feat: v2.1.0 核心重构与功能增强

## 架构重构 - 全局变量消除，迁移至 Config/State 对象 - SMB 插件融合（smb/smb2/smbghost/smbinfo） - 服务探测重构，实现 Nmap 风格 fallback 机制 - 输出系统重构，TXT 实时刷盘 + 双写机制 - i18n 框架升级至 go-i18n ## 性能优化 - 正则表达式预编译 - 内存优化 map[string]struct{} - 并发指纹匹配 - SOCKS5 连接复用 - 滑动窗口调度 + 自适应线程池 ## 新功能 - Web 管理界面 - 多格式 POC 适配（xray/afrog） - 增强指纹库（3139条） - Favicon hash 指纹识别 - 插件选择性编译（Build Tags） - fscan-lab 靶场环境 - 默认端口扩展（62→133） ## 构建系统 - 添加 no_local tag 支持排除本地插件 - 多版本构建：fscan/fscan-nolocal/fscan-web - CI 添加 snapshot 模式支持仅测试构建 ## Bug 修复 - 修复 120+ 个问题，包括 RDP panic、批量扫描漏报、 JSON 输出格式、Redis 检测、Context 超时等 ## 测试增强 - 单元测试覆盖率 74-100% - 并发安全测试 - 集成测试（Web/端口/服务/SSH/ICMP）
2026-09-24 04:01:52 +08:00 · 2026-01-11 20:16:23 +08:00
parent 6b13b2e84f
commit 71b92d4408
948 changed files with 92335 additions and 24630 deletions
@@ -0,0 +1,566 @@
+//go:build plugin_telnet || !plugin_selective
+
+package services
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"strings"
+	"time"
+
+	"github.com/shadow1ng/fscan/common"
+	"github.com/shadow1ng/fscan/common/i18n"
+	"github.com/shadow1ng/fscan/plugins"
+)
+
+// Telnet协议时间常量
+const (
+	telnetReadDelay     = 200 * time.Millisecond  // 读取间隔延迟
+	telnetRetryDelay    = 500 * time.Millisecond  // 重试延迟
+	telnetAuthDelay     = 1000 * time.Millisecond // 认证后等待延迟
+	telnetReadTimeout   = 2 * time.Second         // 读取超时
+	telnetBannerTimeout = 3 * time.Second         // Banner读取超时
+	telnetMaxAttempts   = 10                      // 最大尝试次数
+)
+
+// TelnetPlugin Telnet扫描插件
+type TelnetPlugin struct {
+	plugins.BasePlugin
+}
+
+func NewTelnetPlugin() *TelnetPlugin {
+	return &TelnetPlugin{
+		BasePlugin: plugins.NewBasePlugin("telnet"),
+	}
+}
+
+func (p *TelnetPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+	target := info.Target()
+
+	if config.DisableBrute {
+		return p.identifyService(ctx, info, config, state)
+	}
+
+	// 检测未授权访问
+	if result := p.testUnauthAccess(ctx, info, config, state); result != nil && result.Success {
+		common.LogSuccess(i18n.Tr("telnet_service", target, result.Banner))
+		return result
+	}
+
+	// 生成密码字典
+	credentials := plugins.GenerateCredentials("telnet", config)
+	if len(credentials) == 0 {
+		return &ScanResult{
+			Success: false,
+			Service: "telnet",
+			Error:   fmt.Errorf("没有可用的测试凭据"),
+		}
+	}
+
+	// 转换凭据类型
+	creds := make([]Credential, len(credentials))
+	for i, c := range credentials {
+		creds[i] = Credential{Username: c.Username, Password: c.Password}
+	}
+
+	// 使用公共框架进行并发凭据测试
+	authFn := p.createAuthFunc(info, config, state)
+	testConfig := DefaultConcurrentTestConfig(config)
+
+	result := TestCredentialsConcurrently(ctx, creds, authFn, "telnet", testConfig)
+
+	if result.Success {
+		common.LogSuccess(i18n.Tr("telnet_credential", target, result.Username, result.Password))
+	}
+
+	return result
+}
+
+// createAuthFunc 创建Telnet认证函数
+func (p *TelnetPlugin) createAuthFunc(info *common.HostInfo, config *common.Config, state *common.State) AuthFunc {
+	return func(ctx context.Context, cred Credential) *AuthResult {
+		return p.doTelnetAuth(ctx, info, cred, config, state)
+	}
+}
+
+// doTelnetAuth 执行Telnet认证
+func (p *TelnetPlugin) doTelnetAuth(ctx context.Context, info *common.HostInfo, cred Credential, config *common.Config, state *common.State) *AuthResult {
+	target := info.Target()
+
+	resultChan := make(chan *AuthResult, 1)
+
+	go func() {
+		conn, err := common.WrapperTcpWithTimeout("tcp", target, config.Timeout)
+		if err != nil {
+			state.IncrementTCPFailedPacketCount()
+			resultChan <- &AuthResult{
+				Success:   false,
+				ErrorType: classifyTelnetErrorType(err),
+				Error:     err,
+			}
+			return
+		}
+
+		_ = conn.SetDeadline(time.Now().Add(config.Timeout))
+
+		if p.performTelnetAuth(conn, cred.Username, cred.Password) {
+			state.IncrementTCPSuccessPacketCount()
+			resultChan <- &AuthResult{
+				Success:   true,
+				Conn:      &telnetConnWrapper{conn},
+				ErrorType: ErrorTypeUnknown,
+				Error:     nil,
+			}
+		} else {
+			_ = conn.Close()
+			state.IncrementTCPFailedPacketCount()
+			resultChan <- &AuthResult{
+				Success:   false,
+				ErrorType: ErrorTypeAuth,
+				Error:     fmt.Errorf("认证失败"),
+			}
+		}
+	}()
+
+	select {
+	case result := <-resultChan:
+		return result
+	case <-ctx.Done():
+		// context 被取消，启动清理协程等待并关闭可能创建的连接
+		go func() {
+			result := <-resultChan
+			if result != nil && result.Conn != nil {
+				_ = result.Conn.Close()
+			}
+		}()
+		return &AuthResult{
+			Success:   false,
+			ErrorType: ErrorTypeNetwork,
+			Error:     ctx.Err(),
+		}
+	}
+}
+
+// telnetConnWrapper 包装Telnet连接以实现io.Closer
+type telnetConnWrapper struct {
+	conn net.Conn
+}
+
+func (w *telnetConnWrapper) Close() error {
+	return w.conn.Close()
+}
+
+// classifyTelnetErrorType Telnet错误分类
+func classifyTelnetErrorType(err error) ErrorType {
+	if err == nil {
+		return ErrorTypeUnknown
+	}
+
+	telnetAuthErrors := []string{
+		"authentication failed",
+		"authentication failure",
+		"auth failed",
+		"login failed",
+		"invalid credentials",
+		"invalid password",
+		"invalid username",
+		"access denied",
+		"login incorrect",
+		"permission denied",
+		"bad password",
+		"wrong password",
+		"incorrect login",
+		"login failure",
+		"invalid login",
+		"authentication error",
+		"unauthorized",
+		"credentials rejected",
+	}
+
+	return ClassifyError(err, telnetAuthErrors, CommonNetworkErrors)
+}
+
+// testUnauthAccess 测试Telnet未授权访问
+func (p *TelnetPlugin) testUnauthAccess(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+	target := info.Target()
+
+	resultChan := make(chan *ScanResult, 1)
+
+	go func() {
+		conn, err := common.WrapperTcpWithTimeout("tcp", target, config.Timeout)
+		if err != nil {
+			state.IncrementTCPFailedPacketCount()
+			resultChan <- nil
+			return
+		}
+		defer func() { _ = conn.Close() }()
+
+		_ = conn.SetDeadline(time.Now().Add(config.Timeout))
+
+		buffer := make([]byte, 1024)
+		attempts := 0
+		maxAttempts := telnetMaxAttempts
+
+		for attempts < maxAttempts {
+			attempts++
+
+			_ = conn.SetReadDeadline(time.Now().Add(telnetBannerTimeout))
+			n, err := conn.Read(buffer)
+			if err != nil {
+				time.Sleep(telnetRetryDelay)
+				continue
+			}
+
+			response := string(buffer[:n])
+			cleaned := p.cleanResponse(response)
+			cleanedLower := strings.ToLower(cleaned)
+
+			p.handleIACNegotiation(conn, buffer[:n])
+
+			if p.isShellPrompt(cleaned) {
+				state.IncrementTCPSuccessPacketCount()
+				resultChan <- &ScanResult{
+					Success: true,
+					Type:    plugins.ResultTypeVuln,
+					Service: "telnet",
+					Banner:  "Telnet远程终端服务 (未授权访问)",
+				}
+				return
+			}
+
+			if strings.Contains(cleanedLower, "login") ||
+				strings.Contains(cleanedLower, "username") ||
+				strings.Contains(cleaned, ":") {
+				break
+			}
+
+			time.Sleep(telnetRetryDelay)
+		}
+
+		resultChan <- nil
+	}()
+
+	select {
+	case result := <-resultChan:
+		return result
+	case <-ctx.Done():
+		return nil
+	}
+}
+
+// performTelnetAuth 执行Telnet认证
+func (p *TelnetPlugin) performTelnetAuth(conn net.Conn, username, password string) bool {
+	buffer := make([]byte, 1024)
+
+	loginPromptReceived := false
+	attempts := 0
+	maxAttempts := telnetMaxAttempts
+
+	for attempts < maxAttempts && !loginPromptReceived {
+		attempts++
+
+		_ = conn.SetReadDeadline(time.Now().Add(telnetReadTimeout))
+		n, err := conn.Read(buffer)
+		if err != nil {
+			time.Sleep(telnetReadDelay)
+			continue
+		}
+
+		response := string(buffer[:n])
+		p.handleIACNegotiation(conn, buffer[:n])
+		cleaned := p.cleanResponse(response)
+		cleanedLower := strings.ToLower(cleaned)
+
+		if p.isShellPrompt(cleaned) {
+			return true
+		}
+
+		if strings.Contains(cleanedLower, "login") ||
+			strings.Contains(cleanedLower, "username") ||
+			strings.Contains(cleaned, ":") {
+			loginPromptReceived = true
+			break
+		}
+
+		time.Sleep(telnetReadDelay)
+	}
+
+	if !loginPromptReceived {
+		return false
+	}
+
+	_, err := conn.Write([]byte(username + "\r\n"))
+	if err != nil {
+		return false
+	}
+
+	time.Sleep(telnetRetryDelay)
+	passwordPromptReceived := false
+	attempts = 0
+	maxPasswordAttempts := 5
+
+	for attempts < maxPasswordAttempts && !passwordPromptReceived {
+		attempts++
+
+		_ = conn.SetReadDeadline(time.Now().Add(telnetReadTimeout))
+		n, readErr := conn.Read(buffer)
+		if readErr != nil {
+			time.Sleep(telnetReadDelay)
+			continue
+		}
+
+		response := string(buffer[:n])
+		cleaned := p.cleanResponse(response)
+
+		if strings.Contains(strings.ToLower(cleaned), "password") ||
+			strings.Contains(cleaned, ":") {
+			passwordPromptReceived = true
+			break
+		}
+
+		time.Sleep(telnetReadDelay)
+	}
+
+	if !passwordPromptReceived {
+		return false
+	}
+
+	_, err = conn.Write([]byte(password + "\r\n"))
+	if err != nil {
+		return false
+	}
+
+	time.Sleep(telnetAuthDelay)
+	attempts = 0
+	maxResultAttempts := 5
+
+	for attempts < maxResultAttempts {
+		attempts++
+
+		_ = conn.SetReadDeadline(time.Now().Add(telnetReadTimeout))
+		n, err := conn.Read(buffer)
+		if err != nil {
+			time.Sleep(telnetReadDelay)
+			continue
+		}
+
+		response := string(buffer[:n])
+		cleaned := p.cleanResponse(response)
+
+		if p.isLoginSuccess(cleaned) {
+			return true
+		}
+
+		if p.isLoginFailed(cleaned) {
+			return false
+		}
+
+		time.Sleep(telnetReadDelay)
+	}
+
+	return false
+}
+
+// handleIACNegotiation 处理IAC协商
+func (p *TelnetPlugin) handleIACNegotiation(conn net.Conn, data []byte) {
+	for i := 0; i < len(data); i++ {
+		if data[i] == 255 && i+2 < len(data) {
+			cmd := data[i+1]
+			opt := data[i+2]
+
+			switch cmd {
+			case 251: // WILL
+				_, _ = conn.Write([]byte{255, 254, opt})
+			case 253: // DO
+				_, _ = conn.Write([]byte{255, 252, opt})
+			}
+			i += 2
+		}
+	}
+}
+
+// cleanResponse 清理telnet响应中的IAC命令
+func (p *TelnetPlugin) cleanResponse(data string) string {
+	var result strings.Builder
+
+	for i := 0; i < len(data); i++ {
+		b := data[i]
+		if b == 255 && i+2 < len(data) {
+			i += 2
+			continue
+		}
+		if (b >= 32 && b <= 126) || b == '\r' || b == '\n' || b == '\t' {
+			result.WriteByte(b)
+		}
+	}
+
+	return strings.TrimSpace(result.String())
+}
+
+// isShellPrompt 检查是否为shell提示符
+func (p *TelnetPlugin) isShellPrompt(data string) bool {
+	if data == "" {
+		return false
+	}
+
+	data = strings.ToLower(strings.TrimSpace(data))
+
+	shellPrompts := []string{"$", "#", ">", "~$", "]$", ")#", "bash", "shell", "cmd"}
+
+	for _, prompt := range shellPrompts {
+		if strings.Contains(data, prompt) {
+			return true
+		}
+	}
+
+	return false
+}
+
+// isLoginSuccess 检查登录是否成功
+func (p *TelnetPlugin) isLoginSuccess(data string) bool {
+	if data == "" {
+		return false
+	}
+
+	data = strings.ToLower(strings.TrimSpace(data))
+
+	if p.isShellPrompt(data) {
+		return true
+	}
+
+	successIndicators := []string{
+		"welcome", "last login", "successful", "logged in",
+		"login successful", "authentication successful",
+		"welcome to", "successfully logged", "login ok",
+		"connected to", "logged on",
+	}
+
+	for _, indicator := range successIndicators {
+		if strings.Contains(data, indicator) {
+			return true
+		}
+	}
+
+	return false
+}
+
+// isLoginFailed 检查登录是否失败
+func (p *TelnetPlugin) isLoginFailed(data string) bool {
+	if data == "" {
+		return false
+	}
+
+	data = strings.ToLower(strings.TrimSpace(data))
+
+	failureIndicators := []string{
+		"incorrect", "failed", "denied", "invalid", "wrong", "bad", "error",
+		"authentication failed", "login failed", "access denied",
+		"permission denied", "authentication error", "login incorrect",
+		"invalid password", "invalid username", "unauthorized",
+		"login failure", "connection refused",
+	}
+
+	for _, indicator := range failureIndicators {
+		if strings.Contains(data, indicator) {
+			return true
+		}
+	}
+
+	repeatPrompts := []string{"login:", "username:", "user:", "name:"}
+
+	for _, prompt := range repeatPrompts {
+		if strings.Contains(data, prompt) {
+			return true
+		}
+	}
+
+	return false
+}
+
+// identifyService Telnet服务识别
+func (p *TelnetPlugin) identifyService(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+	target := info.Target()
+
+	resultChan := make(chan *ScanResult, 1)
+
+	go func() {
+		conn, err := common.WrapperTcpWithTimeout("tcp", target, config.Timeout)
+		if err != nil {
+			state.IncrementTCPFailedPacketCount()
+			resultChan <- &ScanResult{
+				Success: false,
+				Service: "telnet",
+				Error:   err,
+			}
+			return
+		}
+		defer func() { _ = conn.Close() }()
+
+		_ = conn.SetDeadline(time.Now().Add(config.Timeout))
+
+		buffer := make([]byte, 2048)
+		n, err := conn.Read(buffer)
+		if err != nil {
+			state.IncrementTCPFailedPacketCount()
+			resultChan <- &ScanResult{
+				Success: false,
+				Service: "telnet",
+				Error:   err,
+			}
+			return
+		}
+
+		state.IncrementTCPSuccessPacketCount()
+
+		p.handleIACNegotiation(conn, buffer[:n])
+		cleaned := p.cleanResponse(string(buffer[:n]))
+		cleanedLower := strings.ToLower(cleaned)
+
+		var banner string
+
+		if p.isShellPrompt(cleaned) {
+			banner = "Telnet远程终端服务 (未授权访问)"
+		} else if strings.Contains(cleanedLower, "login") ||
+			strings.Contains(cleanedLower, "username") ||
+			strings.Contains(cleanedLower, "user") {
+			banner = "Telnet远程终端服务 (需要认证)"
+		} else if strings.Contains(cleanedLower, "password") {
+			banner = "Telnet远程终端服务 (只需密码)"
+		} else if cleaned != "" {
+			displayCleaned := cleaned
+			if len(displayCleaned) > 50 {
+				displayCleaned = displayCleaned[:50] + "..."
+			}
+			banner = fmt.Sprintf("Telnet远程终端服务 (自定义欢迎: %s)", displayCleaned)
+		} else {
+			banner = "Telnet远程终端服务"
+		}
+
+		common.LogSuccess(i18n.Tr("telnet_service", target, banner))
+
+		resultChan <- &ScanResult{
+			Success: true,
+			Type:    plugins.ResultTypeService,
+			Service: "telnet",
+			Banner:  banner,
+		}
+	}()
+
+	select {
+	case result := <-resultChan:
+		return result
+	case <-ctx.Done():
+		return &ScanResult{
+			Success: false,
+			Service: "telnet",
+			Error:   ctx.Err(),
+		}
+	}
+}
+
+func init() {
+	RegisterPluginWithPorts("telnet", func() Plugin {
+		return NewTelnetPlugin()
+	}, []int{23, 2323})
+}