mirror of
https://github.com/shadow1ng/fscan.git
synced 2026-09-22 03:10:42 +08:00
ZacharyZcR
04cae2e42d
根因分析（通过 goroutine dump 定位）: 1. UDP conn.Write 在 WSL2 上可能永久阻塞（SetDeadline 对 Write 不生效） 2. SNMP community 爆破混入通用密码字典（57个），串行 × 10s超时 = 10分钟 修复: - 提取 udpProbe() 公共函数，用 context timeout + conn.Close 双保险 超时后强制关闭连接，中断阻塞的 Write/Read - BACnet/DNS/IPMI/TFTP 统一使用 udpProbe() - SNMP probe 使用 goroutine + context select 保护 - SNMP community 列表不再混入通用密码字典（8个专用 community 足够） - SNMP 后续 community 爆破用 3s 短超时 + 连续失败 3 次快速退出 效果: 同样的扫描从无限卡死 → 9秒完成
83 lines
1.7 KiB
Go
83 lines
1.7 KiB
Go
//go:build plugin_tftp || !plugin_selective
|
|
|
|
package services
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/shadow1ng/fscan/common"
|
|
"github.com/shadow1ng/fscan/plugins"
|
|
)
|
|
|
|
type TFTPPlugin struct {
|
|
plugins.BasePlugin
|
|
}
|
|
|
|
func NewTFTPPlugin() *TFTPPlugin {
|
|
return &TFTPPlugin{BasePlugin: plugins.NewBasePlugin("tftp")}
|
|
}
|
|
|
|
func (p *TFTPPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
|
|
timeout := session.Config.Timeout
|
|
if timeout <= 0 {
|
|
timeout = 3 * time.Second
|
|
}
|
|
|
|
target := info.Target()
|
|
data, n := udpProbe(ctx, session, target, timeout, buildTFTPReadRequest("probe"), 516)
|
|
if data == nil || n < 4 {
|
|
return &ScanResult{Success: false, Service: "tftp"}
|
|
}
|
|
|
|
banner, ok := parseTFTPResponse(data[:n])
|
|
if !ok {
|
|
return &ScanResult{Success: false, Service: "tftp"}
|
|
}
|
|
|
|
return &ScanResult{
|
|
Success: true,
|
|
Type: plugins.ResultTypeService,
|
|
Service: "tftp",
|
|
Banner: banner,
|
|
}
|
|
}
|
|
|
|
func buildTFTPReadRequest(filename string) []byte {
|
|
req := []byte{0x00, 0x01}
|
|
req = append(req, filename...)
|
|
req = append(req, 0x00)
|
|
req = append(req, "octet"...)
|
|
req = append(req, 0x00)
|
|
return req
|
|
}
|
|
|
|
func parseTFTPResponse(data []byte) (string, bool) {
|
|
if len(data) < 4 || data[0] != 0x00 {
|
|
return "", false
|
|
}
|
|
|
|
opcode := data[1]
|
|
switch opcode {
|
|
case 0x03:
|
|
return "TFTP DATA response", true
|
|
case 0x05:
|
|
msg := strings.TrimRight(string(data[4:]), "\x00")
|
|
msg = truncateRunes(msg, 160)
|
|
if msg == "" {
|
|
msg = "error response"
|
|
}
|
|
return fmt.Sprintf("TFTP %s", msg), true
|
|
default:
|
|
return "", false
|
|
}
|
|
}
|
|
|
|
func init() {
|
|
RegisterUDPPluginWithPorts("tftp", func() Plugin {
|
|
return NewTFTPPlugin()
|
|
}, []int{69})
|
|
}
|