mirror of
https://github.com/shadow1ng/fscan.git
synced 2026-09-22 03:10:42 +08:00
fix: 修复新服务扫描插件的健壮性问题
- ipmi: 删除未使用的 encoding/binary 导入 - rmi: TCP读取改用 io.ReadFull 避免分片导致的解析错误 - jdwp: handshake响应读取改用 io.ReadFull 避免分片误判 - nfs: v4协议回退时使用新连接避免残留数据污染 - snmp: 修正timeout计算与其他插件保持一致
This commit is contained in:
@@ -4,7 +4,6 @@ package services
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/binary"
|
||||
"fmt"
|
||||
"time"
|
||||
|
||||
@@ -161,5 +160,4 @@ func init() {
|
||||
RegisterUDPPluginWithPorts("ipmi", func() Plugin {
|
||||
return NewIPMIPlugin()
|
||||
}, []int{623})
|
||||
_ = binary.BigEndian // suppress unused import if needed
|
||||
}
|
||||
|
||||
@@ -6,6 +6,7 @@ import (
|
||||
"bytes"
|
||||
"context"
|
||||
"fmt"
|
||||
"io"
|
||||
"time"
|
||||
|
||||
"github.com/shadow1ng/fscan/common"
|
||||
@@ -41,8 +42,7 @@ func (p *JDWPPlugin) Scan(ctx context.Context, info *common.HostInfo, session *c
|
||||
}
|
||||
|
||||
buf := make([]byte, len(jdwpHandshake))
|
||||
n, err := conn.Read(buf)
|
||||
if err != nil || !bytes.Equal(buf[:n], jdwpHandshake) {
|
||||
if _, err := io.ReadFull(conn, buf); err != nil || !bytes.Equal(buf, jdwpHandshake) {
|
||||
return &ScanResult{Success: false, Service: "jdwp"}
|
||||
}
|
||||
|
||||
|
||||
@@ -36,9 +36,15 @@ func (p *NFSPlugin) Scan(ctx context.Context, info *common.HostInfo, session *co
|
||||
|
||||
// NFS NULL call (program=100003, version=3, procedure=0) to confirm NFS service
|
||||
if err := p.rpcNullCall(conn, 100003, 3); err != nil {
|
||||
// Try v4
|
||||
_ = conn.SetDeadline(time.Now().Add(timeout))
|
||||
if err := p.rpcNullCall(conn, 100003, 4); err != nil {
|
||||
// Try v4 on a fresh connection
|
||||
conn.Close()
|
||||
c, dialErr := session.DialTCP(ctx, "tcp", addr, timeout)
|
||||
if dialErr != nil {
|
||||
return &ScanResult{Success: false, Service: "nfs"}
|
||||
}
|
||||
defer c.Close()
|
||||
_ = c.SetDeadline(time.Now().Add(timeout))
|
||||
if err := p.rpcNullCall(c, 100003, 4); err != nil {
|
||||
return &ScanResult{Success: false, Service: "nfs"}
|
||||
}
|
||||
}
|
||||
|
||||
+14
-8
@@ -5,6 +5,7 @@ package services
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"io"
|
||||
"time"
|
||||
|
||||
"github.com/shadow1ng/fscan/common"
|
||||
@@ -40,18 +41,23 @@ func (p *RMIPlugin) Scan(ctx context.Context, info *common.HostInfo, session *co
|
||||
return &ScanResult{Success: false, Service: "rmi"}
|
||||
}
|
||||
|
||||
buf := make([]byte, 256)
|
||||
// RMI server responds with ProtocolAck (0x4e) followed by endpoint info.
|
||||
// Read at least 1 byte for the ack; io.ReadFull guarantees it.
|
||||
ack := make([]byte, 1)
|
||||
if _, err := io.ReadFull(conn, ack); err != nil {
|
||||
return &ScanResult{Success: false, Service: "rmi"}
|
||||
}
|
||||
if ack[0] != 0x4e {
|
||||
return &ScanResult{Success: false, Service: "rmi"}
|
||||
}
|
||||
|
||||
buf := make([]byte, 255)
|
||||
n, err := conn.Read(buf)
|
||||
if err != nil || n < 5 {
|
||||
if err != nil && n == 0 {
|
||||
return &ScanResult{Success: false, Service: "rmi"}
|
||||
}
|
||||
|
||||
// RMI server responds with 0x4e (ProtocolAck) followed by endpoint info
|
||||
if buf[0] != 0x4e {
|
||||
return &ScanResult{Success: false, Service: "rmi"}
|
||||
}
|
||||
|
||||
endpoint := parseRMIEndpoint(buf[1:n])
|
||||
endpoint := parseRMIEndpoint(buf[:n])
|
||||
|
||||
return &ScanResult{
|
||||
Success: true,
|
||||
|
||||
@@ -23,7 +23,7 @@ func NewSNMPPlugin() *SNMPPlugin {
|
||||
|
||||
func (p *SNMPPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
|
||||
config := session.Config
|
||||
timeout := time.Duration(config.Timeout.Seconds()) * time.Second
|
||||
timeout := config.Timeout
|
||||
if timeout <= 0 {
|
||||
timeout = 3 * time.Second
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user