mirror of
https://github.com/shadow1ng/fscan.git
synced 2026-09-22 03:10:42 +08:00
ZacharyZcR
28686f845d
根因分析（通过 goroutine dump 定位）: 1. UDP conn.Write 在 WSL2 上可能永久阻塞（SetDeadline 对 Write 不生效） 2. SNMP community 爆破混入通用密码字典（57个），串行 × 10s超时 = 10分钟 修复: - 提取 udpProbe() 公共函数，用 context timeout + conn.Close 双保险 超时后强制关闭连接，中断阻塞的 Write/Read - BACnet/DNS/IPMI/TFTP 统一使用 udpProbe() - SNMP probe 使用 goroutine + context select 保护 - SNMP community 列表不再混入通用密码字典（8个专用 community 足够） - SNMP 后续 community 爆破用 3s 短超时 + 连续失败 3 次快速退出 效果: 同样的扫描从无限卡死 → 9秒完成
70 lines
1.5 KiB
Go
70 lines
1.5 KiB
Go
//go:build plugin_bacnet || !plugin_selective
|
|
|
|
package services
|
|
|
|
import (
|
|
"context"
|
|
"encoding/binary"
|
|
"time"
|
|
|
|
"github.com/shadow1ng/fscan/common"
|
|
"github.com/shadow1ng/fscan/plugins"
|
|
)
|
|
|
|
var bacnetWhoIs = []byte{0x81, 0x0a, 0x00, 0x0c, 0x01, 0x20, 0xff, 0xff, 0x00, 0xff, 0x10, 0x08}
|
|
|
|
type BACnetPlugin struct {
|
|
plugins.BasePlugin
|
|
}
|
|
|
|
func NewBACnetPlugin() *BACnetPlugin {
|
|
return &BACnetPlugin{BasePlugin: plugins.NewBasePlugin("bacnet")}
|
|
}
|
|
|
|
func (p *BACnetPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
|
|
timeout := session.Config.Timeout
|
|
if timeout <= 0 {
|
|
timeout = 3 * time.Second
|
|
}
|
|
|
|
target := info.Target()
|
|
data, n := udpProbe(ctx, session, target, timeout, bacnetWhoIs, 1476)
|
|
if data == nil {
|
|
return &ScanResult{Success: false, Service: "bacnet"}
|
|
}
|
|
|
|
banner, ok := parseBACnetResponse(data[:n])
|
|
if !ok {
|
|
return &ScanResult{Success: false, Service: "bacnet"}
|
|
}
|
|
|
|
return &ScanResult{
|
|
Success: true,
|
|
Type: plugins.ResultTypeService,
|
|
Service: "bacnet",
|
|
Banner: banner,
|
|
}
|
|
}
|
|
|
|
func parseBACnetResponse(data []byte) (string, bool) {
|
|
if len(data) < 6 || data[0] != 0x81 {
|
|
return "", false
|
|
}
|
|
length := int(binary.BigEndian.Uint16(data[2:4]))
|
|
if length != len(data) {
|
|
return "", false
|
|
}
|
|
for i := 4; i+1 < len(data); i++ {
|
|
if data[i] == 0x10 && data[i+1] == 0x00 {
|
|
return "BACnet I-Am response", true
|
|
}
|
|
}
|
|
return "", false
|
|
}
|
|
|
|
func init() {
|
|
RegisterUDPPluginWithPorts("bacnet", func() Plugin {
|
|
return NewBACnetPlugin()
|
|
}, []int{47808})
|
|
}
|