fix: resolve recent service scan regressions

plugins/services/ssh.go

@@ -3,6 +3,7 @@
 package services
 
 import (
+	"bufio"
 	"context"
 	"fmt"
 	"io"
@@ -308,19 +309,27 @@ func (p *SSHPlugin) identifyService(ctx context.Context, info *common.HostInfo,
 func (p *SSHPlugin) readSSHBanner(conn net.Conn, config *common.Config) string {
 	_ = conn.SetReadDeadline(time.Now().Add(config.ModuleTimeout()))
 
-	banner := make([]byte, 256)
-	n, err := conn.Read(banner)
-	if err != nil || n < 4 {
-		return ""
-	}
+	// RFC 4253 permits servers to send informational lines before the SSH
+	// identification string. Read bounded lines until the protocol banner is
+	// found instead of requiring SSH- at the first byte of the first read.
+	reader := bufio.NewReaderSize(conn, 256)
+	for range 50 {
+		line, err := reader.ReadString('\n')
+		if len(line) > 255 {
+			return ""
+		}
 
-	bannerStr := strings.TrimSpace(string(banner[:n]))
+		banner := strings.TrimSpace(line)
+		if strings.HasPrefix(banner, "SSH-") {
+			if matched := sshBannerRegex.FindStringSubmatch(banner); len(matched) >= 3 {
+				return fmt.Sprintf("SSH %s (%s)", matched[1], matched[2])
+			}
+			return i18n.Tr("ssh_service_banner", banner)
+		}
 
-	if strings.HasPrefix(bannerStr, "SSH-") {
-		if matched := sshBannerRegex.FindStringSubmatch(bannerStr); len(matched) >= 3 {
-			return fmt.Sprintf("SSH %s (%s)", matched[1], matched[2])
+		if err != nil {
+			return ""
 		}
-		return i18n.Tr("ssh_service_banner", bannerStr)
 	}
 
 	return ""

plugins/services/ssh_test.go

@@ -4,9 +4,47 @@ package services
 
 import (
 	"errors"
+	"net"
 	"testing"
+	"time"
+
+	"github.com/shadow1ng/fscan/common"
 )
 
+func TestReadSSHBannerAllowsPreBannerLines(t *testing.T) {
+	client, server := net.Pipe()
+	defer client.Close()
+	defer server.Close()
+
+	go func() {
+		_, _ = server.Write([]byte("Authorized access only\r\nSSH-2.0-OpenSSH_9.6\r\n"))
+	}()
+
+	cfg := common.NewConfig()
+	cfg.Timeout = time.Second
+	got := NewSSHPlugin().readSSHBanner(client, cfg)
+	if got != "SSH 2.0 (OpenSSH_9.6)" {
+		t.Fatalf("readSSHBanner() = %q", got)
+	}
+}
+
+func TestReadSSHBannerRejectsNonSSHService(t *testing.T) {
+	client, server := net.Pipe()
+	defer client.Close()
+	defer server.Close()
+
+	go func() {
+		_, _ = server.Write([]byte("HTTP/1.1 200 OK\r\n"))
+		_ = server.Close()
+	}()
+
+	cfg := common.NewConfig()
+	cfg.Timeout = time.Second
+	if got := NewSSHPlugin().readSSHBanner(client, cfg); got != "" {
+		t.Fatalf("readSSHBanner() = %q, want empty", got)
+	}
+}
+
 func TestClassifySSHErrorType(t *testing.T) {
 	tests := []struct {
 		name string

plugins/services/telnet.go

@@ -61,12 +61,11 @@ func (p *TelnetPlugin) Scan(ctx context.Context, info *common.HostInfo, session
 
 	// 检测未授权访问
 	if result := p.testUnauthAccess(ctx, info, session); result != nil && result.Success {
-		session.LogVuln(i18n.Tr("telnet_service", target, result.Banner))
-		// 验证命令执行能力
 		if ok, osType, evidence := p.verifyCommandExecution(ctx, info, "", "", session); ok {
+			session.LogVuln(i18n.Tr("telnet_service", target, result.Banner))
 			session.LogVuln(i18n.Tr("telnet_unauth_rce", target, osType, evidence))
+			return result
 		}
-		return result
 	}
 
 	// 生成密码字典

plugins/services/vnc.go

@@ -34,6 +34,15 @@ func (p *VNCPlugin) Scan(ctx context.Context, info *common.HostInfo, session *co
 		return result
 	}
 
+	// -nobr 仅保留未授权访问检测，不继续尝试密码。
+	if config.DisableBrute {
+		return &ScanResult{
+			Type:    plugins.ResultTypeService,
+			Success: true,
+			Service: "vnc",
+		}
+	}
+
 	// 生成密码列表
 	var credentials []Credential
 	if config.Credentials.Passwords != nil {

plugins/services/vnc_test.go

@@ -3,10 +3,59 @@
 package services
 
 import (
+	"context"
 	"errors"
+	"net"
+	"strconv"
+	"sync/atomic"
 	"testing"
+	"time"
+
+	"github.com/shadow1ng/fscan/common"
 )
 
+func TestVNCDisableBruteOnlyChecksUnauthenticatedAccess(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer listener.Close()
+
+	var connections atomic.Int32
+	go func() {
+		for {
+			conn, err := listener.Accept()
+			if err != nil {
+				return
+			}
+			connections.Add(1)
+			_ = conn.Close()
+		}
+	}()
+
+	host, portText, err := net.SplitHostPort(listener.Addr().String())
+	if err != nil {
+		t.Fatal(err)
+	}
+	port, err := strconv.Atoi(portText)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	cfg := common.NewConfig()
+	cfg.DisableBrute = true
+	session := common.NewScanSession(cfg, common.NewState(), &common.FlagVars{})
+	result := NewVNCPlugin().Scan(context.Background(), &common.HostInfo{Host: host, Port: port}, session)
+	if result == nil || !result.Success || result.Service != "vnc" {
+		t.Fatalf("Scan() = %#v, want identified VNC service", result)
+	}
+
+	time.Sleep(20 * time.Millisecond)
+	if got := connections.Load(); got != 1 {
+		t.Fatalf("connections = %d, want one unauthenticated-access check and no password attempts", got)
+	}
+}
+
 func TestClassifyVNCErrorType(t *testing.T) {
 	tests := []struct {
 		name string