archive/fscan
1
0
Fork 0
mirror of https://github.com/shadow1ng/fscan.git synced 2026-09-25 04:31:52 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

更新指纹、优化内存占用

Browse Source
This commit is contained in:
影舞者
2021-09-10 20:32:51 +08:00
parent 2e452a9695
commit d5665f03d6
20 changed files with 265 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Plugins/CVE-2020-0796.go
+5 -1
View File
@@ -104,6 +104,11 @@ func SmbGhostScan(info *common.HostInfo) error {
ip, port, timeout := info.Host, 445, time.Duration(info.Timeout)*time.Second
addr := fmt.Sprintf("%s:%v", info.Host, port)
conn, err := net.DialTimeout("tcp", addr, timeout)
defer func() {
if conn != nil{
conn.Close()
}
}()
if err != nil {
return err
}
@@ -117,7 +122,6 @@ func SmbGhostScan(info *common.HostInfo) error {
if err != nil {
return err
}
defer conn.Close()
if bytes.Contains(buff[:n], []byte("Public")) == true {
result := fmt.Sprintf("[+] %v CVE-2020-0796 SmbGhost Vulnerable", ip)
common.LogSuccess(result)
Plugins/NetBIOS.go
+10 -2
View File
@@ -76,6 +76,11 @@ func NetBIOS1(info *common.HostInfo) (nbname NbnsName, err error) {
}
realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
conn, err := net.DialTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
defer func() {
if conn != nil{
conn.Close()
}
}()
if err != nil {
return
}
@@ -83,7 +88,6 @@ func NetBIOS1(info *common.HostInfo) (nbname NbnsName, err error) {
if err != nil {
return
}
defer conn.Close()
if info.Ports == "139" && len(payload0) > 0 {
_, err1 := conn.Write(payload0)
@@ -191,6 +195,11 @@ func GetNbnsname(info *common.HostInfo) (nbname NbnsName, err error) {
senddata1 := []byte{102, 102, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 32, 67, 75, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 0, 0, 33, 0, 1}
realhost := fmt.Sprintf("%s:%v", info.Host, 137)
conn, err := net.DialTimeout("udp", realhost, time.Duration(info.Timeout)*time.Second)
defer func() {
if conn != nil{
conn.Close()
}
}()
if err != nil {
return
}
@@ -198,7 +207,6 @@ func GetNbnsname(info *common.HostInfo) (nbname NbnsName, err error) {
if err != nil {
return
}
defer conn.Close()
_, err = conn.Write(senddata1)
if err != nil {
return
Plugins/fcgiscan.go
+5
View File
@@ -53,6 +53,11 @@ func FcgiScan(info *common.HostInfo) {
}
fcgi, err := New(addr, info.Timeout)
defer func() {
if fcgi.rwc != nil{
fcgi.rwc.Close()
}
}()
if err != nil {
errlog := fmt.Sprintf("[-] fcgi %v:%v %v", info.Host, info.Ports, err)
common.LogError(errlog)
Plugins/findnet.go
+5 -1
View File
@@ -24,6 +24,11 @@ func Findnet(info *common.HostInfo) error {
func FindnetScan(info *common.HostInfo) error {
realhost := fmt.Sprintf("%s:%v", info.Host, 135)
conn, err := net.DialTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
defer func() {
if conn != nil{
conn.Close()
}
}()
if err != nil {
return err
}
@@ -31,7 +36,6 @@ func FindnetScan(info *common.HostInfo) error {
if err != nil {
return err
}
defer conn.Close()
_, err = conn.Write(bufferV1)
if err != nil {
return err
Plugins/icmp.go
+10 -2
View File
@@ -51,8 +51,12 @@ func ICMPRun(hostslist []string, Ping bool) []string {
common.LogError(err)
//尝试无监听icmp探测
conn, err := net.DialTimeout("ip4:icmp", "127.0.0.1", 3*time.Second)
defer func() {
if conn != nil{
conn.Close()
}
}()
if err == nil {
go conn.Close()
RunIcmp2(hostslist, chanHosts)
} else {
common.LogError(err)
@@ -138,10 +142,14 @@ func RunIcmp2(hostslist []string, chanHosts chan string) {
func icmpalive(host string) bool {
startTime := time.Now()
conn, err := net.DialTimeout("ip4:icmp", host, 6*time.Second)
defer func() {
if conn != nil{
conn.Close()
}
}()
if err != nil {
return false
}
defer conn.Close()
if err := conn.SetDeadline(startTime.Add(6 * time.Second)); err != nil {
return false
}
Plugins/memcached.go
+5 -1
View File
@@ -11,6 +11,11 @@ import (
func MemcachedScan(info *common.HostInfo) (err error) {
realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
client, err := net.DialTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
defer func() {
if client != nil{
client.Close()
}
}()
if err == nil {
err = client.SetDeadline(time.Now().Add(time.Duration(info.Timeout) * time.Second))
if err == nil {
@@ -23,7 +28,6 @@ func MemcachedScan(info *common.HostInfo) (err error) {
result := fmt.Sprintf("[+] Memcached %s unauthorized", realhost)
common.LogSuccess(result)
}
client.Close()
} else {
errlog := fmt.Sprintf("[-] Memcached %v:%v %v", info.Host, info.Ports, err)
common.LogError(errlog)
Plugins/mongodb.go
+5 -1
View File
@@ -24,10 +24,14 @@ func MongodbUnauth(info *common.HostInfo) (flag bool, err error) {
getlogdata := []byte{72, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 212, 7, 0, 0, 0, 0, 0, 0, 97, 100, 109, 105, 110, 46, 36, 99, 109, 100, 0, 0, 0, 0, 0, 1, 0, 0, 0, 33, 0, 0, 0, 2, 103, 101, 116, 76, 111, 103, 0, 16, 0, 0, 0, 115, 116, 97, 114, 116, 117, 112, 87, 97, 114, 110, 105, 110, 103, 115, 0, 0}
realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
conn, err := net.DialTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
defer func() {
if conn != nil{
conn.Close()
}
}()
if err != nil {
return flag, err
}
defer conn.Close()
err = conn.SetReadDeadline(time.Now().Add(time.Duration(info.Timeout)*time.Second))
if err != nil {
return flag, err
Plugins/ms17017.go
+5 -2
View File
@@ -29,15 +29,18 @@ func MS17010(info *common.HostInfo) error {
}
func MS17010Scan(info *common.HostInfo) error {
ip := info.Host
// connecting to a host in LAN if reachable should be very quick
conn, err := net.DialTimeout("tcp", ip+":445", time.Duration(info.Timeout)*time.Second)
defer func() {
if conn != nil{
conn.Close()
}
}()
if err != nil {
//fmt.Printf("failed to connect to %s\n", ip)
return err
}
defer conn.Close()
err = conn.SetDeadline(time.Now().Add(time.Duration(info.Timeout) * time.Second))
if err != nil {
//fmt.Printf("failed to connect to %s\n", ip)
Plugins/portscan.go
+7 -3
View File
@@ -71,13 +71,17 @@ func PortScan(hostslist []string, ports string, timeout int64) []string {
func PortConnect(addr Addr, respondingHosts chan<- string, adjustedTimeout int64, wg *sync.WaitGroup) {
host, port := addr.ip, addr.port
con, err := net.DialTimeout("tcp4", fmt.Sprintf("%s:%v", host, port), time.Duration(adjustedTimeout)*time.Second)
conn, err := net.DialTimeout("tcp4", fmt.Sprintf("%s:%v", host, port), time.Duration(adjustedTimeout)*time.Second)
defer func() {
if conn != nil{
conn.Close()
}
}()
if err == nil {
con.Close()
address := host + ":" + strconv.Itoa(port)
result := fmt.Sprintf("%s open", address)
common.LogSuccess(result)
respondingHosts <- address
wg.Add(1)
respondingHosts <- address
}
}
Plugins/redis.go
+29 -13
View File
@@ -10,6 +10,11 @@ import (
"time"
)
var (
dbfilename string
dir string
)
func RedisScan(info *common.HostInfo) (tmperr error) {
starttime := time.Now().Unix()
flag, err := RedisUnauth(info)
@@ -57,9 +62,16 @@ func RedisConn(info *common.HostInfo, pass string) (flag bool, err error) {
return flag, err
}
if strings.Contains(reply, "+OK") {
result := fmt.Sprintf("[+] Redis:%s %s", realhost, pass)
common.LogSuccess(result)
flag = true
dbfilename, dir, err = getconfig(conn)
if err != nil {
result := fmt.Sprintf("[+] Redis:%s %s", realhost, pass)
common.LogSuccess(result)
return flag,err
}else {
result := fmt.Sprintf("[+] Redis:%s %s file:%s/%s", realhost, pass, dir, dbfilename)
common.LogSuccess(result)
}
err = Expoilt(realhost, conn)
}
return flag, err
@@ -86,19 +98,22 @@ func RedisUnauth(info *common.HostInfo) (flag bool, err error) {
return flag, err
}
if strings.Contains(reply, "redis_version") {
result := fmt.Sprintf("[+] Redis:%s unauthorized", realhost)
common.LogSuccess(result)
flag = true
dbfilename, dir, err = getconfig(conn)
if err != nil {
result := fmt.Sprintf("[+] Redis:%s unauthorized", realhost)
common.LogSuccess(result)
return flag,err
}else {
result := fmt.Sprintf("[+] Redis:%s unauthorized file:%s/%s", realhost,dir,dbfilename)
common.LogSuccess(result)
}
err = Expoilt(realhost, conn)
}
return flag, err
}
func Expoilt(realhost string, conn net.Conn) error {
dbfilename, dir, err := getconfig(conn)
if err != nil {
return err
}
flagSsh, flagCron, err := testwrite(conn)
if err != nil {
return err
@@ -116,7 +131,7 @@ func Expoilt(realhost string, conn net.Conn) error {
result := fmt.Sprintf("[+] %v SSH public key was written successfully", realhost)
common.LogSuccess(result)
} else {
fmt.Println("Redis:", realhost, "SSHPUB write failed", text)
fmt.Println("[-] Redis:", realhost, "SSHPUB write failed", text)
}
}
}
@@ -268,14 +283,15 @@ func Readfile(filename string) (string, error) {
}
func readreply(conn net.Conn) (result string, err error) {
buf := make([]byte, 4096)
size := 5 * 1024
buf := make([]byte, size)
for {
count, err := conn.Read(buf)
if err != nil {
break
}
result += string(buf[0:count])
if count < 4096 {
if count < size {
break
}
}
@@ -318,7 +334,7 @@ func getconfig(conn net.Conn) (dbfilename string, dir string, err error) {
if err != nil {
return
}
text1 := strings.Split(text, "\n")
text1 := strings.Split(text, "\r\n")
if len(text1) > 2 {
dbfilename = text1[len(text1)-2]
} else {
@@ -332,7 +348,7 @@ func getconfig(conn net.Conn) (dbfilename string, dir string, err error) {
if err != nil {
return
}
text1 = strings.Split(text, "\n")
text1 = strings.Split(text, "\r\n")
if len(text1) > 2 {
dir = text1[len(text1)-2]
} else {
Plugins/smb.go
+2 -1
View File
@@ -1,6 +1,7 @@
package Plugins
import (
"errors"
"fmt"
"github.com/shadow1ng/fscan/common"
"github.com/stacktitan/smb/smb"
@@ -72,6 +73,6 @@ func doWithTimeOut(info *common.HostInfo, user string, pass string) (flag bool,
case <-signal:
return flag, err
case <-time.After(time.Duration(info.Timeout) * time.Second):
return false, err
return false,errors.New("time out")
}
}
Plugins/webtitle.go
+5 -6
View File
@@ -8,7 +8,6 @@ import (
"github.com/shadow1ng/fscan/WebScan"
"github.com/shadow1ng/fscan/WebScan/lib"
"github.com/shadow1ng/fscan/common"
"golang.org/x/net/html/charset"
"golang.org/x/text/encoding/simplifiedchinese"
"golang.org/x/text/transform"
"io"
@@ -56,6 +55,7 @@ func GOWebTitle(info *common.HostInfo) error {
if err != nil && !strings.Contains(err.Error(), "EOF") {
return err
}
if strings.Contains(result, "://") {
//有跳转
redirecturl, err := url.Parse(result)
@@ -174,14 +174,14 @@ func geturl(info *common.HostInfo, flag int, CheckData []WebScan.CheckDatas) (er
return ""
}
encode := GetEncoding()
_, encode1, _ := charset.DetermineEncoding(body, "")
//_, encode1, _ := charset.DetermineEncoding(body, "")
var encode2 string
detector := chardet.NewTextDetector()
detectorstr, _ := detector.DetectBest(body)
if detectorstr != nil {
encode2 = detectorstr.Charset
}
if encode == "gbk" || encode == "gb2312" || encode1 == "gbk" || strings.Contains(strings.ToLower(encode2), "gb") {
if encode == "gbk" || encode == "gb2312" || strings.Contains(strings.ToLower(encode2), "gb") {
titleGBK, err := Decodegbk(text)
if err == nil {
title = string(titleGBK)
@@ -204,9 +204,9 @@ func geturl(info *common.HostInfo, flag int, CheckData []WebScan.CheckDatas) (er
}
length := resp.Header.Get("Content-Length")
if length == "" {
length = fmt.Sprintf("%v", len(text))
length = fmt.Sprintf("%v", len(body))
}
result := fmt.Sprintf("[*] WebTitle:%-25v code:%-3v len:%-6v title:%v", Url, resp.StatusCode, length, title)
result := fmt.Sprintf("[*] WebTitle:%-25v code:%-3v len:%-6v title:%v", resp.Request.URL, resp.StatusCode, length, title)
common.LogSuccess(result)
}
CheckData = append(CheckData, WebScan.CheckDatas{body, fmt.Sprintf("%s", resp.Header)})
@@ -258,7 +258,6 @@ func getRespBody(oResp *http.Response) ([]byte, error) {
if err != nil {
return nil, err
}
defer oResp.Body.Close()
body = raw
}
return body, nil