mirror of
https://github.com/shadow1ng/fscan.git
synced 2026-09-22 03:10:42 +08:00
ZacharyZcR
6d61b661f4
- UDP 插件在 -p 指定端口时被跳过 - Redis exploit 无超时保护 / readReply 吞没非超时错误 - service_probe 连接丢失后静默成功 - SNMP 探测成功但终端无输出 - SSH 爆破不稳定 (并发过高 + 自适应超时过短 + 限流误判) - 进度条 isActive 竞态 新增 Config.ModuleTimeout() 协议级超时下限 (≥3s) 新增 ErrorTypeThrottle 限流错误分类
77 lines
1.6 KiB
Go
77 lines
1.6 KiB
Go
//go:build plugin_ipmi || !plugin_selective
|
|
|
|
package services
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/shadow1ng/fscan/common"
|
|
"github.com/shadow1ng/fscan/plugins"
|
|
)
|
|
|
|
type IPMIPlugin struct {
|
|
plugins.BasePlugin
|
|
}
|
|
|
|
func NewIPMIPlugin() *IPMIPlugin {
|
|
return &IPMIPlugin{BasePlugin: plugins.NewBasePlugin("ipmi")}
|
|
}
|
|
|
|
func (p *IPMIPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
|
|
timeout := session.Config.ModuleTimeout()
|
|
if timeout <= 0 {
|
|
timeout = 3 * time.Second
|
|
}
|
|
|
|
target := info.Target()
|
|
|
|
if result := p.rmcpPing(ctx, target, timeout, session); result != nil {
|
|
return result
|
|
}
|
|
return &ScanResult{Success: false, Service: "ipmi"}
|
|
}
|
|
|
|
func (p *IPMIPlugin) rmcpPing(ctx context.Context, target string, timeout time.Duration, session *common.ScanSession) *ScanResult {
|
|
ping := []byte{
|
|
0x06, 0x00, 0xff, 0x06,
|
|
0x00, 0x00, 0x11, 0xbe,
|
|
0x80, 0x00, 0x00, 0x00,
|
|
}
|
|
|
|
buf, n := udpProbe(ctx, session, target, timeout, ping, 512)
|
|
if buf == nil || n < 12 {
|
|
return nil
|
|
}
|
|
|
|
if buf[0] != 0x06 || buf[3] != 0x06 {
|
|
return nil
|
|
}
|
|
if n >= 9 && buf[8] != 0x40 {
|
|
return nil
|
|
}
|
|
|
|
banner := "IPMI/RMCP service detected"
|
|
if n >= 16 {
|
|
banner = fmt.Sprintf("IPMI/RMCP detected (supported entities: 0x%02x)", buf[15])
|
|
if buf[15]&0x80 != 0 {
|
|
banner += " [IPMI supported]"
|
|
}
|
|
}
|
|
|
|
return &ScanResult{
|
|
Success: true,
|
|
Type: plugins.ResultTypeVuln,
|
|
Service: "ipmi",
|
|
VulInfo: "IPMI Service Exposed (hash dump possible with rakp)",
|
|
Banner: banner,
|
|
}
|
|
}
|
|
|
|
func init() {
|
|
RegisterUDPPluginWithPorts("ipmi", func() Plugin {
|
|
return NewIPMIPlugin()
|
|
}, []int{623})
|
|
}
|