加强poc fuzz模块,支持跑备份文件、目录、shiro-key(默认跑10key,可用-full参数跑100key)等。新增ms17017利用(使用参数: -sc add),可在ms17010-exp.go自定义shellcode,内置添加用户等功能。 新增poc、指纹。支持socks5代理。因body指纹更全,默认不再跑ico图标。

common/Parse.go

@@ -122,6 +122,7 @@ func ParseInput(Info *HostInfo) {
 	if BruteThread <= 0 {
 		BruteThread = 1
 	}
+
 	if TmpOutputfile != "" {
 		if !strings.Contains(Outputfile, "/") && !strings.Contains(Outputfile, `\`) {
 			Outputfile = getpath() + TmpOutputfile
@@ -129,9 +130,11 @@ func ParseInput(Info *HostInfo) {
 			Outputfile = TmpOutputfile
 		}
 	}
+
 	if TmpSave == true {
 		IsSave = false
 	}
+
 	if Info.Ports == DefaultPorts {
 		Info.Ports += "," + Webport
 	}
@@ -157,6 +160,9 @@ func ParseInput(Info *HostInfo) {
 		Passwords = append(Passwords, pass...)
 		Passwords = RemoveDuplicate(Passwords)
 	}
+	if Socks5Proxy != "" && !strings.HasPrefix(Socks5Proxy, "socks5://") {
+		Socks5Proxy = "socks5://" + Socks5Proxy
+	}
 }
 
 func ParseScantype(Info *HostInfo) {

common/config.go

@@ -1,6 +1,6 @@
 package common
 
-var version = "1.7.1"
+var version = "1.8.0"
 var Userdict = map[string][]string{
 	"ftp":        {"ftp", "admin", "www", "web", "root", "db", "wwwroot", "data"},
 	"mysql":      {"root", "mysql"},
@@ -107,4 +107,5 @@ var (
 	BruteThread   int
 	LiveTop       int
 	Socks5Proxy   string
+	PocFull       bool
 )

common/flag.go

@@ -51,13 +51,15 @@ func Flag(Info *HostInfo) {
 	flag.BoolVar(&TmpSave, "no", false, "not to save output log")
 	flag.Int64Var(&WaitTime, "debug", 60, "every time to LogErr")
 	flag.BoolVar(&Silent, "silent", false, "silent scan")
+	flag.BoolVar(&PocFull, "full", false, "poc full scan,as: shiro 100 key")
 	flag.StringVar(&URL, "u", "", "url")
 	flag.StringVar(&UrlFile, "uf", "", "urlfile")
 	flag.StringVar(&Pocinfo.PocName, "pocname", "", "use the pocs these contain pocname, -pocname weblogic")
 	flag.StringVar(&Pocinfo.Proxy, "proxy", "", "set poc proxy, -proxy http://127.0.0.1:8080")
 	flag.StringVar(&Socks5Proxy, "socks5", "", "set socks5 proxy, will be used in tcp connection, timeout setting will not work")
-	flag.StringVar(&Pocinfo.Cookie, "cookie", "", "set poc cookie")
+	flag.StringVar(&Pocinfo.Cookie, "cookie", "", "set poc cookie,-cookie rememberMe=login")
 	flag.Int64Var(&Pocinfo.Timeout, "wt", 5, "Set web timeout")
 	flag.IntVar(&Pocinfo.Num, "num", 20, "poc rate")
+	flag.StringVar(&SC, "sc", "", "ms17 shellcode,as -sc add")
 	flag.Parse()
 }