,7 +154,7 @@ func NetBIOS1(info *common.HostInfo) (nbname NbnsName, err error) {
return
}
offset, err := bytetoint(ret[start+44 : start+45][0])
if err != nil {
if err != nil || len(ret) < start+offset+length {
return
}
index := start + offset
@@ -211,13 +214,16 @@ func GetNbnsname(info *common.HostInfo) (nbname NbnsName, err error) {
data := text[57:]
var msg string
for i := 0; i < num; i++ {
if len(data) < 18*i+16 {
break
}
name := string(data[18*i : 18*i+15])
flag_bit := data[18*i+15 : 18*i+16]
if GROUP_NAMES[string(flag_bit)] != "" && string(flag_bit) != "\x00" {
msg += fmt.Sprintf("%s G %s\n", name, GROUP_NAMES[string(flag_bit)])
} else if UNIQUE_NAMES[string(flag_bit)] != "" && string(flag_bit) != "\x00" {
msg += fmt.Sprintf("%s U %s\n", name, UNIQUE_NAMES[string(flag_bit)])
} else if string(flag_bit) == "\x00" {
} else if string(flag_bit) == "\x00" || len(data) >= 18*i+18 {
name_flags := data[18*i+16 : 18*i+18][0]
if name_flags >= 128 {
nbname.group = strings.Replace(name, " ", "", -1)
Plugins/base.go
+10 -10
View File
@@ -1,16 +1,16 @@
package Plugins
var PluginList = map[string]interface{}{
"21": FtpScan,
"22": SshScan,
"135": Findnet,
"139": NetBIOS,
"445": SmbScan,
"1433": MssqlScan,
"3306": MysqlScan,
"5432": PostgresScan,
"6379": RedisScan,
"9200": elasticsearchScan,
"21": FtpScan,
"22": SshScan,
"135": Findnet,
"139": NetBIOS,
"445": SmbScan,
"1433": MssqlScan,
"3306": MysqlScan,
"5432": PostgresScan,
"6379": RedisScan,
//"9200": elasticsearchScan,
"11211": MemcachedScan,
"27017": MongodbScan,
"1000001": MS17010,
Plugins/portscan.go
+16
View File
@@ -17,6 +17,22 @@ type Addr struct {
func PortScan(hostslist []string, ports string, timeout int64) []string {
var AliveAddress []string
probePorts := common.ParsePort(ports)
noPorts := common.ParsePort(common.NoPorts)
if len(noPorts) > 0 {
tmp := make(map[int]struct{})
var tmpPorts []int
for _, port := range probePorts {
for _, noport := range noPorts {
if port != noport {
if _, ok := tmp[port]; !ok {
tmp[port] = struct{}{}
tmpPorts = append(tmpPorts, port)
}
}
}
}
probePorts = tmpPorts
}
workers := common.Threads
Addrs := make(chan Addr)
results := make(chan string)
Plugins/redis.go
+6 -5
View File
@@ -96,15 +96,16 @@ func Expoilt(realhost string, conn net.Conn) error {
return err
}
if flagSsh == true {
result := fmt.Sprintf("Redis:%v like can write /root/.ssh/", realhost)
result := fmt.Sprintf("[+] Redis:%v like can write /root/.ssh/", realhost)
common.LogSuccess(result)
if common.RedisFile != "" {
writeok, text, err := writekey(conn, common.RedisFile)
if err != nil {
fmt.Println(fmt.Sprintf("[-] %v SSH write key errer: %v", realhost, text))
return err
}
if writeok {
result := fmt.Sprintf("%v SSH public key was written successfully", realhost)
result := fmt.Sprintf("[+] %v SSH public key was written successfully", realhost)
common.LogSuccess(result)
} else {
fmt.Println("Redis:", realhost, "SSHPUB write failed", text)
@@ -113,7 +114,7 @@ func Expoilt(realhost string, conn net.Conn) error {
}
if flagCron == true {
result := fmt.Sprintf("Redis:%v like can write /var/spool/cron/", realhost)
result := fmt.Sprintf("[+] Redis:%v like can write /var/spool/cron/", realhost)
common.LogSuccess(result)
if common.RedisShell != "" {
writeok, text, err := writecron(conn, common.RedisShell)
@@ -121,10 +122,10 @@ func Expoilt(realhost string, conn net.Conn) error {
return err
}
if writeok {
result := fmt.Sprintf("%v /var/spool/cron/root was written successfully", realhost)
result := fmt.Sprintf("[+] %v /var/spool/cron/root was written successfully", realhost)
common.LogSuccess(result)
} else {
fmt.Println("Redis:", realhost, "cron write failed", text)
fmt.Println("[-] Redis:", realhost, "cron write failed", text)
}
}
}
Plugins/scanner.go
+2 -1
View File
@@ -26,6 +26,7 @@ func Scan(info common.HostInfo) {
return
}
AlivePorts := PortScan(Hosts, info.Ports, info.Timeout)
fmt.Println("alive ports len is:", len(AlivePorts))
if info.Scantype == "portscan" {
return
}
@@ -64,7 +65,7 @@ func Scan(info common.HostInfo) {
}
}
wg.Wait()
common.Logwg.Wait()
common.LogWG.Wait()
close(common.Results)
fmt.Println(fmt.Sprintf("已完成 %v/%v", common.End, common.Num))
}
Plugins/ssh.go
+1 -1
View File
@@ -56,7 +56,7 @@ func SshConn(info *common.HostInfo, user string, pass string) (flag bool, err er
flag = true
if info.Command != "" {
combo, _ := session.CombinedOutput(info.Command)
result := fmt.Sprintf("SSH:%v:%v:%v %v \n %v", Host, Port, Username, Password, string(combo))
result := fmt.Sprintf("[+] SSH:%v:%v:%v %v \n %v", Host, Port, Username, Password, string(combo))
common.LogSuccess(result)
} else {
result := fmt.Sprintf("[+] SSH:%v:%v:%v %v", Host, Port, Username, Password)
Plugins/webtitle.go
+3 -2
View File
@@ -6,6 +6,7 @@ import (
"github.com/shadow1ng/fscan/WebScan"
"github.com/shadow1ng/fscan/WebScan/lib"
"github.com/shadow1ng/fscan/common"
"golang.org/x/net/html/charset"
"golang.org/x/text/encoding/simplifiedchinese"
"golang.org/x/text/transform"
"io/ioutil"
@@ -113,7 +114,6 @@ func geturl(info *common.HostInfo, flag int, CheckData []WebScan.CheckDatas) (er
res.Header.Set("User-agent", "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36")
res.Header.Set("Accept", "*/*")
res.Header.Set("Accept-Language", "zh-CN,zh;q=0.9")
res.Header.Set("Accept-Encoding", "gzip, deflate")
if common.Pocinfo.Cookie != "" {
res.Header.Set("Cookie", "rememberMe=1;"+common.Pocinfo.Cookie)
} else {
@@ -167,7 +167,8 @@ func geturl(info *common.HostInfo, flag int, CheckData []WebScan.CheckDatas) (er
return ""
}
encoding := GetEncoding()
if encoding == "gbk" || encoding == "gb2312" {
_, charsetName, _ := charset.DetermineEncoding(body, "")
if encoding == "gbk" || encoding == "gb2312" || charsetName == "gbk" {
titleGBK, err := Decodegbk(text)
if err == nil {
title = string(titleGBK)