mirror of
https://github.com/shadow1ng/fscan.git
synced 2026-09-22 03:10:42 +08:00
ZacharyZcR
04cae2e42d
根因分析（通过 goroutine dump 定位）: 1. UDP conn.Write 在 WSL2 上可能永久阻塞（SetDeadline 对 Write 不生效） 2. SNMP community 爆破混入通用密码字典（57个），串行 × 10s超时 = 10分钟 修复: - 提取 udpProbe() 公共函数，用 context timeout + conn.Close 双保险 超时后强制关闭连接，中断阻塞的 Write/Read - BACnet/DNS/IPMI/TFTP 统一使用 udpProbe() - SNMP probe 使用 goroutine + context select 保护 - SNMP community 列表不再混入通用密码字典（8个专用 community 足够） - SNMP 后续 community 爆破用 3s 短超时 + 连续失败 3 次快速退出 效果: 同样的扫描从无限卡死 → 9秒完成
141 lines
3.1 KiB
Go
141 lines
3.1 KiB
Go
//go:build plugin_ipmi || !plugin_selective
|
|
|
|
package services
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/shadow1ng/fscan/common"
|
|
"github.com/shadow1ng/fscan/plugins"
|
|
)
|
|
|
|
type IPMIPlugin struct {
|
|
plugins.BasePlugin
|
|
}
|
|
|
|
func NewIPMIPlugin() *IPMIPlugin {
|
|
return &IPMIPlugin{BasePlugin: plugins.NewBasePlugin("ipmi")}
|
|
}
|
|
|
|
func (p *IPMIPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
|
|
timeout := session.Config.Timeout
|
|
if timeout <= 0 {
|
|
timeout = 3 * time.Second
|
|
}
|
|
|
|
target := info.Target()
|
|
|
|
if result := p.rmcpPing(ctx, target, timeout, session); result != nil {
|
|
return result
|
|
}
|
|
return &ScanResult{Success: false, Service: "ipmi"}
|
|
}
|
|
|
|
func (p *IPMIPlugin) rmcpPing(ctx context.Context, target string, timeout time.Duration, session *common.ScanSession) *ScanResult {
|
|
ping := []byte{
|
|
0x06, 0x00, 0xff, 0x06,
|
|
0x00, 0x00, 0x11, 0xbe,
|
|
0x80, 0x00, 0x00, 0x00,
|
|
}
|
|
|
|
buf, n := udpProbe(ctx, session, target, timeout, ping, 512)
|
|
if buf == nil || n < 12 {
|
|
return nil
|
|
}
|
|
|
|
if buf[0] != 0x06 || buf[3] != 0x06 {
|
|
return nil
|
|
}
|
|
if n >= 9 && buf[8] != 0x40 {
|
|
return nil
|
|
}
|
|
|
|
banner := "IPMI/RMCP service detected"
|
|
if n >= 16 {
|
|
banner = fmt.Sprintf("IPMI/RMCP detected (supported entities: 0x%02x)", buf[15])
|
|
if buf[15]&0x80 != 0 {
|
|
banner += " [IPMI supported]"
|
|
}
|
|
}
|
|
|
|
// getChannelAuth 需要独立连接，暂不执行（核心检测已完成）
|
|
|
|
return &ScanResult{
|
|
Success: true,
|
|
Type: plugins.ResultTypeVuln,
|
|
Service: "ipmi",
|
|
VulInfo: "IPMI Service Exposed (hash dump possible with rakp)",
|
|
Banner: banner,
|
|
}
|
|
}
|
|
|
|
func (p *IPMIPlugin) getChannelAuth(conn interface {
|
|
Read([]byte) (int, error)
|
|
Write([]byte) (int, error)
|
|
SetDeadline(time.Time) error
|
|
}) string {
|
|
_ = conn.SetDeadline(time.Now().Add(2 * time.Second))
|
|
|
|
// IPMI Get Channel Authentication Capabilities
|
|
// RMCP header + IPMI session wrapper + message
|
|
pkt := []byte{
|
|
0x06, 0x00, 0xff, 0x07, // RMCP: version, reserved, seq=0xff, class=IPMI
|
|
0x00, 0x00, 0x00, 0x00, // auth type = none
|
|
0x00, 0x00, 0x00, 0x00, // session seq
|
|
0x00, 0x00, 0x00, 0x00, // session id
|
|
0x09, // message length
|
|
0x20, // target = BMC
|
|
0x18, // netFn=App(6) << 2 | lun=0
|
|
0xc8, // checksum
|
|
0x81, // source
|
|
0x00, // seq
|
|
0x38, // cmd = Get Channel Auth Capabilities
|
|
0x8e, // channel=14 (current), IPMI v2.0
|
|
0x04, // privilege = Administrator
|
|
0xb5, // checksum
|
|
}
|
|
|
|
if _, err := conn.Write(pkt); err != nil {
|
|
return ""
|
|
}
|
|
|
|
buf := make([]byte, 512)
|
|
n, err := conn.Read(buf)
|
|
if err != nil || n < 30 {
|
|
return ""
|
|
}
|
|
|
|
// Parse auth capabilities from response
|
|
if n >= 27 {
|
|
authTypes := buf[22]
|
|
var methods []string
|
|
if authTypes&0x01 != 0 {
|
|
methods = append(methods, "none")
|
|
}
|
|
if authTypes&0x02 != 0 {
|
|
methods = append(methods, "md2")
|
|
}
|
|
if authTypes&0x04 != 0 {
|
|
methods = append(methods, "md5")
|
|
}
|
|
if authTypes&0x10 != 0 {
|
|
methods = append(methods, "password")
|
|
}
|
|
if authTypes&0x20 != 0 {
|
|
methods = append(methods, "oem")
|
|
}
|
|
if len(methods) > 0 {
|
|
return fmt.Sprintf("[auth: %v]", methods)
|
|
}
|
|
}
|
|
return ""
|
|
}
|
|
|
|
func init() {
|
|
RegisterUDPPluginWithPorts("ipmi", func() Plugin {
|
|
return NewIPMIPlugin()
|
|
}, []int{623})
|
|
}
|