mirror of
https://github.com/shadow1ng/fscan.git
synced 2026-09-22 03:10:42 +08:00
ZacharyZcR
bc2a8f653a
- ipmi: 删除未使用的 encoding/binary 导入 - rmi: TCP读取改用 io.ReadFull 避免分片导致的解析错误 - jdwp: handshake响应读取改用 io.ReadFull 避免分片误判 - nfs: v4协议回退时使用新连接避免残留数据污染 - snmp: 修正timeout计算与其他插件保持一致
112 lines
2.7 KiB
Go
112 lines
2.7 KiB
Go
//go:build plugin_jdwp || !plugin_selective
|
|
|
|
package services
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"fmt"
|
|
"io"
|
|
"time"
|
|
|
|
"github.com/shadow1ng/fscan/common"
|
|
"github.com/shadow1ng/fscan/plugins"
|
|
)
|
|
|
|
var jdwpHandshake = []byte("JDWP-Handshake")
|
|
|
|
type JDWPPlugin struct {
|
|
plugins.BasePlugin
|
|
}
|
|
|
|
func NewJDWPPlugin() *JDWPPlugin {
|
|
return &JDWPPlugin{BasePlugin: plugins.NewBasePlugin("jdwp")}
|
|
}
|
|
|
|
func (p *JDWPPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
|
|
timeout := session.Config.Timeout
|
|
if timeout <= 0 {
|
|
timeout = 3 * time.Second
|
|
}
|
|
|
|
addr := fmt.Sprintf("%s:%d", info.Host, info.Port)
|
|
conn, err := session.DialTCP(ctx, "tcp", addr, timeout)
|
|
if err != nil {
|
|
return &ScanResult{Success: false, Service: "jdwp"}
|
|
}
|
|
defer conn.Close()
|
|
|
|
_ = conn.SetDeadline(time.Now().Add(timeout))
|
|
if _, err := conn.Write(jdwpHandshake); err != nil {
|
|
return &ScanResult{Success: false, Service: "jdwp"}
|
|
}
|
|
|
|
buf := make([]byte, len(jdwpHandshake))
|
|
if _, err := io.ReadFull(conn, buf); err != nil || !bytes.Equal(buf, jdwpHandshake) {
|
|
return &ScanResult{Success: false, Service: "jdwp"}
|
|
}
|
|
|
|
version := p.getVersion(conn, timeout)
|
|
|
|
return &ScanResult{
|
|
Success: true,
|
|
Type: plugins.ResultTypeVuln,
|
|
Service: "jdwp",
|
|
VulInfo: "JDWP Remote Debug Port Exposed",
|
|
Banner: version,
|
|
}
|
|
}
|
|
|
|
func (p *JDWPPlugin) getVersion(conn interface{ Read([]byte) (int, error); Write([]byte) (int, error); SetDeadline(time.Time) error }, timeout time.Duration) string {
|
|
_ = conn.SetDeadline(time.Now().Add(timeout))
|
|
|
|
// JDWP Version command: length=11, id=1, flags=0, commandSet=1, command=1
|
|
pkt := []byte{
|
|
0x00, 0x00, 0x00, 0x0b, // length = 11
|
|
0x00, 0x00, 0x00, 0x01, // id = 1
|
|
0x00, // flags = 0 (request)
|
|
0x01, // commandSet = 1 (VirtualMachine)
|
|
0x01, // command = 1 (Version)
|
|
}
|
|
if _, err := conn.Write(pkt); err != nil {
|
|
return ""
|
|
}
|
|
|
|
header := make([]byte, 11)
|
|
if _, err := conn.Read(header); err != nil {
|
|
return ""
|
|
}
|
|
replyLen := int(header[0])<<24 | int(header[1])<<16 | int(header[2])<<8 | int(header[3])
|
|
if replyLen <= 11 || replyLen > 4096 {
|
|
return ""
|
|
}
|
|
|
|
body := make([]byte, replyLen-11)
|
|
if _, err := conn.Read(body); err != nil {
|
|
return ""
|
|
}
|
|
|
|
return parseJDWPVersionString(body)
|
|
}
|
|
|
|
func parseJDWPVersionString(data []byte) string {
|
|
if len(data) < 4 {
|
|
return ""
|
|
}
|
|
strLen := int(data[0])<<24 | int(data[1])<<16 | int(data[2])<<8 | int(data[3])
|
|
if strLen <= 0 || strLen > len(data)-4 {
|
|
return ""
|
|
}
|
|
s := string(data[4 : 4+strLen])
|
|
if len(s) > 200 {
|
|
s = s[:200]
|
|
}
|
|
return s
|
|
}
|
|
|
|
func init() {
|
|
RegisterPluginWithPorts("jdwp", func() Plugin {
|
|
return NewJDWPPlugin()
|
|
}, []int{5005, 8000, 8787, 5050})
|
|
}
|