Update release.yml

Fix #334

.github/conf/.goreleaser.yml

@@ -1,69 +1,55 @@
 before:
   hooks:
-    - sudo apt -y install libprotobuf-dev protobuf-compiler protoc-gen-go
     - go mod tidy
-    - go generate ./...
 builds:
-  - id: "with-upx"
+  -
+    id: default
     env:
       - CGO_ENABLED=0
     goos:
-      - linux
       - windows
+      - linux
       - darwin
+      - freebsd
+      - solaris
     goarch:
       - amd64
-      - arm64
-      - arm
       - "386"
-    goarm:
-      - "6"
-      - "7"
-    flags:
-      - -trimpath
-    ldflags:
-      - -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{ .CommitDate }} -X main.builtBy=goreleaser
-    ignore:
-      - goos: windows
-        goarch: arm64
-      - goos: windows
-        goarch: arm
-      - goos: linux
-        goarch: mips64
-    hooks:
-       post: upx --best -f -q "{{ .Path }}"
-
-# UnknownExecutableFormatException
-# CantPackException: can't pack new-exe
-  - id: "without-upx"
-    env:
-      - CGO_ENABLED=0
-    goos:
-      - linux
-      - windows
-      - darwin
-    goarch:
-      - mips64
       - arm
+      - arm64
+      - mips
+      - mipsle
+      - mips64
     goarm:
       - "6"
       - "7"
     flags:
       - -trimpath
     ldflags:
-      - -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{ .CommitDate }} -X main.builtBy=goreleaser
+      - -s -w
-    ignore:
+upx:
-      - goos: linux
+  -
-        goarch: arm
+    ids: [ default ]
-
+    enabled: true
-
+    goos: ["windows", "linux"]
+    goarch: ["amd64", "386"]
+    compress: best
+#    lzma: true
+#    brute: true
 archives:
-  - replacements:
+  -
-      darwin: Darwin
+    format: binary
-      linux: Linux
+    allow_different_binary_count: true
-      windows: Windows
+    name_template: >-
-      386: i386
+      {{- .ProjectName }}
-      amd64: x86_64
+      {{- if eq .Os "darwin"}}_mac
+      {{- else if eq .Os "linux"}}
+      {{- else if eq .Os "windows"}}
+      {{- else }}_{{ .Os }}{{ end }}
+      {{- if eq .Arch "amd64" }}
+      {{- else if eq .Arch "386" }}32
+      {{- else }}_{{ .Arch }}{{ end }}
+      {{- if .Arm }}v{{ .Arm }}{{ end -}}
 checksum:
   name_template: 'checksums.txt'
 snapshot:
@@ -74,3 +60,5 @@ changelog:
     exclude:
       - '^docs:'
       - '^test:'
+      - "^*.md"
+      - "^*.ya?ml"

.github/workflows/release.yml

@@ -13,23 +13,31 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      -
+      - name: "Check out code"
-        name: Checkout
+        uses: actions/checkout@v3
-        uses: actions/checkout@v2
         with:
           fetch-depth: 0
-      -
+
-        name: Set up Go
+      - name: "Set up Go"
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v4
         with:
-          go-version: 1.19
+          go-version: 1.20.14
       -
-        name: Run GoReleaser
+        name: Install UPX
-        uses: goreleaser/goreleaser-action@v2
+        uses: crazy-max/ghaction-upx@v3
+        with:
+          install-only: true
+
+      - name: UPX version
+        run: upx --version
+
+      -
+        name: "Create release on GitHub"
+        uses: goreleaser/goreleaser-action@v4
         with:
           distribution: goreleaser
           version: latest
-          args: -f .github/conf/.goreleaser.yml
+          args: "release --clean -f .github/conf/.goreleaser.yml"
           workdir: .
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Plugins/CVE-2020-0796.go

@@ -106,10 +106,10 @@ func SmbGhostScan(info *common.HostInfo) error {
 	ip, port, timeout := info.Host, 445, time.Duration(common.Timeout)*time.Second
 	addr := fmt.Sprintf("%s:%v", info.Host, port)
 	conn, err := common.WrapperTcpWithTimeout("tcp", addr, timeout)
-	defer conn.Close()
 	if err != nil {
 		return err
 	}
+	defer conn.Close()
 	_, err = conn.Write([]byte(pkt))
 	if err != nil {
 		return err
@@ -117,13 +117,12 @@ func SmbGhostScan(info *common.HostInfo) error {
 	buff := make([]byte, 1024)
 	err = conn.SetReadDeadline(time.Now().Add(timeout))
 	n, err := conn.Read(buff)
-	if err != nil {
+	if err != nil || n == 0 {
 		return err
 	}
-	if bytes.Contains(buff[:n], []byte("Public")) == true {
+	if bytes.Contains(buff[:n], []byte("Public")) == true && len(buff[:n]) >= 76 && bytes.Equal(buff[72:74], []byte{0x11, 0x03}) && bytes.Equal(buff[74:76], []byte{0x02, 0x00}) {
 		result := fmt.Sprintf("[+] %v CVE-2020-0796 SmbGhost Vulnerable", ip)
 		common.LogSuccess(result)
-
 	}
 	return err
 }

Plugins/NetBIOS.go

@@ -41,10 +41,10 @@ func NetBIOS1(info *common.HostInfo) (netbios NetBiosInfo, err error) {
 	realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
 	var conn net.Conn
 	conn, err = common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(common.Timeout)*time.Second)
-	defer conn.Close()
 	if err != nil {
 		return
 	}
+	defer conn.Close()
 	err = conn.SetDeadline(time.Now().Add(time.Duration(common.Timeout) * time.Second))
 	if err != nil {
 		return
@@ -89,10 +89,10 @@ func GetNbnsname(info *common.HostInfo) (netbios NetBiosInfo, err error) {
 	//senddata1 := []byte("ff\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x00\x00!\x00\x01")
 	realhost := fmt.Sprintf("%s:137", info.Host)
 	conn, err := net.DialTimeout("udp", realhost, time.Duration(common.Timeout)*time.Second)
-	defer conn.Close()
 	if err != nil {
 		return
 	}
+	defer conn.Close()
 	err = conn.SetDeadline(time.Now().Add(time.Duration(common.Timeout) * time.Second))
 	if err != nil {
 		return

Plugins/fcgiscan.go

@@ -191,38 +191,38 @@ func New(addr string, timeout int64) (fcgi *FCGIClient, err error) {
 	return
 }
 
-func (this *FCGIClient) writeRecord(recType uint8, reqId uint16, content []byte) (err error) {
+func (c *FCGIClient) writeRecord(recType uint8, reqId uint16, content []byte) (err error) {
-	this.mutex.Lock()
+	c.mutex.Lock()
-	defer this.mutex.Unlock()
+	defer c.mutex.Unlock()
-	this.buf.Reset()
+	c.buf.Reset()
-	this.h.init(recType, reqId, len(content))
+	c.h.init(recType, reqId, len(content))
-	if err := binary.Write(&this.buf, binary.BigEndian, this.h); err != nil {
+	if err := binary.Write(&c.buf, binary.BigEndian, c.h); err != nil {
 		return err
 	}
-	if _, err := this.buf.Write(content); err != nil {
+	if _, err := c.buf.Write(content); err != nil {
 		return err
 	}
-	if _, err := this.buf.Write(pad[:this.h.PaddingLength]); err != nil {
+	if _, err := c.buf.Write(pad[:c.h.PaddingLength]); err != nil {
 		return err
 	}
-	_, err = this.rwc.Write(this.buf.Bytes())
+	_, err = c.rwc.Write(c.buf.Bytes())
 	return err
 }
 
-func (this *FCGIClient) writeBeginRequest(reqId uint16, role uint16, flags uint8) error {
+func (c *FCGIClient) writeBeginRequest(reqId uint16, role uint16, flags uint8) error {
 	b := [8]byte{byte(role >> 8), byte(role), flags}
-	return this.writeRecord(FCGI_BEGIN_REQUEST, reqId, b[:])
+	return c.writeRecord(FCGI_BEGIN_REQUEST, reqId, b[:])
 }
 
-func (this *FCGIClient) writeEndRequest(reqId uint16, appStatus int, protocolStatus uint8) error {
+func (c *FCGIClient) writeEndRequest(reqId uint16, appStatus int, protocolStatus uint8) error {
 	b := make([]byte, 8)
 	binary.BigEndian.PutUint32(b, uint32(appStatus))
 	b[4] = protocolStatus
-	return this.writeRecord(FCGI_END_REQUEST, reqId, b)
+	return c.writeRecord(FCGI_END_REQUEST, reqId, b)
 }
 
-func (this *FCGIClient) writePairs(recType uint8, reqId uint16, pairs map[string]string) error {
+func (c *FCGIClient) writePairs(recType uint8, reqId uint16, pairs map[string]string) error {
-	w := newWriter(this, recType, reqId)
+	w := newWriter(c, recType, reqId)
 	b := make([]byte, 8)
 	for k, v := range pairs {
 		n := encodeSize(b, uint32(len(k)))
@@ -324,21 +324,21 @@ func (w *streamWriter) Close() error {
 	return w.c.writeRecord(w.recType, w.reqId, nil)
 }
 
-func (this *FCGIClient) Request(env map[string]string, reqStr string) (retout []byte, reterr []byte, err error) {
+func (c *FCGIClient) Request(env map[string]string, reqStr string) (retout []byte, reterr []byte, err error) {
 
 	var reqId uint16 = 1
-	defer this.rwc.Close()
+	defer c.rwc.Close()
 
-	err = this.writeBeginRequest(reqId, uint16(FCGI_RESPONDER), 0)
+	err = c.writeBeginRequest(reqId, uint16(FCGI_RESPONDER), 0)
 	if err != nil {
 		return
 	}
-	err = this.writePairs(FCGI_PARAMS, reqId, env)
+	err = c.writePairs(FCGI_PARAMS, reqId, env)
 	if err != nil {
 		return
 	}
 	if len(reqStr) > 0 {
-		err = this.writeRecord(FCGI_STDIN, reqId, []byte(reqStr))
+		err = c.writeRecord(FCGI_STDIN, reqId, []byte(reqStr))
 		if err != nil {
 			return
 		}
@@ -349,7 +349,7 @@ func (this *FCGIClient) Request(env map[string]string, reqStr string) (retout []
 
 	// recive untill EOF or FCGI_END_REQUEST
 	for {
-		err1 = rec.read(this.rwc)
+		err1 = rec.read(c.rwc)
 		if err1 != nil {
 			if err1 != io.EOF {
 				err = err1

Plugins/findnet.go

@@ -24,10 +24,10 @@ func Findnet(info *common.HostInfo) error {
 func FindnetScan(info *common.HostInfo) error {
 	realhost := fmt.Sprintf("%s:%v", info.Host, 135)
 	conn, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(common.Timeout)*time.Second)
-	defer conn.Close()
 	if err != nil {
 		return err
 	}
+	defer conn.Close()
 	err = conn.SetDeadline(time.Now().Add(time.Duration(common.Timeout) * time.Second))
 	if err != nil {
 		return err

Plugins/ftp.go

@@ -17,7 +17,7 @@ func FtpScan(info *common.HostInfo) (tmperr error) {
 	if flag && err == nil {
 		return err
 	} else {
-		errlog := fmt.Sprintf("[-] ftp://%v:%v %v %v", info.Host, info.Ports, "anonymous", err)
+		errlog := fmt.Sprintf("[-] ftp %v:%v %v %v", info.Host, info.Ports, "anonymous", err)
 		common.LogError(errlog)
 		tmperr = err
 		if common.CheckErrs(err) {
@@ -32,7 +32,7 @@ func FtpScan(info *common.HostInfo) (tmperr error) {
 			if flag && err == nil {
 				return err
 			} else {
-				errlog := fmt.Sprintf("[-] ftp://%v:%v %v %v %v", info.Host, info.Ports, user, pass, err)
+				errlog := fmt.Sprintf("[-] ftp %v:%v %v %v %v", info.Host, info.Ports, user, pass, err)
 				common.LogError(errlog)
 				tmperr = err
 				if common.CheckErrs(err) {
@@ -55,7 +55,7 @@ func FtpConn(info *common.HostInfo, user string, pass string) (flag bool, err er
 		err = conn.Login(Username, Password)
 		if err == nil {
 			flag = true
-			result := fmt.Sprintf("[+] ftp://%v:%v:%v %v", Host, Port, Username, Password)
+			result := fmt.Sprintf("[+] ftp %v:%v:%v %v", Host, Port, Username, Password)
 			dirs, err := conn.List("")
 			//defer conn.Logout()
 			if err == nil {

Plugins/icmp.go

@@ -15,7 +15,6 @@ import (
 
 var (
 	AliveHosts []string
-	OS         = runtime.GOOS
 	ExistHosts = make(map[string]struct{})
 	livewg     sync.WaitGroup
 )
@@ -159,10 +158,10 @@ func RunIcmp2(hostslist []string, chanHosts chan string) {
 func icmpalive(host string) bool {
 	startTime := time.Now()
 	conn, err := net.DialTimeout("ip4:icmp", host, 6*time.Second)
-	defer conn.Close()
 	if err != nil {
 		return false
 	}
+	defer conn.Close()
 	if err := conn.SetDeadline(startTime.Add(6 * time.Second)); err != nil {
 		return false
 	}
@@ -180,17 +179,13 @@ func icmpalive(host string) bool {
 }
 
 func RunPing(hostslist []string, chanHosts chan string) {
-	var bsenv = ""
-	if OS != "windows" {
-		bsenv = "/bin/bash"
-	}
 	var wg sync.WaitGroup
 	limiter := make(chan struct{}, 50)
 	for _, host := range hostslist {
 		wg.Add(1)
 		limiter <- struct{}{}
 		go func(host string) {
-			if ExecCommandPing(host, bsenv) {
+			if ExecCommandPing(host) {
 				livewg.Add(1)
 				chanHosts <- host
 			}
@@ -201,14 +196,15 @@ func RunPing(hostslist []string, chanHosts chan string) {
 	wg.Wait()
 }
 
-func ExecCommandPing(ip string, bsenv string) bool {
+func ExecCommandPing(ip string) bool {
 	var command *exec.Cmd
-	if OS == "windows" {
+	switch runtime.GOOS {
+	case "windows":
 		command = exec.Command("cmd", "/c", "ping -n 1 -w 1 "+ip+" && echo true || echo false") //ping -c 1 -i 0.5 -t 4 -W 2 -w 5 "+ip+" >/dev/null && echo true || echo false"
-	} else if OS == "linux" {
+	case "darwin":
-		command = exec.Command(bsenv, "-c", "ping -c 1 -w 1 "+ip+" >/dev/null && echo true || echo false") //ping -c 1 -i 0.5 -t 4 -W 2 -w 5 "+ip+" >/dev/null && echo true || echo false"
+		command = exec.Command("/bin/bash", "-c", "ping -c 1 -W 1 "+ip+" && echo true || echo false") //ping -c 1 -i 0.5 -t 4 -W 2 -w 5 "+ip+" >/dev/null && echo true || echo false"
-	} else if OS == "darwin" {
+	default: //linux
-		command = exec.Command(bsenv, "-c", "ping -c 1 -W 1 "+ip+" >/dev/null && echo true || echo false") //ping -c 1 -i 0.5 -t 4 -W 2 -w 5 "+ip+" >/dev/null && echo true || echo false"
+		command = exec.Command("/bin/bash", "-c", "ping -c 1 -w 1 "+ip+" && echo true || echo false") //ping -c 1 -i 0.5 -t 4 -W 2 -w 5 "+ip+" >/dev/null && echo true || echo false"
 	}
 	outinfo := bytes.Buffer{}
 	command.Stdout = &outinfo
@@ -219,7 +215,7 @@ func ExecCommandPing(ip string, bsenv string) bool {
 	if err = command.Wait(); err != nil {
 		return false
 	} else {
-		if strings.Contains(outinfo.String(), "true") {
+		if strings.Contains(outinfo.String(), "true") && strings.Count(outinfo.String(), ip) > 2 {
 			return true
 		} else {
 			return false

Plugins/ms17010.go

@@ -39,11 +39,11 @@ func MS17010Scan(info *common.HostInfo) error {
 	ip := info.Host
 	// connecting to a host in LAN if reachable should be very quick
 	conn, err := common.WrapperTcpWithTimeout("tcp", ip+":445", time.Duration(common.Timeout)*time.Second)
-	defer conn.Close()
 	if err != nil {
 		//fmt.Printf("failed to connect to %s\n", ip)
 		return err
 	}
+	defer conn.Close()
 	err = conn.SetDeadline(time.Now().Add(time.Duration(common.Timeout) * time.Second))
 	if err != nil {
 		//fmt.Printf("failed to connect to %s\n", ip)

Plugins/portscan.go

@@ -17,6 +17,10 @@ type Addr struct {
 func PortScan(hostslist []string, ports string, timeout int64) []string {
 	var AliveAddress []string
 	probePorts := common.ParsePort(ports)
+	if len(probePorts) == 0 {
+		fmt.Printf("[-] parse port %s error, please check your port format\n", ports)
+		return AliveAddress
+	}
 	noPorts := common.ParsePort(common.NoPorts)
 	if len(noPorts) > 0 {
 		temp := map[int]struct{}{}
@@ -36,8 +40,8 @@ func PortScan(hostslist []string, ports string, timeout int64) []string {
 		sort.Ints(probePorts)
 	}
 	workers := common.Threads
-	Addrs := make(chan Addr, len(hostslist)*len(probePorts))
+	Addrs := make(chan Addr, 100)
-	results := make(chan string, len(hostslist)*len(probePorts))
+	results := make(chan string, 100)
 	var wg sync.WaitGroup
 
 	//接收结果
@@ -74,8 +78,8 @@ func PortScan(hostslist []string, ports string, timeout int64) []string {
 func PortConnect(addr Addr, respondingHosts chan<- string, adjustedTimeout int64, wg *sync.WaitGroup) {
 	host, port := addr.ip, addr.port
 	conn, err := common.WrapperTcpWithTimeout("tcp4", fmt.Sprintf("%s:%v", host, port), time.Duration(adjustedTimeout)*time.Second)
-	defer conn.Close()
 	if err == nil {
+		defer conn.Close()
 		address := host + ":" + strconv.Itoa(port)
 		result := fmt.Sprintf("%s open", address)
 		common.LogSuccess(result)

Plugins/rdp.go

@@ -36,21 +36,20 @@ func RdpScan(info *common.HostInfo) (tmperr error) {
 	var num = 0
 	var all = len(common.Userdict["rdp"]) * len(common.Passwords)
 	var mutex sync.Mutex
-	brlist := make(chan Brutelist, all)
+	brlist := make(chan Brutelist)
 	port, _ := strconv.Atoi(info.Ports)
 
+	for i := 0; i < common.BruteThread; i++ {
+		wg.Add(1)
+		go worker(info.Host, common.Domain, port, &wg, brlist, &signal, &num, all, &mutex, common.Timeout)
+	}
+
 	for _, user := range common.Userdict["rdp"] {
 		for _, pass := range common.Passwords {
 			pass = strings.Replace(pass, "{user}", user, -1)
 			brlist <- Brutelist{user, pass}
 		}
 	}
-
-	for i := 0; i < common.BruteThread; i++ {
-		wg.Add(1)
-		go worker(info.Host, common.Domain, port, &wg, brlist, &signal, &num, all, &mutex, common.Timeout)
-	}
-
 	close(brlist)
 	go func() {
 		wg.Wait()
@@ -127,10 +126,10 @@ func NewClient(host string, logLevel glog.LEVEL) *Client {
 
 func (g *Client) Login(domain, user, pwd string, timeout int64) error {
 	conn, err := common.WrapperTcpWithTimeout("tcp", g.Host, time.Duration(timeout)*time.Second)
-	defer conn.Close()
 	if err != nil {
 		return fmt.Errorf("[dial err] %v", err)
 	}
+	defer conn.Close()
 	glog.Info(conn.LocalAddr().String())
 
 	g.tpkt = tpkt.New(core.NewSocketLayer(conn), nla.NewNTLMv2(domain, user, pwd))

Plugins/redis.go

@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"fmt"
 	"github.com/shadow1ng/fscan/common"
+	"io"
 	"net"
 	"os"
 	"strings"
@@ -48,10 +49,10 @@ func RedisConn(info *common.HostInfo, pass string) (flag bool, err error) {
 	flag = false
 	realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
 	conn, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(common.Timeout)*time.Second)
-	defer conn.Close()
 	if err != nil {
 		return flag, err
 	}
+	defer conn.Close()
 	err = conn.SetReadDeadline(time.Now().Add(time.Duration(common.Timeout) * time.Second))
 	if err != nil {
 		return flag, err
@@ -84,10 +85,10 @@ func RedisUnauth(info *common.HostInfo) (flag bool, err error) {
 	flag = false
 	realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
 	conn, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(common.Timeout)*time.Second)
-	defer conn.Close()
 	if err != nil {
 		return flag, err
 	}
+	defer conn.Close()
 	err = conn.SetReadDeadline(time.Now().Add(time.Duration(common.Timeout) * time.Second))
 	if err != nil {
 		return flag, err
@@ -117,6 +118,9 @@ func RedisUnauth(info *common.HostInfo) (flag bool, err error) {
 }
 
 func Expoilt(realhost string, conn net.Conn) error {
+	if common.Noredistest {
+		return nil
+	}
 	flagSsh, flagCron, err := testwrite(conn)
 	if err != nil {
 		return err
@@ -220,7 +224,8 @@ func writekey(conn net.Conn, filename string) (flag bool, text string, err error
 
 func writecron(conn net.Conn, host string) (flag bool, text string, err error) {
 	flag = false
-	_, err = conn.Write([]byte("CONFIG SET dir /var/spool/cron/\r\n"))
+	// 尝试写入Ubuntu的路径
+	_, err = conn.Write([]byte("CONFIG SET dir /var/spool/cron/crontabs/\r\n"))
 	if err != nil {
 		return flag, text, err
 	}
@@ -228,6 +233,17 @@ func writecron(conn net.Conn, host string) (flag bool, text string, err error) {
 	if err != nil {
 		return flag, text, err
 	}
+	if !strings.Contains(text, "OK") {
+		// 如果没有返回"OK"，可能是CentOS，尝试CentOS的路径
+		_, err = conn.Write([]byte("CONFIG SET dir /var/spool/cron/\r\n"))
+		if err != nil {
+			return flag, text, err
+		}
+		text, err = readreply(conn)
+		if err != nil {
+			return flag, text, err
+		}
+	}
 	if strings.Contains(text, "OK") {
 		_, err = conn.Write([]byte("CONFIG SET dbfilename root\r\n"))
 		if err != nil {
@@ -289,20 +305,13 @@ func Readfile(filename string) (string, error) {
 	return "", err
 }
 
-func readreply(conn net.Conn) (result string, err error) {
+func readreply(conn net.Conn) (string, error) {
-	size := 5 * 1024
+	conn.SetReadDeadline(time.Now().Add(time.Second))
-	buf := make([]byte, size)
+	bytes, err := io.ReadAll(conn)
-	for {
+	if len(bytes) > 0 {
-		count, err := conn.Read(buf)
+		err = nil
-		if err != nil {
-			break
-		}
-		result += string(buf[0:count])
-		if count < size {
-			break
-		}
 	}
-	return result, err
+	return string(bytes), err
 }
 
 func testwrite(conn net.Conn) (flag bool, flagCron bool, err error) {

Plugins/scanner.go

@@ -17,13 +17,13 @@ func Scan(info common.HostInfo) {
 		fmt.Println("len(hosts)==0", err)
 		return
 	}
-	lib.Inithttp(common.Pocinfo)
+	lib.Inithttp()
 	var ch = make(chan struct{}, common.Threads)
 	var wg = sync.WaitGroup{}
 	web := strconv.Itoa(common.PORTList["web"])
 	ms17010 := strconv.Itoa(common.PORTList["ms17010"])
 	if len(Hosts) > 0 || len(common.HostPort) > 0 {
-		if common.NoPing == false && len(Hosts) > 0 {
+		if common.NoPing == false && len(Hosts) > 1 || common.Scantype == "icmp" {
 			Hosts = CheckLive(Hosts, common.Ping)
 			fmt.Println("[*] Icmp alive hosts len is:", len(Hosts))
 		}
@@ -33,12 +33,12 @@ func Scan(info common.HostInfo) {
 		}
 		var AlivePorts []string
 		if common.Scantype == "webonly" || common.Scantype == "webpoc" {
-			AlivePorts = NoPortScan(Hosts, info.Ports)
+			AlivePorts = NoPortScan(Hosts, common.Ports)
 		} else if common.Scantype == "hostname" {
-			info.Ports = "139"
+			common.Ports = "139"
-			AlivePorts = NoPortScan(Hosts, info.Ports)
+			AlivePorts = NoPortScan(Hosts, common.Ports)
 		} else if len(Hosts) > 0 {
-			AlivePorts = PortScan(Hosts, info.Ports, common.Timeout)
+			AlivePorts = PortScan(Hosts, common.Ports, common.Timeout)
 			fmt.Println("[*] alive ports len is:", len(AlivePorts))
 			if common.Scantype == "portscan" {
 				common.LogWG.Wait()
@@ -90,7 +90,7 @@ func Scan(info common.HostInfo) {
 	wg.Wait()
 	common.LogWG.Wait()
 	close(common.Results)
-	fmt.Println(fmt.Sprintf("已完成 %v/%v", common.End, common.Num))
+	fmt.Printf("已完成 %v/%v\n", common.End, common.Num)
 }
 
 var Mutex = &sync.Mutex{}
@@ -112,6 +112,11 @@ func AddScan(scantype string, info common.HostInfo, ch *chan struct{}, wg *sync.
 }
 
 func ScanFunc(name *string, info *common.HostInfo) {
+	defer func() {
+		if err := recover(); err != nil {
+			fmt.Printf("[-] %v:%v scan error: %v\n", info.Host, info.Ports, err)
+		}
+	}()
 	f := reflect.ValueOf(PluginList[*name])
 	in := []reflect.Value{reflect.ValueOf(info)}
 	f.Call(in)

Plugins/smb2.go

@@ -17,60 +17,106 @@ func SmbScan2(info *common.HostInfo) (tmperr error) {
 	}
 	hasprint := false
 	starttime := time.Now().Unix()
-	hash := common.HashBytes
+	if len(common.HashBytes) > 0 {
-	for _, user := range common.Userdict["smb"] {
+		for _, user := range common.Userdict["smb"] {
-	PASS:
+			for _, hash := range common.HashBytes {
-		for _, pass := range common.Passwords {
+				pass := ""
-			pass = strings.Replace(pass, "{user}", user, -1)
+				flag, err, flag2 := Smb2Con(info, user, pass, hash, hasprint)
-			flag, err, flag2 := Smb2Con(info, user, pass, hash, hasprint)
+				if flag2 {
-			if flag2 {
+					hasprint = true
-				hasprint = true
-			}
-			if flag == true {
-				var result string
-				if common.Domain != "" {
-					result = fmt.Sprintf("[+] SMB2 %v:%v:%v\\%v ", info.Host, info.Ports, common.Domain, user)
-				} else {
-					result = fmt.Sprintf("[+] SMB2 %v:%v:%v ", info.Host, info.Ports, user)
 				}
-				if len(hash) > 0 {
+				if flag == true {
-					result += "hash: " + common.Hash
+					var result string
+					if common.Domain != "" {
+						result = fmt.Sprintf("[+] SMB2 %v:%v:%v\\%v ", info.Host, info.Ports, common.Domain, user)
+					} else {
+						result = fmt.Sprintf("[+] SMB2 %v:%v:%v ", info.Host, info.Ports, user)
+					}
+					if len(hash) > 0 {
+						result += "hash: " + common.Hash
+					} else {
+						result += pass
+					}
+					common.LogSuccess(result)
+					return err
 				} else {
-					result += pass
+					var errlog string
+					if len(common.Hash) > 0 {
+						errlog = fmt.Sprintf("[-] smb2 %v:%v %v %v %v", info.Host, 445, user, common.Hash, err)
+					} else {
+						errlog = fmt.Sprintf("[-] smb2 %v:%v %v %v %v", info.Host, 445, user, pass, err)
+					}
+					errlog = strings.Replace(errlog, "\n", " ", -1)
+					common.LogError(errlog)
+					tmperr = err
+					if common.CheckErrs(err) {
+						return err
+					}
+					if time.Now().Unix()-starttime > (int64(len(common.Userdict["smb"])*len(common.HashBytes)) * common.Timeout) {
+						return err
+					}
 				}
-				common.LogSuccess(result)
-				return err
-			} else {
-				var errlog string
 				if len(common.Hash) > 0 {
-					errlog = fmt.Sprintf("[-] smb2 %v:%v %v %v %v", info.Host, 445, user, common.Hash, err)
+					break
-				} else {
-					errlog = fmt.Sprintf("[-] smb2 %v:%v %v %v %v", info.Host, 445, user, pass, err)
-				}
-				errlog = strings.Replace(errlog, "\n", " ", -1)
-				common.LogError(errlog)
-				tmperr = err
-				if common.CheckErrs(err) {
-					return err
-				}
-				if time.Now().Unix()-starttime > (int64(len(common.Userdict["smb"])*len(common.Passwords)) * common.Timeout) {
-					return err
 				}
 			}
-			if len(common.Hash) > 0 {
+		}
-				break PASS
+	} else {
+		for _, user := range common.Userdict["smb"] {
+			for _, pass := range common.Passwords {
+				pass = strings.Replace(pass, "{user}", user, -1)
+				hash := []byte{}
+				flag, err, flag2 := Smb2Con(info, user, pass, hash, hasprint)
+				if flag2 {
+					hasprint = true
+				}
+				if flag == true {
+					var result string
+					if common.Domain != "" {
+						result = fmt.Sprintf("[+] SMB2 %v:%v:%v\\%v ", info.Host, info.Ports, common.Domain, user)
+					} else {
+						result = fmt.Sprintf("[+] SMB2 %v:%v:%v ", info.Host, info.Ports, user)
+					}
+					if len(hash) > 0 {
+						result += "hash: " + common.Hash
+					} else {
+						result += pass
+					}
+					common.LogSuccess(result)
+					return err
+				} else {
+					var errlog string
+					if len(common.Hash) > 0 {
+						errlog = fmt.Sprintf("[-] smb2 %v:%v %v %v %v", info.Host, 445, user, common.Hash, err)
+					} else {
+						errlog = fmt.Sprintf("[-] smb2 %v:%v %v %v %v", info.Host, 445, user, pass, err)
+					}
+					errlog = strings.Replace(errlog, "\n", " ", -1)
+					common.LogError(errlog)
+					tmperr = err
+					if common.CheckErrs(err) {
+						return err
+					}
+					if time.Now().Unix()-starttime > (int64(len(common.Userdict["smb"])*len(common.Passwords)) * common.Timeout) {
+						return err
+					}
+				}
+				if len(common.Hash) > 0 {
+					break
+				}
 			}
 		}
 	}
+
 	return tmperr
 }
 
 func Smb2Con(info *common.HostInfo, user string, pass string, hash []byte, hasprint bool) (flag bool, err error, flag2 bool) {
 	conn, err := net.DialTimeout("tcp", info.Host+":445", time.Duration(common.Timeout)*time.Second)
-	defer conn.Close()
 	if err != nil {
 		return
 	}
+	defer conn.Close()
 	initiator := smb2.NTLMInitiator{
 		User:   user,
 		Domain: common.Domain,

Plugins/webtitle.go

@@ -25,8 +25,13 @@ func WebTitle(info *common.HostInfo) error {
 	}
 	err, CheckData := GOWebTitle(info)
 	info.Infostr = WebScan.InfoCheck(info.Url, &CheckData)
-
+	//不扫描打印机,避免打纸
-	if !common.NoWebCan && err == nil {
+	for _, v := range info.Infostr {
+		if v == "打印机" {
+			return nil
+		}
+	}
+	if !common.NoPoc && err == nil {
 		WebScan.WebScan(info)
 	} else {
 		errlog := fmt.Sprintf("[-] webtitle %v %v", info.Url, err)
@@ -137,12 +142,12 @@ func geturl(info *common.HostInfo, flag int, CheckData []WebScan.CheckDatas) (er
 	if err != nil {
 		return err, "https", CheckData
 	}
-	if !utf8.Valid(body) {
+	CheckData = append(CheckData, WebScan.CheckDatas{body, fmt.Sprintf("%s", resp.Header)})
-		body, _ = simplifiedchinese.GBK.NewDecoder().Bytes(body)
-	}
-	CheckData = append(CheckData, WebScan.CheckDatas{Body: body, Headers: fmt.Sprintf("%s", resp.Header)})
 	var reurl string
 	if flag != 2 {
+		if !utf8.Valid(body) {
+			body, _ = simplifiedchinese.GBK.NewDecoder().Bytes(body)
+		}
 		title = gettitle(body)
 		length := resp.Header.Get("Content-Length")
 		if length == "" {
@@ -197,7 +202,7 @@ func getRespBody(oResp *http.Response) ([]byte, error) {
 }
 
 func gettitle(body []byte) (title string) {
-	re := regexp.MustCompile("(?ims)<title>(.*?)</title>")
+	re := regexp.MustCompile("(?ims)<title.*?>(.*?)</title>")
 	find := re.FindSubmatch(body)
 	if len(find) > 1 {
 		title = string(find[1])
@@ -208,9 +213,11 @@ func gettitle(body []byte) (title string) {
 		if len(title) > 100 {
 			title = title[:100]
 		}
-	}
+		if title == "" {
-	if title == "" {
+			title = "\"\"" //空格
-		title = "None"
+		}
+	} else {
+		title = "None" //没有title
 	}
 	return
 }

README.md

@@ -196,7 +196,7 @@ fscan 是 404Team [星链计划2.0](https://github.com/knownsec/404StarLink2.0-G
 
 - [https://github.com/knownsec/404StarLink2.0-Galaxy#community](https://github.com/knownsec/404StarLink2.0-Galaxy#community)
 
-
+演示视频[【安全工具】5大功能，一键化内网扫描神器——404星链计划fscan](https://www.bilibili.com/video/BV1Cv4y1R72M)
 # 7. Star Chart
 [![Stargazers over time](https://starchart.cc/shadow1ng/fscan.svg)](https://starchart.cc/shadow1ng/fscan)
 

WebScan/WebScan.go

@@ -46,7 +46,6 @@ func Execute(PocInfo common.PocInfo) {
 	if common.Cookie != "" {
 		req.Header.Set("Cookie", common.Cookie)
 	}
-	req.Header.Set("Connection", "close")
 	pocs := filterPoc(PocInfo.PocName)
 	lib.CheckMultiPoc(req, pocs, common.PocNum)
 }
@@ -67,6 +66,7 @@ func initpoc() {
 			}
 		}
 	} else {
+		fmt.Println("[+] load poc from " + common.PocPath)
 		err := filepath.Walk(common.PocPath,
 			func(path string, info os.FileInfo, err error) error {
 				if err != nil || info == nil {

WebScan/info/rules.go

@@ -17,7 +17,7 @@ type PocData struct {
 }
 
 var RuleDatas = []RuleData{
-	{"宝塔", "body", "(app.bt.cn/static/app.png|安全入口校验失败|<title>入口校验失败</title>|href=\"http://www.bt.cn/bbs)"},
+	{"宝塔", "code", "(app.bt.cn/static/app.png|安全入口校验失败|<title>入口校验失败</title>|href=\"http://www.bt.cn/bbs)"},
 	{"深信服防火墙类产品", "code", "(SANGFOR FW)"},
 	{"360网站卫士", "code", "(webscan.360.cn/status/pai/hash|wzws-waf-cgi|zhuji.360.cn/guard/firewall/stopattack.html)"},
 	{"360网站卫士", "headers", "(360wzws|CWAP-waf|zhuji.360.cn|X-Safe-Firewall)"},
@@ -55,7 +55,7 @@ var RuleDatas = []RuleData{
 	{"Yundun", "headers", "(YUNDUN)"},
 	{"Yunsuo", "headers", "(yunsuo)"},
 	{"Coding pages", "header", "(Coding Pages)"},
-	{"启明防火墙", "body", "(/cgi-bin/webui?op=get_product_model)"},
+	{"启明防火墙", "code", "(/cgi-bin/webui?op=get_product_model)"},
 	{"Shiro", "headers", "(=deleteMe|rememberMe=)"},
 	{"Portainer(Docker管理)", "code", "(portainer.updatePassword|portainer.init.admin)"},
 	{"Gogs简易Git服务", "cookie", "(i_like_gogs)"},
@@ -64,7 +64,7 @@ var RuleDatas = []RuleData{
 	{"Nexus", "cookie", "(NX-ANTI-CSRF-TOKEN)"},
 	{"Harbor", "code", "(<title>Harbor</title>)"},
 	{"Harbor", "cookie", "(harbor-lang)"},
-	{"禅道", "code", "(/theme/default/images/main/zt-logo.png)"},
+	{"禅道", "code", "(/theme/default/images/main/zt-logo.png|/zentao/theme/zui/css/min.css)"},
 	{"禅道", "cookie", "(zentaosid)"},
 	{"协众OA", "code", "(Powered by 协众OA)"},
 	{"协众OA", "cookie", "(CNOAOASESSID)"},
@@ -199,7 +199,6 @@ var RuleDatas = []RuleData{
 	{"IBM-Lotus-Domino", "code", "(/mailjump.nsf|/domcfg.nsf|/names.nsf|/homepage.nsf)"},
 	{"APACHE-kylin", "code", "(url=kylin)"},
 	{"C-Lodop打印服务系统", "code", "(/CLodopfuncs.js|www.c-lodop.com)"},
-	{"ATLASSIAN-Confluence", "code", "(Atlassian Confluence)"},
 	{"HFS", "code", "(href=\"http://www.rejetto.com/hfs/)"},
 	{"Jellyfin", "code", "(content=\"http://jellyfin.org\")"},
 	{"FIT2CLOUD-JumpServer-堡垒机", "code", "(<title>JumpServer</title>)"},
@@ -250,6 +249,8 @@ var RuleDatas = []RuleData{
 	{"JEECMS", "code", "(/r/cms/www/red/js/common.js|/r/cms/www/red/js/indexshow.js|Powered by JEECMS|JEECMS|/jeeadmin/jeecms/index.do)"},
 	{"CMS", "code", "(Powered by .*CMS)"},
 	{"目录遍历", "code", "(Directory listing for /)"},
+	{"ATLASSIAN-Confluence", "code", "(com.atlassian.confluence)"},
+	{"ATLASSIAN-Confluence", "headers", "(X-Confluence)"},
 	{"向日葵", "code", "({\"success\":false,\"msg\":\"Verification failure\"})"},
 	{"Kubernetes", "code", "(Kubernetes Dashboard</title>|Kubernetes Enterprise Manager|Mirantis Kubernetes Engine|Kubernetes Resource Report)"},
 	{"WordPress", "code", "(/wp-login.php?action=lostpassword|WordPress</title>)"},

WebScan/lib/check.go

@@ -240,6 +240,9 @@ func optimizeCookies(rawCookie string) (output string) {
 }
 
 func newReverse() *Reverse {
+	if !common.DnsLog {
+		return &Reverse{}
+	}
 	letters := "1234567890abcdefghijklmnopqrstuvwxyz"
 	randSource := rand.New(rand.NewSource(time.Now().UnixNano()))
 	sub := RandomStr(randSource, letters, 8)
@@ -532,7 +535,7 @@ func evalset1(env *cel.Env, variableMap map[string]interface{}, k string, expres
 
 func CheckInfoPoc(infostr string) string {
 	for _, poc := range info.PocDatas {
-		if strings.Compare(poc.Name, infostr) == 0 {
+		if strings.Contains(infostr, poc.Name) {
 			return poc.Alias
 		}
 	}

WebScan/lib/client.go

@@ -9,11 +9,10 @@ import (
 	"github.com/shadow1ng/fscan/common"
 	"golang.org/x/net/proxy"
 	"gopkg.in/yaml.v2"
-	"io/ioutil"
-	"log"
 	"net"
 	"net/http"
 	"net/url"
+	"os"
 	"strings"
 	"time"
 )
@@ -25,11 +24,17 @@ var (
 	keepAlive        = 5 * time.Second
 )
 
-func Inithttp(PocInfo common.PocInfo) {
+func Inithttp() {
-	//PocInfo.Proxy = "http://127.0.0.1:8080"
+	//common.Proxy = "http://127.0.0.1:8080"
+	if common.PocNum == 0 {
+		common.PocNum = 20
+	}
+	if common.WebTimeout == 0 {
+		common.WebTimeout = 5
+	}
 	err := InitHttpClient(common.PocNum, common.Proxy, time.Duration(common.WebTimeout)*time.Second)
 	if err != nil {
-		log.Fatal(err)
+		panic(err)
 	}
 }
 
@@ -241,7 +246,7 @@ func SelectPoc(Pocs embed.FS, pocname string) []string {
 
 func LoadPocbyPath(fileName string) (*Poc, error) {
 	p := &Poc{}
-	data, err := ioutil.ReadFile(fileName)
+	data, err := os.ReadFile(fileName)
 	if err != nil {
 		fmt.Printf("[-] load poc %s error3: %v\n", fileName, err)
 		return nil, err

WebScan/lib/eval.go

@@ -15,7 +15,6 @@ import (
 	"github.com/shadow1ng/fscan/common"
 	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
 	"io"
-	"io/ioutil"
 	"math/rand"
 	"net/http"
 	"net/url"
@@ -578,6 +577,7 @@ func reverseCheck(r *Reverse, timeout int64) bool {
 	}
 
 	if !bytes.Contains(resp.Body, []byte(`"data": []`)) && bytes.Contains(resp.Body, []byte(`"message": "OK"`)) { // api返回结果不为空
+		fmt.Println(urlStr)
 		return true
 	}
 	return false
@@ -657,12 +657,12 @@ func ParseRequest(oReq *http.Request) (*Request, error) {
 	req.ContentType = oReq.Header.Get("Content-Type")
 	if oReq.Body == nil || oReq.Body == http.NoBody {
 	} else {
-		data, err := ioutil.ReadAll(oReq.Body)
+		data, err := io.ReadAll(oReq.Body)
 		if err != nil {
 			return nil, err
 		}
 		req.Body = data
-		oReq.Body = ioutil.NopCloser(bytes.NewBuffer(data))
+		oReq.Body = io.NopCloser(bytes.NewBuffer(data))
 	}
 	return req, nil
 }
@@ -677,9 +677,9 @@ func ParseResponse(oResp *http.Response) (*Response, error) {
 	}
 	resp.Headers = header
 	resp.ContentType = oResp.Header.Get("Content-Type")
-	body, err := getRespBody(oResp)
+	body, _ := getRespBody(oResp)
 	resp.Body = body
-	return &resp, err
+	return &resp, nil
 }
 
 func getRespBody(oResp *http.Response) (body []byte, err error) {

common/Parse.go

@@ -66,6 +66,21 @@ func ParsePass(Info *HostInfo) {
 			Passwords = PwdList
 		}
 	}
+	if Hashfile != "" {
+		hashs, err := Readfile(Hashfile)
+		if err == nil {
+			for _, line := range hashs {
+				if line == "" {
+					continue
+				}
+				if len(line) == 32 {
+					Hashs = append(Hashs, line)
+				} else {
+					fmt.Println("[-] len(hash) != 32 " + line)
+				}
+			}
+		}
+	}
 	if URL != "" {
 		urls := strings.Split(URL, ",")
 		TmpUrls := make(map[string]struct{})
@@ -101,7 +116,7 @@ func ParsePass(Info *HostInfo) {
 					newport += port + ","
 				}
 			}
-			Info.Ports = newport
+			Ports = newport
 		}
 	}
 }
@@ -140,15 +155,15 @@ func ParseInput(Info *HostInfo) {
 		IsSave = false
 	}
 
-	if Info.Ports == DefaultPorts {
+	if Ports == DefaultPorts {
-		Info.Ports += "," + Webport
+		Ports += "," + Webport
 	}
 
 	if PortAdd != "" {
-		if strings.HasSuffix(Info.Ports, ",") {
+		if strings.HasSuffix(Ports, ",") {
-			Info.Ports += PortAdd
+			Ports += PortAdd
 		} else {
-			Info.Ports += "," + PortAdd
+			Ports += "," + PortAdd
 		}
 	}
 
@@ -205,13 +220,19 @@ func ParseInput(Info *HostInfo) {
 		fmt.Println("[-] Hash is error,len(hash) must be 32")
 		os.Exit(0)
 	} else {
-		var err error
+		Hashs = append(Hashs, Hash)
-		HashBytes, err = hex.DecodeString(Hash)
+	}
+	Hashs = RemoveDuplicate(Hashs)
+	for _, hash := range Hashs {
+		hashbyte, err := hex.DecodeString(Hash)
 		if err != nil {
-			fmt.Println("[-] Hash is error,hex decode error")
+			fmt.Println("[-] Hash is error,hex decode error ", hash)
-			os.Exit(0)
+			continue
+		} else {
+			HashBytes = append(HashBytes, hashbyte)
 		}
 	}
+	Hashs = []string{}
 }
 
 func ParseScantype(Info *HostInfo) {
@@ -219,35 +240,35 @@ func ParseScantype(Info *HostInfo) {
 	if !ok {
 		showmode()
 	}
-	if Scantype != "all" && Info.Ports == DefaultPorts+","+Webport {
+	if Scantype != "all" && Ports == DefaultPorts+","+Webport {
 		switch Scantype {
 		case "wmiexec":
-			Info.Ports = "135"
+			Ports = "135"
 		case "wmiinfo":
-			Info.Ports = "135"
+			Ports = "135"
 		case "smbinfo":
-			Info.Ports = "445"
+			Ports = "445"
 		case "hostname":
-			Info.Ports = "135,137,139,445"
+			Ports = "135,137,139,445"
 		case "smb2":
-			Info.Ports = "445"
+			Ports = "445"
 		case "web":
-			Info.Ports = Webport
+			Ports = Webport
 		case "webonly":
-			Info.Ports = Webport
+			Ports = Webport
 		case "ms17010":
-			Info.Ports = "445"
+			Ports = "445"
 		case "cve20200796":
-			Info.Ports = "445"
+			Ports = "445"
 		case "portscan":
-			Info.Ports = DefaultPorts + "," + Webport
+			Ports = DefaultPorts + "," + Webport
 		case "main":
-			Info.Ports = DefaultPorts
+			Ports = DefaultPorts
 		default:
 			port, _ := PORTList[Scantype]
-			Info.Ports = strconv.Itoa(port)
+			Ports = strconv.Itoa(port)
 		}
-		fmt.Println("-m ", Scantype, " start scan the port:", Info.Ports)
+		fmt.Println("-m ", Scantype, " start scan the port:", Ports)
 	}
 }
 

common/ParseIP.go

@@ -24,11 +24,21 @@ var ParseIPErr = errors.New(" host parsing error\n" +
 	"192.168.1.1-255")
 
 func ParseIP(host string, filename string, nohosts ...string) (hosts []string, err error) {
-	hosts = ParseIPs(host)
+	if filename == "" && strings.Contains(host, ":") {
-	if filename != "" {
+		//192.168.0.0/16:80
-		var filehost []string
+		hostport := strings.Split(host, ":")
-		filehost, _ = Readipfile(filename)
+		if len(hostport) == 2 {
-		hosts = append(hosts, filehost...)
+			host = hostport[0]
+			hosts = ParseIPs(host)
+			Ports = hostport[1]
+		}
+	} else {
+		hosts = ParseIPs(host)
+		if filename != "" {
+			var filehost []string
+			filehost, _ = Readipfile(filename)
+			hosts = append(hosts, filehost...)
+		}
 	}
 
 	if len(nohosts) > 0 {
@@ -78,6 +88,12 @@ func ParseIPs(ip string) (hosts []string) {
 func parseIP(ip string) []string {
 	reg := regexp.MustCompile(`[a-zA-Z]+`)
 	switch {
+	case ip == "192":
+		return parseIP("192.168.0.0/8")
+	case ip == "172":
+		return parseIP("172.16.0.0/12")
+	case ip == "10":
+		return parseIP("10.0.0.0/8")
 	// 扫描/8时,只扫网关和随机IP,避免扫描过多IP
 	case strings.HasSuffix(ip, "/8"):
 		return parseIP8(ip)

common/ParsePort.go

@@ -15,6 +15,11 @@ func ParsePort(ports string) (scanPorts []int) {
 		if port == "" {
 			continue
 		}
+		if PortGroup[port] != "" {
+			port = PortGroup[port]
+			scanPorts = append(scanPorts, ParsePort(port)...)
+			continue
+		}
 		upper := port
 		if strings.Contains(port, "-") {
 			ranges := strings.Split(port, "-")
@@ -35,6 +40,9 @@ func ParsePort(ports string) (scanPorts []int) {
 		start, _ := strconv.Atoi(port)
 		end, _ := strconv.Atoi(upper)
 		for i := start; i <= end; i++ {
+			if i > 65535 || i < 1 {
+				continue
+			}
 			scanPorts = append(scanPorts, i)
 		}
 	}

common/config.go

@@ -1,6 +1,6 @@
 package common
 
-var version = "1.8.3"
+var version = "1.8.4"
 var Userdict = map[string][]string{
 	"ftp":        {"ftp", "admin", "www", "web", "root", "db", "wwwroot", "data"},
 	"mysql":      {"root", "mysql"},
@@ -82,6 +82,7 @@ type PocInfo struct {
 }
 
 var (
+	Ports       string
 	Path        string
 	Scantype    string
 	Command     string
@@ -96,12 +97,13 @@ var (
 	NoPing      bool
 	Ping        bool
 	Pocinfo     PocInfo
-	NoWebCan    bool
+	NoPoc       bool
 	IsBrute     bool
 	RedisFile   string
 	RedisShell  string
 	Userfile    string
 	Passfile    string
+	Hashfile    string
 	HostFile    string
 	PortFile    string
 	PocPath     string
@@ -119,7 +121,8 @@ var (
 	LiveTop     int
 	Socks5Proxy string
 	Hash        string
-	HashBytes   []byte
+	Hashs       []string
+	HashBytes   [][]byte
 	HostPort    []string
 	IsWmi       bool
 	Noredistest bool

common/flag.go

@@ -20,7 +20,7 @@ func Flag(Info *HostInfo) {
 	Banner()
 	flag.StringVar(&Info.Host, "h", "", "IP address of the host you want to scan,for example: 192.168.11.11 | 192.168.11.11-255 | 192.168.11.11,192.168.11.12")
 	flag.StringVar(&NoHosts, "hn", "", "the hosts no scan,as: -hn 192.168.1.1/24")
-	flag.StringVar(&Info.Ports, "p", DefaultPorts, "Select a port,for example: 22 | 1-65535 | 22,80,3306")
+	flag.StringVar(&Ports, "p", DefaultPorts, "Select a port,for example: 22 | 1-65535 | 22,80,3306")
 	flag.StringVar(&PortAdd, "pa", "", "add port base DefaultPorts,-pa 3389")
 	flag.StringVar(&UserAdd, "usera", "", "add a user base DefaultUsers,-usera user")
 	flag.StringVar(&PassAdd, "pwda", "", "add a password base DefaultPasses,-pwda password")
@@ -38,11 +38,12 @@ func Flag(Info *HostInfo) {
 	flag.StringVar(&HostFile, "hf", "", "host file, -hf ip.txt")
 	flag.StringVar(&Userfile, "userf", "", "username file")
 	flag.StringVar(&Passfile, "pwdf", "", "password file")
+	flag.StringVar(&Hashfile, "hashf", "", "hash file")
 	flag.StringVar(&PortFile, "portf", "", "Port File")
 	flag.StringVar(&PocPath, "pocpath", "", "poc file path")
 	flag.StringVar(&RedisFile, "rf", "", "redis file to write sshkey file (as: -rf id_rsa.pub)")
 	flag.StringVar(&RedisShell, "rs", "", "redis shell to write cron file (as: -rs 192.168.1.1:6666)")
-	flag.BoolVar(&NoWebCan, "nopoc", false, "not to scan web vul")
+	flag.BoolVar(&NoPoc, "nopoc", false, "not to scan web vul")
 	flag.BoolVar(&IsBrute, "nobr", false, "not to Brute password")
 	flag.IntVar(&BruteThread, "br", 1, "Brute threads")
 	flag.BoolVar(&NoPing, "np", false, "not to ping")

common/log.go

@@ -4,6 +4,8 @@ import (
 	"encoding/json"
 	"fmt"
 	"github.com/fatih/color"
+	"io"
+	"log"
 	"os"
 	"strings"
 	"sync"
@@ -13,7 +15,6 @@ import (
 var Num int64
 var End int64
 var Results = make(chan *string)
-var Start = true
 var LogSucTime int64
 var LogErrTime int64
 var WaitTime int64
@@ -28,6 +29,7 @@ type JsonText struct {
 }
 
 func init() {
+	log.SetOutput(io.Discard)
 	LogSucTime = time.Now().Unix()
 	go SaveLog()
 }

go.mod

@@ -4,15 +4,15 @@ go 1.19
 
 require (
 	github.com/C-Sto/goWMIExec v0.0.1-deva.0.20210704154847-b8ebd6464a06
-	github.com/denisenkom/go-mssqldb v0.12.2
+	github.com/denisenkom/go-mssqldb v0.12.3
 	github.com/fatih/color v1.7.0
-	github.com/go-sql-driver/mysql v1.6.0
+	github.com/go-sql-driver/mysql v1.8.1
 	github.com/google/cel-go v0.13.0
 	github.com/hirochachacha/go-smb2 v1.1.0
-	github.com/jlaffaye/ftp v0.0.0-20220829015825-b85cf1edccd4
+	github.com/jlaffaye/ftp v0.2.0
-	github.com/lib/pq v1.10.6
+	github.com/lib/pq v1.10.9
 	github.com/satori/go.uuid v1.2.0
-	github.com/sijms/go-ora/v2 v2.5.3
+	github.com/sijms/go-ora/v2 v2.5.29
 	github.com/stacktitan/smb v0.0.0-20190531122847-da9a425dceb8
 	github.com/tomatome/grdp v0.0.0-20211231062539-be8adab7eaf3
 	golang.org/x/crypto v0.3.0
@@ -25,6 +25,7 @@ require (
 )
 
 require (
+	filippo.io/edwards25519 v1.1.0 // indirect
 	github.com/BurntSushi/toml v0.3.1 // indirect
 	github.com/antlr/antlr4/runtime/Go/antlr v1.4.10 // indirect
 	github.com/geoffgarside/ber v1.1.0 // indirect

go.sum

@@ -11,6 +11,8 @@ cloud.google.com/go/firestore v1.1.0/go.mod h1:ulACoGHTpvq5r8rxGJ4ddJZBZqakUQqCl
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v0.19.0/go.mod h1:h6H6c8enJmmocHUbLiiGY6sx7f9i+X3m1CHdd5c6Rdw=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v0.11.0/go.mod h1:HcM1YX14R7CJcghJGOYCgdezslRSVzqwLf/q+4Y2r/0=
 github.com/Azure/azure-sdk-for-go/sdk/internal v0.7.0/go.mod h1:yqy467j36fJxcRV2TzfVZ1pCb5vxm4BtZPUdYWe/Xo8=
@@ -40,8 +42,8 @@ github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsr
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/denisenkom/go-mssqldb v0.12.2 h1:1OcPn5GBIobjWNd+8yjfHNIaFX14B1pWI3F9HZy5KXw=
+github.com/denisenkom/go-mssqldb v0.12.3 h1:pBSGx9Tq67pBOTLmxNuirNTeB8Vjmf886Kx+8Y+8shw=
-github.com/denisenkom/go-mssqldb v0.12.2/go.mod h1:lnIw1mZukFRZDJYQ0Pb833QS2IaC3l5HkEfra2LJ+sk=
+github.com/denisenkom/go-mssqldb v0.12.3/go.mod h1:k0mtMFOnU+AihqFxPMiF05rtiDrorD1Vrm1KEz5hxDo=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
 github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
@@ -60,8 +62,8 @@ github.com/go-gl/glfw/v3.3/glfw v0.0.0-20210410170116-ea3d685f79fb/go.mod h1:tQ2
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
-github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
+github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
-github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
+github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
@@ -135,8 +137,8 @@ github.com/huin/asn1ber v0.0.0-20120622192748-af09f62e6358/go.mod h1:qBE210J2T9u
 github.com/icodeface/tls v0.0.0-20190904083142-17aec93c60e5 h1:ZcsPFW8UgACapqjcrBJx0PuyT4ppArO5VFn0vgnkvmc=
 github.com/icodeface/tls v0.0.0-20190904083142-17aec93c60e5/go.mod h1:VJNHW2GxCtQP/IQtXykBIPBV8maPJ/dHWirVTwm9GwY=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
-github.com/jlaffaye/ftp v0.0.0-20220829015825-b85cf1edccd4 h1:8bWaY08VCoFn17gezYWKLhCwAJr2Er8tUOZCvDVshos=
+github.com/jlaffaye/ftp v0.2.0 h1:lXNvW7cBu7R/68bknOX3MrRIIqZ61zELs1P2RAiA3lg=
-github.com/jlaffaye/ftp v0.0.0-20220829015825-b85cf1edccd4/go.mod h1:hhq4G4crv+nW2qXtNYcuzLeOudG92Ps37HEKeg2e3lE=
+github.com/jlaffaye/ftp v0.2.0/go.mod h1:is2Ds5qkhceAPy2xD6RLI6hmp/qysSoymZ+Z2uTnspI=
 github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
@@ -151,8 +153,8 @@ github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORN
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/lib/pq v1.10.6 h1:jbk+ZieJ0D7EVGJYpL9QTz7/YW6UHbmdnZWYyK5cdBs=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
-github.com/lib/pq v1.10.6/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/lunixbochs/struc v0.0.0-20200707160740-784aaebc1d40 h1:EnfXoSqDfSNJv0VBNqY/88RNnhSGYkrHaO0mmFGbVsc=
 github.com/lunixbochs/struc v0.0.0-20200707160740-784aaebc1d40/go.mod h1:vy1vK6wD6j7xX6O6hXe621WabdtNkou2h7uRtTfRMyg=
 github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
@@ -210,8 +212,8 @@ github.com/shurcooL/go v0.0.0-20200502201357-93f07166e636/go.mod h1:TDJrrUr11Vxr
 github.com/shurcooL/httpfs v0.0.0-20190707220628-8d4bc4ba7749/go.mod h1:ZY1cvUeJuFPAdZ/B6v7RHavJWZn2YPVFQ1OSXhCGOkg=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/shurcooL/vfsgen v0.0.0-20200824052919-0d455de96546/go.mod h1:TrYk7fJVaAttu97ZZKrO9UbRa8izdowaMIZcxYMbVaw=
-github.com/sijms/go-ora/v2 v2.5.3 h1:klGKmhqRONVTtIzTdfYTvrW94kdJkdmZl93u2A3vchI=
+github.com/sijms/go-ora/v2 v2.5.29 h1:ZSaeQM0Jn+r3XcIajk1YJk3Rx8fmt9eso6QQ73IZM6E=
-github.com/sijms/go-ora/v2 v2.5.3/go.mod h1:EHxlY6x7y9HAsdfumurRfTd+v8NrEOTR3Xl4FWlH6xk=
+github.com/sijms/go-ora/v2 v2.5.29/go.mod h1:EHxlY6x7y9HAsdfumurRfTd+v8NrEOTR3Xl4FWlH6xk=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
@@ -235,7 +237,7 @@ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UV
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
+github.com/stretchr/testify v1.8.3 h1:RP3t2pwF7cMEbC1dqtB6poj3niw/9gnV4Cjg5oW5gtY=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/tfriedel6/canvas v0.12.1/go.mod h1:WIe1YgsQiKA1awmU6tSs8e5DkceDHC5MHgV5vQQZr/0=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
@@ -268,6 +270,7 @@ golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=
+golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.3.0 h1:a06MkbcxBrEFc0w0QIZWXrH/9cCX6KJyWbBOIwAn+7A=
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/exp v0.0.0-20181106170214-d68db9428509/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -313,6 +316,7 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210610132358-84b48f89b13b/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -344,6 +348,7 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=

main.go

@@ -13,6 +13,5 @@ func main() {
 	common.Flag(&Info)
 	common.Parse(&Info)
 	Plugins.Scan(Info)
-	t := time.Since(start)
+	fmt.Printf("[*] 扫描结束,耗时: %s\n", time.Since(start))
-	fmt.Printf("[*] 扫描结束,耗时: %s\n", t)
 }