archive/fscan
1
0
Fork 0
mirror of https://github.com/shadow1ng/fscan.git synced 2026-09-22 03:10:42 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

refacor: 结构化修改

Browse Source
This commit is contained in:
ZacharyZcR
2024-12-19 16:15:53 +08:00
parent 0cfbf40baf
commit c8687827ac
29 changed files with 85 additions and 112 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Plugins/FTP.go
+2 -3
View File
@@ -4,13 +4,12 @@ import (
"fmt"
"github.com/jlaffaye/ftp"
"github.com/shadow1ng/fscan/Common"
"github.com/shadow1ng/fscan/Config"
"strings"
"time"
)
// FtpScan 执行FTP服务扫描
func FtpScan(info *Config.HostInfo) (tmperr error) {
func FtpScan(info *Common.HostInfo) (tmperr error) {
// 如果已开启暴力破解则直接返回
if Common.IsBrute {
return
@@ -62,7 +61,7 @@ func FtpScan(info *Config.HostInfo) (tmperr error) {
}
// FtpConn 建立FTP连接并尝试登录
func FtpConn(info *Config.HostInfo, user string, pass string) (flag bool, err error) {
func FtpConn(info *Common.HostInfo, user string, pass string) (flag bool, err error) {
Host, Port, Username, Password := info.Host, info.Ports, user, pass
// 建立FTP连接
Plugins/FcgiScan.go
+1 -2
View File
@@ -7,7 +7,6 @@ import (
"errors"
"fmt"
"github.com/shadow1ng/fscan/Common"
"github.com/shadow1ng/fscan/Config"
"io"
"strconv"
"strings"
@@ -20,7 +19,7 @@ import (
//https://github.com/wofeiwo/webcgi-exploits
// FcgiScan 执行FastCGI服务器漏洞扫描
func FcgiScan(info *Config.HostInfo) error {
func FcgiScan(info *Common.HostInfo) error {
// 如果设置了暴力破解模式则跳过
if Common.IsBrute {
return nil
Plugins/FindNet.go
+2 -3
View File
@@ -5,7 +5,6 @@ import (
"encoding/hex"
"fmt"
"github.com/shadow1ng/fscan/Common"
"github.com/shadow1ng/fscan/Config"
"strconv"
"strings"
"time"
@@ -19,13 +18,13 @@ var (
)
// Findnet 探测Windows网络主机信息的入口函数
func Findnet(info *Config.HostInfo) error {
func Findnet(info *Common.HostInfo) error {
fmt.Println("[+] FindNet扫描模块开始...")
return FindnetScan(info)
}
// FindnetScan 通过RPC协议扫描网络主机信息
func FindnetScan(info *Config.HostInfo) error {
func FindnetScan(info *Common.HostInfo) error {
// 连接目标RPC端口
target := fmt.Sprintf("%s:%v", info.Host, 135)
conn, err := Common.WrapperTcpWithTimeout("tcp", target, time.Duration(Common.Timeout)*time.Second)
Plugins/LocalInfo.go
+1 -2
View File
@@ -3,7 +3,6 @@ package Plugins
import (
"fmt"
"github.com/shadow1ng/fscan/Common"
"github.com/shadow1ng/fscan/Config"
"os"
"path/filepath"
"runtime"
@@ -89,7 +88,7 @@ var (
}
)
func LocalInfoScan(info *Config.HostInfo) (err error) {
func LocalInfoScan(info *Common.HostInfo) (err error) {
fmt.Println("[+] LocalInfo扫描模块开始...")
home, err := os.UserHomeDir()
if err != nil {
Plugins/MS17010-Exp.go
+1 -2
View File
@@ -6,7 +6,6 @@ import (
"encoding/hex"
"fmt"
"github.com/shadow1ng/fscan/Common"
"github.com/shadow1ng/fscan/Config"
"io"
"io/ioutil"
"net"
@@ -15,7 +14,7 @@ import (
)
// MS17010EXP 执行MS17-010漏洞利用
func MS17010EXP(info *Config.HostInfo) {
func MS17010EXP(info *Common.HostInfo) {
address := info.Host + ":445"
var sc string
Plugins/MS17010.go
+2 -3
View File
@@ -6,7 +6,6 @@ import (
"errors"
"fmt"
"github.com/shadow1ng/fscan/Common"
"github.com/shadow1ng/fscan/Config"
"log"
"strings"
"time"
@@ -83,7 +82,7 @@ func init() {
}
// MS17010 扫描入口函数
func MS17010(info *Config.HostInfo) error {
func MS17010(info *Common.HostInfo) error {
// 暴力破解模式下跳过扫描
if Common.IsBrute {
return nil
@@ -100,7 +99,7 @@ func MS17010(info *Config.HostInfo) error {
}
// MS17010Scan 执行MS17-010漏洞扫描
func MS17010Scan(info *Config.HostInfo) error {
func MS17010Scan(info *Common.HostInfo) error {
ip := info.Host
// 连接目标445端口
Plugins/MSSQL.go
+2 -3
View File
@@ -5,13 +5,12 @@ import (
"fmt"
_ "github.com/denisenkom/go-mssqldb"
"github.com/shadow1ng/fscan/Common"
"github.com/shadow1ng/fscan/Config"
"strings"
"time"
)
// MssqlScan 执行MSSQL服务扫描
func MssqlScan(info *Config.HostInfo) (tmperr error) {
func MssqlScan(info *Common.HostInfo) (tmperr error) {
if Common.IsBrute {
return
}
@@ -50,7 +49,7 @@ func MssqlScan(info *Config.HostInfo) (tmperr error) {
}
// MssqlConn 尝试MSSQL连接
func MssqlConn(info *Config.HostInfo, user string, pass string) (bool, error) {
func MssqlConn(info *Common.HostInfo, user string, pass string) (bool, error) {
host, port, username, password := info.Host, info.Ports, user, pass
timeout := time.Duration(Common.Timeout) * time.Second
Plugins/Memcached.go
+1 -2
View File
@@ -3,13 +3,12 @@ package Plugins
import (
"fmt"
"github.com/shadow1ng/fscan/Common"
"github.com/shadow1ng/fscan/Config"
"strings"
"time"
)
// MemcachedScan 检测Memcached未授权访问
func MemcachedScan(info *Config.HostInfo) error {
func MemcachedScan(info *Common.HostInfo) error {
fmt.Println("[+] Memcached扫描模块开始...")
realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
timeout := time.Duration(Common.Timeout) * time.Second
Plugins/Mongodb.go
+2 -3
View File
@@ -3,13 +3,12 @@ package Plugins
import (
"fmt"
"github.com/shadow1ng/fscan/Common"
"github.com/shadow1ng/fscan/Config"
"strings"
"time"
)
// MongodbScan 执行MongoDB未授权扫描
func MongodbScan(info *Config.HostInfo) error {
func MongodbScan(info *Common.HostInfo) error {
if Common.IsBrute {
return nil
}
@@ -25,7 +24,7 @@ func MongodbScan(info *Config.HostInfo) error {
}
// MongodbUnauth 检测MongoDB未授权访问
func MongodbUnauth(info *Config.HostInfo) (bool, error) {
func MongodbUnauth(info *Common.HostInfo) (bool, error) {
// MongoDB查询数据包
msgPacket := createOpMsgPacket()
queryPacket := createOpQueryPacket()
Plugins/MySQL.go
+2 -3
View File
@@ -5,13 +5,12 @@ import (
"fmt"
_ "github.com/go-sql-driver/mysql"
"github.com/shadow1ng/fscan/Common"
"github.com/shadow1ng/fscan/Config"
"strings"
"time"
)
// MysqlScan 执行MySQL服务扫描
func MysqlScan(info *Config.HostInfo) (tmperr error) {
func MysqlScan(info *Common.HostInfo) (tmperr error) {
if Common.IsBrute {
return
}
@@ -50,7 +49,7 @@ func MysqlScan(info *Config.HostInfo) (tmperr error) {
}
// MysqlConn 尝试MySQL连接
func MysqlConn(info *Config.HostInfo, user string, pass string) (bool, error) {
func MysqlConn(info *Common.HostInfo, user string, pass string) (bool, error) {
host, port, username, password := info.Host, info.Ports, user, pass
timeout := time.Duration(Common.Timeout) * time.Second
Plugins/NetBIOS.go
+3 -4
View File
@@ -5,7 +5,6 @@ import (
"errors"
"fmt"
"github.com/shadow1ng/fscan/Common"
"github.com/shadow1ng/fscan/Config"
"gopkg.in/yaml.v3"
"net"
"strconv"
@@ -15,7 +14,7 @@ import (
var errNetBIOS = errors.New("netbios error")
func NetBIOS(info *Config.HostInfo) error {
func NetBIOS(info *Common.HostInfo) error {
fmt.Println("[+] NetBIOS扫描模块开始...")
netbios, _ := NetBIOS1(info)
output := netbios.String()
@@ -28,7 +27,7 @@ func NetBIOS(info *Config.HostInfo) error {
return errNetBIOS
}
func NetBIOS1(info *Config.HostInfo) (netbios NetBiosInfo, err error) {
func NetBIOS1(info *Common.HostInfo) (netbios NetBiosInfo, err error) {
netbios, err = GetNbnsname(info)
var payload0 []byte
if netbios.ServerService != "" || netbios.WorkstationService != "" {
@@ -87,7 +86,7 @@ func NetBIOS1(info *Config.HostInfo) (netbios NetBiosInfo, err error) {
return
}
func GetNbnsname(info *Config.HostInfo) (netbios NetBiosInfo, err error) {
func GetNbnsname(info *Common.HostInfo) (netbios NetBiosInfo, err error) {
senddata1 := []byte{102, 102, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 32, 67, 75, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 0, 0, 33, 0, 1}
//senddata1 := []byte("ff\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x00\x00!\x00\x01")
realhost := fmt.Sprintf("%s:137", info.Host)
Plugins/Oracle.go
+2 -3
View File
@@ -4,14 +4,13 @@ import (
"database/sql"
"fmt"
"github.com/shadow1ng/fscan/Common"
"github.com/shadow1ng/fscan/Config"
_ "github.com/sijms/go-ora/v2"
"strings"
"time"
)
// OracleScan 执行Oracle服务扫描
func OracleScan(info *Config.HostInfo) (tmperr error) {
func OracleScan(info *Common.HostInfo) (tmperr error) {
if Common.IsBrute {
return
}
@@ -50,7 +49,7 @@ func OracleScan(info *Config.HostInfo) (tmperr error) {
}
// OracleConn 尝试Oracle连接
func OracleConn(info *Config.HostInfo, user string, pass string) (bool, error) {
func OracleConn(info *Common.HostInfo, user string, pass string) (bool, error) {
host, port, username, password := info.Host, info.Ports, user, pass
timeout := time.Duration(Common.Timeout) * time.Second
Plugins/Postgres.go
+2 -3
View File
@@ -5,13 +5,12 @@ import (
"fmt"
_ "github.com/lib/pq"
"github.com/shadow1ng/fscan/Common"
"github.com/shadow1ng/fscan/Config"
"strings"
"time"
)
// PostgresScan 执行PostgreSQL服务扫描
func PostgresScan(info *Config.HostInfo) (tmperr error) {
func PostgresScan(info *Common.HostInfo) (tmperr error) {
if Common.IsBrute {
return
}
@@ -50,7 +49,7 @@ func PostgresScan(info *Config.HostInfo) (tmperr error) {
}
// PostgresConn 尝试PostgreSQL连接
func PostgresConn(info *Config.HostInfo, user string, pass string) (bool, error) {
func PostgresConn(info *Common.HostInfo, user string, pass string) (bool, error) {
host, port, username, password := info.Host, info.Ports, user, pass
timeout := time.Duration(Common.Timeout) * time.Second
Plugins/RDP.go
+1 -2
View File
@@ -4,7 +4,6 @@ import (
"errors"
"fmt"
"github.com/shadow1ng/fscan/Common"
"github.com/shadow1ng/fscan/Config"
"github.com/tomatome/grdp/core"
"github.com/tomatome/grdp/glog"
"github.com/tomatome/grdp/protocol/nla"
@@ -30,7 +29,7 @@ type Brutelist struct {
}
// RdpScan 执行RDP服务扫描
func RdpScan(info *Config.HostInfo) (tmperr error) {
func RdpScan(info *Common.HostInfo) (tmperr error) {
if Common.IsBrute {
return
}
Plugins/Redis.go
+3 -4
View File
@@ -4,7 +4,6 @@ import (
"bufio"
"fmt"
"github.com/shadow1ng/fscan/Common"
"github.com/shadow1ng/fscan/Config"
"io"
"net"
"os"
@@ -18,7 +17,7 @@ var (
)
// RedisScan 执行Redis服务扫描
func RedisScan(info *Config.HostInfo) (tmperr error) {
func RedisScan(info *Common.HostInfo) (tmperr error) {
fmt.Println("[+] Redis扫描模块开始...")
starttime := time.Now().Unix()
@@ -60,7 +59,7 @@ func RedisScan(info *Config.HostInfo) (tmperr error) {
}
// RedisConn 尝试Redis连接
func RedisConn(info *Config.HostInfo, pass string) (bool, error) {
func RedisConn(info *Common.HostInfo, pass string) (bool, error) {
realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
// 建立TCP连接
@@ -108,7 +107,7 @@ func RedisConn(info *Config.HostInfo, pass string) (bool, error) {
}
// RedisUnauth 尝试Redis未授权访问检测
func RedisUnauth(info *Config.HostInfo) (flag bool, err error) {
func RedisUnauth(info *Common.HostInfo) (flag bool, err error) {
flag = false
realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
Plugins/SMB.go
+3 -4
View File
@@ -4,14 +4,13 @@ import (
"errors"
"fmt"
"github.com/shadow1ng/fscan/Common"
"github.com/shadow1ng/fscan/Config"
"github.com/stacktitan/smb/smb"
"strings"
"time"
)
// SmbScan 执行SMB服务的认证扫描
func SmbScan(info *Config.HostInfo) (tmperr error) {
func SmbScan(info *Common.HostInfo) (tmperr error) {
// 如果未启用暴力破解则直接返回
if Common.IsBrute {
return nil
@@ -67,7 +66,7 @@ func SmbScan(info *Config.HostInfo) (tmperr error) {
}
// SmblConn 尝试建立SMB连接并进行认证
func SmblConn(info *Config.HostInfo, user string, pass string, signal chan struct{}) (flag bool, err error) {
func SmblConn(info *Common.HostInfo, user string, pass string, signal chan struct{}) (flag bool, err error) {
flag = false
// 配置SMB连接选项
@@ -95,7 +94,7 @@ func SmblConn(info *Config.HostInfo, user string, pass string, signal chan struc
}
// doWithTimeOut 执行带超时的SMB连接认证
func doWithTimeOut(info *Config.HostInfo, user string, pass string) (flag bool, err error) {
func doWithTimeOut(info *Common.HostInfo, user string, pass string) (flag bool, err error) {
signal := make(chan struct{})
// 在goroutine中执行SMB连接
Plugins/SMB2.go
+7 -8
View File
@@ -3,7 +3,6 @@ package Plugins
import (
"fmt"
"github.com/shadow1ng/fscan/Common"
"github.com/shadow1ng/fscan/Config"
"net"
"os"
"strings"
@@ -13,7 +12,7 @@ import (
)
// SmbScan2 执行SMB2服务的认证扫描，支持密码和哈希两种认证方式
func SmbScan2(info *Config.HostInfo) (tmperr error) {
func SmbScan2(info *Common.HostInfo) (tmperr error) {
// 如果未启用暴力破解则直接返回
if Common.IsBrute {
@@ -34,7 +33,7 @@ func SmbScan2(info *Config.HostInfo) (tmperr error) {
}
// smbHashScan 使用哈希进行认证扫描
func smbHashScan(info *Config.HostInfo, hasprint bool, startTime int64) error {
func smbHashScan(info *Common.HostInfo, hasprint bool, startTime int64) error {
for _, user := range Common.Userdict["smb"] {
for _, hash := range Common.HashBytes {
success, err, printed := Smb2Con(info, user, "", hash, hasprint)
@@ -63,7 +62,7 @@ func smbHashScan(info *Config.HostInfo, hasprint bool, startTime int64) error {
}
// smbPasswordScan 使用密码进行认证扫描
func smbPasswordScan(info *Config.HostInfo, hasprint bool, startTime int64) error {
func smbPasswordScan(info *Common.HostInfo, hasprint bool, startTime int64) error {
for _, user := range Common.Userdict["smb"] {
for _, pass := range Common.Passwords {
pass = strings.ReplaceAll(pass, "{user}", user)
@@ -93,7 +92,7 @@ func smbPasswordScan(info *Config.HostInfo, hasprint bool, startTime int64) erro
}
// logSuccessfulAuth 记录成功的认证
func logSuccessfulAuth(info *Config.HostInfo, user, pass string, hash []byte) {
func logSuccessfulAuth(info *Common.HostInfo, user, pass string, hash []byte) {
var result string
if Common.Domain != "" {
result = fmt.Sprintf("[✓] SMB2认证成功 %v:%v Domain:%v\\%v ",
@@ -112,7 +111,7 @@ func logSuccessfulAuth(info *Config.HostInfo, user, pass string, hash []byte) {
}
// logFailedAuth 记录失败的认证
func logFailedAuth(info *Config.HostInfo, user, pass string, hash []byte, err error) {
func logFailedAuth(info *Common.HostInfo, user, pass string, hash []byte, err error) {
var errlog string
if len(hash) > 0 {
errlog = fmt.Sprintf("[x] SMB2认证失败 %v:%v User:%v Hash:%v Err:%v",
@@ -139,7 +138,7 @@ func shouldStopScan(err error, startTime int64, totalAttempts int) bool {
}
// Smb2Con 尝试SMB2连接并进行认证，检查共享访问权限
func Smb2Con(info *Config.HostInfo, user string, pass string, hash []byte, hasprint bool) (flag bool, err error, flag2 bool) {
func Smb2Con(info *Common.HostInfo, user string, pass string, hash []byte, hasprint bool) (flag bool, err error, flag2 bool) {
// 建立TCP连接
conn, err := net.DialTimeout("tcp", fmt.Sprintf("%s:445", info.Host),
time.Duration(Common.Timeout)*time.Second)
@@ -202,7 +201,7 @@ func Smb2Con(info *Config.HostInfo, user string, pass string, hash []byte, haspr
}
// logShareInfo 记录SMB共享信息
func logShareInfo(info *Config.HostInfo, user string, pass string, hash []byte, shares []string) {
func logShareInfo(info *Common.HostInfo, user string, pass string, hash []byte, shares []string) {
var result string
// 构建基础信息
Plugins/SSH.go
+2 -3
View File
@@ -3,7 +3,6 @@ package Plugins
import (
"fmt"
"github.com/shadow1ng/fscan/Common"
"github.com/shadow1ng/fscan/Config"
"golang.org/x/crypto/ssh"
"io/ioutil"
"net"
@@ -12,7 +11,7 @@ import (
)
// SshScan 执行SSH服务的认证扫描
func SshScan(info *Config.HostInfo) (tmperr error) {
func SshScan(info *Common.HostInfo) (tmperr error) {
if Common.IsBrute {
return
}
@@ -59,7 +58,7 @@ func SshScan(info *Config.HostInfo) (tmperr error) {
}
// SshConn 尝试建立SSH连接并进行认证
func SshConn(info *Config.HostInfo, user string, pass string) (flag bool, err error) {
func SshConn(info *Common.HostInfo, user string, pass string) (flag bool, err error) {
// 准备认证方法
var auth []ssh.AuthMethod
if Common.SshKey != "" {
Plugins/SmbGhost.go
+2 -3
View File
@@ -3,7 +3,6 @@ package Plugins
import (
"bytes"
"fmt"
"github.com/shadow1ng/fscan/Config"
"time"
"github.com/shadow1ng/fscan/Common"
@@ -96,7 +95,7 @@ const (
)
// SmbGhost 检测SMB Ghost漏洞(CVE-2020-0796)的入口函数
func SmbGhost(info *Config.HostInfo) error {
func SmbGhost(info *Common.HostInfo) error {
// 如果开启了暴力破解模式，跳过该检测
if Common.IsBrute {
return nil
@@ -110,7 +109,7 @@ func SmbGhost(info *Config.HostInfo) error {
}
// SmbGhostScan 执行具体的SMB Ghost漏洞检测逻辑
func SmbGhostScan(info *Config.HostInfo) error {
func SmbGhostScan(info *Common.HostInfo) error {
// 设置扫描参数
ip := info.Host
port := 445 // SMB服务默认端口
Plugins/WMIExec.go
+2 -3
View File
@@ -4,7 +4,6 @@ import (
"errors"
"fmt"
"github.com/shadow1ng/fscan/Common"
"github.com/shadow1ng/fscan/Config"
"os"
"strings"
"time"
@@ -33,7 +32,7 @@ func init() {
}
// WmiExec 执行WMI远程命令
func WmiExec(info *Config.HostInfo) (tmperr error) {
func WmiExec(info *Common.HostInfo) (tmperr error) {
// 如果是暴力破解模式则跳过
if Common.IsBrute {
return nil
@@ -98,7 +97,7 @@ func WmiExec(info *Config.HostInfo) (tmperr error) {
}
// Wmiexec 包装WMI执行函数
func Wmiexec(info *Config.HostInfo, user string, pass string, hash string) (flag bool, err error) {
func Wmiexec(info *Common.HostInfo, user string, pass string, hash string) (flag bool, err error) {
target := fmt.Sprintf("%s:%v", info.Host, info.Ports)
wmiexec.Timeout = int(Common.Timeout)
return WMIExec(target, user, pass, hash, Common.Domain, Common.Command, ClientHost, "", nil)
Plugins/WebTitle.go
+3 -4
View File
@@ -4,7 +4,6 @@ import (
"compress/gzip"
"crypto/tls"
"fmt"
"github.com/shadow1ng/fscan/Config"
"io"
"net/http"
"net/url"
@@ -20,7 +19,7 @@ import (
)
// WebTitle 获取Web标题并执行扫描
func WebTitle(info *Config.HostInfo) error {
func WebTitle(info *Common.HostInfo) error {
// 如果是webpoc扫描模式，直接执行WebScan
if Common.Scantype == "webpoc" {
WebScan.WebScan(info)
@@ -52,7 +51,7 @@ func WebTitle(info *Config.HostInfo) error {
}
// GOWebTitle 获取网站标题并处理URL
func GOWebTitle(info *Config.HostInfo) (err error, CheckData []WebScan.CheckDatas) {
func GOWebTitle(info *Common.HostInfo) (err error, CheckData []WebScan.CheckDatas) {
// 如果URL未指定，根据端口生成URL
if info.Url == "" {
switch info.Ports {
@@ -120,7 +119,7 @@ func GOWebTitle(info *Config.HostInfo) (err error, CheckData []WebScan.CheckData
// - error: 错误信息
// - string: 重定向URL或协议
// - []WebScan.CheckDatas: 更新后的检查数据
func geturl(info *Config.HostInfo, flag int, CheckData []WebScan.CheckDatas) (error, string, []WebScan.CheckDatas) {
func geturl(info *Common.HostInfo, flag int, CheckData []WebScan.CheckDatas) (error, string, []WebScan.CheckDatas) {
// 处理目标URL
Url := info.Url
if flag == 2 {
Plugins/fcgiscan.go
+1 -2
View File
@@ -7,7 +7,6 @@ import (
"errors"
"fmt"
"github.com/shadow1ng/fscan/Common"
"github.com/shadow1ng/fscan/Config"
"io"
"strconv"
"strings"
@@ -20,7 +19,7 @@ import (
//https://github.com/wofeiwo/webcgi-exploits
// FcgiScan 执行FastCGI服务器漏洞扫描
func FcgiScan(info *Config.HostInfo) error {
func FcgiScan(info *Common.HostInfo) error {
// 如果设置了暴力破解模式则跳过
if Common.IsBrute {
return nil