Skip to content

Commit 40b6dbc

Browse files
shadow1ngshadow1ng
authored
Merge pull request #395 from ZacharyZcR/main
Fscan 2.0.0 完整代码重构、新增本地信息搜集插件
2 parents 3dfd2e9 + 59cc462 commit 40b6dbc

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

69 files changed

+7579
-5159
lines changed

‎.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,3 @@
11
result.txt
2+
main
3+
.idea

‎common/config.go renamed to ‎Common/Config.go

Lines changed: 3 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
package common
1+
package Common
22

3-
var version = "1.8.4"
3+
var version = "2.0.0"
44
var Userdict = map[string][]string{
55
"ftp": {"ftp", "admin", "www", "web", "root", "db", "wwwroot", "data"},
66
"mysql": {"root", "mysql"},
@@ -14,33 +14,7 @@ var Userdict = map[string][]string{
1414
}
1515

1616
var Passwords = []string{"123456", "admin", "admin123", "root", "", "pass123", "pass@123", "password", "123123", "654321", "111111", "123", "1", "admin@123", "Admin@123", "admin123!@#", "{user}", "{user}1", "{user}111", "{user}123", "{user}@123", "{user}_123", "{user}#123", "{user}@111", "{user}@2019", "{user}@123#4", "P@ssw0rd!", "P@ssw0rd", "Passw0rd", "qwe123", "12345678", "test", "test123", "123qwe", "123qwe!@#", "123456789", "123321", "666666", "a123456.", "123456~a", "123456!a", "000000", "1234567890", "8888888", "!QAZ2wsx", "1qaz2wsx", "abc123", "abc123456", "1qaz@WSX", "a11111", "a12345", "Aa1234", "Aa1234.", "Aa12345", "a123456", "a123123", "Aa123123", "Aa123456", "Aa12345.", "sysadmin", "system", "1qaz!QAZ", "2wsx@WSX", "qwe123!@#", "Aa123456!", "A123456s!", "sa123456", "1q2w3e", "Charge123", "Aa123456789"}
17-
var PORTList = map[string]int{
18-
"ftp": 21,
19-
"ssh": 22,
20-
"findnet": 135,
21-
"netbios": 139,
22-
"smb": 445,
23-
"mssql": 1433,
24-
"oracle": 1521,
25-
"mysql": 3306,
26-
"rdp": 3389,
27-
"psql": 5432,
28-
"redis": 6379,
29-
"fcgi": 9000,
30-
"mem": 11211,
31-
"mgo": 27017,
32-
"ms17010": 1000001,
33-
"cve20200796": 1000002,
34-
"web": 1000003,
35-
"webonly": 1000003,
36-
"webpoc": 1000003,
37-
"smb2": 1000004,
38-
"wmiexec": 1000005,
39-
"all": 0,
40-
"portscan": 0,
41-
"icmp": 0,
42-
"main": 0,
43-
}
17+
4418
var PortGroup = map[string]string{
4519
"ftp": "21",
4620
"ssh": "22",
@@ -69,13 +43,6 @@ var IsSave = true
6943
var Webport = "80,81,82,83,84,85,86,87,88,89,90,91,92,98,99,443,800,801,808,880,888,889,1000,1010,1080,1081,1082,1099,1118,1888,2008,2020,2100,2375,2379,3000,3008,3128,3505,5555,6080,6648,6868,7000,7001,7002,7003,7004,7005,7007,7008,7070,7071,7074,7078,7080,7088,7200,7680,7687,7688,7777,7890,8000,8001,8002,8003,8004,8006,8008,8009,8010,8011,8012,8016,8018,8020,8028,8030,8038,8042,8044,8046,8048,8053,8060,8069,8070,8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8091,8092,8093,8094,8095,8096,8097,8098,8099,8100,8101,8108,8118,8161,8172,8180,8181,8200,8222,8244,8258,8280,8288,8300,8360,8443,8448,8484,8800,8834,8838,8848,8858,8868,8879,8880,8881,8888,8899,8983,8989,9000,9001,9002,9008,9010,9043,9060,9080,9081,9082,9083,9084,9085,9086,9087,9088,9089,9090,9091,9092,9093,9094,9095,9096,9097,9098,9099,9100,9200,9443,9448,9800,9981,9986,9988,9998,9999,10000,10001,10002,10004,10008,10010,10250,12018,12443,14000,16080,18000,18001,18002,18004,18008,18080,18082,18088,18090,18098,19001,20000,20720,21000,21501,21502,28018,20880"
7044
var DefaultPorts = "21,22,80,81,135,139,443,445,1433,1521,3306,5432,6379,7001,8000,8080,8089,9000,9200,11211,27017"
7145

72-
type HostInfo struct {
73-
Host string
74-
Ports string
75-
Url string
76-
Infostr []string
77-
}
78-
7946
type PocInfo struct {
8047
Target string
8148
PocName string

‎Common/Flag.go

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
package Common
2+
3+
import (
4+
"flag"
5+
)
6+
7+
func Banner() {
8+
banner := `
9+
___ _
10+
/ _ \ ___ ___ _ __ __ _ ___| | __
11+
/ /_\/____/ __|/ __| '__/ _` + "`" + ` |/ __| |/ /
12+
/ /_\\_____\__ \ (__| | | (_| | (__| <
13+
\____/ |___/\___|_| \__,_|\___|_|\_\
14+
fscan version: ` + version + `
15+
`
16+
print(banner)
17+
}
18+
19+
func Flag(Info *HostInfo) {
20+
Banner()
21+
22+
// 目标配置
23+
flag.StringVar(&Info.Host, "h", "", "目标主机IP，例如: 192.168.11.11 | 192.168.11.11-255 | 192.168.11.11,192.168.11.12")
24+
flag.StringVar(&NoHosts, "hn", "", "排除的主机范围，例如: -hn 192.168.1.1/24")
25+
flag.StringVar(&Ports, "p", DefaultPorts, "端口配置，例如: 22 | 1-65535 | 22,80,3306")
26+
flag.StringVar(&PortAdd, "pa", "", "在默认端口基础上添加端口，-pa 3389")
27+
flag.StringVar(&NoPorts, "pn", "", "排除的端口，例如: -pn 445")
28+
29+
// 认证配置
30+
flag.StringVar(&UserAdd, "usera", "", "在默认用户列表基础上添加用户,-usera user")
31+
flag.StringVar(&PassAdd, "pwda", "", "在默认密码列表基础上添加密码,-pwda password")
32+
flag.StringVar(&Username, "user", "", "用户名")
33+
flag.StringVar(&Password, "pwd", "", "密码")
34+
flag.StringVar(&Domain, "domain", "", "域名(用于SMB)")
35+
flag.StringVar(&SshKey, "sshkey", "", "SSH密钥文件(id_rsa)")
36+
37+
// 扫描配置
38+
flag.StringVar(&Scantype, "m", "all", "扫描类型，例如: -m ssh")
39+
flag.IntVar(&Threads, "t", 600, "线程数量")
40+
flag.Int64Var(&Timeout, "time", 3, "超时时间(秒)")
41+
flag.IntVar(&LiveTop, "top", 10, "显示存活主机数量")
42+
flag.BoolVar(&NoPing, "np", false, "禁用存活探测")
43+
flag.BoolVar(&Ping, "ping", false, "使用ping替代ICMP")
44+
flag.StringVar(&Command, "c", "", "执行命令(支持ssh|wmiexec)")
45+
46+
// 文件配置
47+
flag.StringVar(&HostFile, "hf", "", "主机列表文件")
48+
flag.StringVar(&Userfile, "userf", "", "用户名字典")
49+
flag.StringVar(&Passfile, "pwdf", "", "密码字典")
50+
flag.StringVar(&Hashfile, "hashf", "", "Hash字典")
51+
flag.StringVar(&PortFile, "portf", "", "端口列表文件")
52+
53+
// Web配置
54+
flag.StringVar(&URL, "u", "", "目标URL")
55+
flag.StringVar(&UrlFile, "uf", "", "URL列表文件")
56+
flag.StringVar(&Cookie, "cookie", "", "设置Cookie")
57+
flag.Int64Var(&WebTimeout, "wt", 5, "Web请求超时时间")
58+
flag.StringVar(&Proxy, "proxy", "", "设置HTTP代理")
59+
flag.StringVar(&Socks5Proxy, "socks5", "", "设置Socks5代理(将用于TCP连接,超时设置将失效)")
60+
61+
// POC配置
62+
flag.StringVar(&PocPath, "pocpath", "", "POC文件路径")
63+
flag.StringVar(&Pocinfo.PocName, "pocname", "", "使用包含指定名称的POC,例如: -pocname weblogic")
64+
flag.BoolVar(&NoPoc, "nopoc", false, "禁用Web漏洞扫描")
65+
flag.BoolVar(&PocFull, "full", false, "完整POC扫描,如:shiro 100个key")
66+
flag.BoolVar(&DnsLog, "dns", false, "启用dnslog验证")
67+
flag.IntVar(&PocNum, "num", 20, "POC并发数")
68+
69+
// Redis利用配置
70+
flag.StringVar(&RedisFile, "rf", "", "Redis写入SSH公钥文件")
71+
flag.StringVar(&RedisShell, "rs", "", "Redis写入计划任务")
72+
flag.BoolVar(&Noredistest, "noredis", false, "禁用Redis安全检测")
73+
74+
// 暴力破解配置
75+
flag.BoolVar(&IsBrute, "nobr", false, "禁用密码爆破")
76+
flag.IntVar(&BruteThread, "br", 1, "密码爆破线程数")
77+
78+
// 其他配置
79+
flag.StringVar(&Path, "path", "", "FCG/SMB远程文件路径")
80+
flag.StringVar(&Hash, "hash", "", "Hash值")
81+
flag.StringVar(&SC, "sc", "", "MS17漏洞shellcode")
82+
flag.BoolVar(&IsWmi, "wmi", false, "启用WMI")
83+
84+
// 输出配置
85+
flag.StringVar(&Outputfile, "o", "result.txt", "结果输出文件")
86+
flag.BoolVar(&TmpSave, "no", false, "禁用结果保存")
87+
flag.BoolVar(&Silent, "silent", false, "静默扫描模式")
88+
flag.BoolVar(&Nocolor, "nocolor", false, "禁用彩色输出")
89+
flag.BoolVar(&JsonOutput, "json", false, "JSON格式输出")
90+
flag.Int64Var(&WaitTime, "debug", 60, "错误日志输出间隔")
91+
92+
flag.Parse()
93+
}

‎common/log.go renamed to ‎Common/Log.go

Lines changed: 53 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
package common
1+
package Common
22

33
import (
44
"encoding/json"
@@ -12,67 +12,81 @@ import (
1212
"time"
1313
)
1414

15-
var Num int64
16-
var End int64
17-
var Results = make(chan *string)
18-
var LogSucTime int64
19-
var LogErrTime int64
20-
var WaitTime int64
21-
var Silent bool
22-
var Nocolor bool
23-
var JsonOutput bool
24-
var LogWG sync.WaitGroup
15+
// 记录扫描状态的全局变量
16+
var (
17+
Num int64 // 总任务数
18+
End int64 // 已完成数
19+
Results = make(chan *string) // 结果通道
20+
LogSucTime int64 // 最近成功日志时间
21+
LogErrTime int64 // 最近错误日志时间
22+
WaitTime int64 // 等待时间
23+
Silent bool // 静默模式
24+
Nocolor bool // 禁用颜色
25+
JsonOutput bool // JSON输出
26+
LogWG sync.WaitGroup // 日志同步等待组
27+
)
2528

29+
// JsonText JSON输出的结构体
2630
type JsonText struct {
27-
Type string `json:"type"`
28-
Text string `json:"text"`
31+
Type string `json:"type"` // 消息类型
32+
Text string `json:"text"` // 消息内容
2933
}
3034

35+
// init 初始化日志配置
3136
func init() {
3237
log.SetOutput(io.Discard)
3338
LogSucTime = time.Now().Unix()
3439
go SaveLog()
3540
}
3641

42+
// LogSuccess 记录成功信息
3743
func LogSuccess(result string) {
3844
LogWG.Add(1)
3945
LogSucTime = time.Now().Unix()
4046
Results <- &result
4147
}
4248

49+
// SaveLog 保存日志信息
4350
func SaveLog() {
4451
for result := range Results {
52+
// 打印日志
4553
if !Silent {
4654
if Nocolor {
4755
fmt.Println(*result)
4856
} else {
49-
if strings.HasPrefix(*result, "[+] InfoScan") {
57+
switch {
58+
case strings.HasPrefix(*result, "[+] 信息扫描"):
5059
color.Green(*result)
51-
} else if strings.HasPrefix(*result, "[+]") {
60+
case strings.HasPrefix(*result, "[+]"):
5261
color.Red(*result)
53-
} else {
62+
default:
5463
fmt.Println(*result)
5564
}
5665
}
5766
}
67+
68+
// 保存到文件
5869
if IsSave {
5970
WriteFile(*result, Outputfile)
6071
}
6172
LogWG.Done()
6273
}
6374
}
6475

76+
// WriteFile 写入文件
6577
func WriteFile(result string, filename string) {
78+
// 打开文件
6679
fl, err := os.OpenFile(filename, os.O_WRONLY|os.O_CREATE|os.O_APPEND, 0666)
6780
if err != nil {
68-
fmt.Printf("Open %s error, %v\n", filename, err)
81+
fmt.Printf("[!] 打开文件失败 %s: %v\n", filename, err)
6982
return
7083
}
84+
defer fl.Close()
85+
7186
if JsonOutput {
72-
var scantype string
73-
var text string
87+
// 解析JSON格式
88+
var scantype, text string
7489
if strings.HasPrefix(result, "[+]") || strings.HasPrefix(result, "[*]") || strings.HasPrefix(result, "[-]") {
75-
//找到第二个空格的位置
7690
index := strings.Index(result[4:], " ")
7791
if index == -1 {
7892
scantype = "msg"
@@ -85,47 +99,51 @@ func WriteFile(result string, filename string) {
8599
scantype = "msg"
86100
text = result
87101
}
102+
103+
// 构造JSON对象
88104
jsonText := JsonText{
89105
Type: scantype,
90106
Text: text,
91107
}
108+
109+
// 序列化JSON
92110
jsonData, err := json.Marshal(jsonText)
93111
if err != nil {
94-
fmt.Println(err)
112+
fmt.Printf("[!] JSON序列化失败: %v\n", err)
95113
jsonText = JsonText{
96114
Type: "msg",
97115
Text: result,
98116
}
99-
jsonData, err = json.Marshal(jsonText)
100-
if err != nil {
101-
fmt.Println(err)
102-
jsonData = []byte(result)
103-
}
117+
jsonData, _ = json.Marshal(jsonText)
104118
}
105119
jsonData = append(jsonData, []byte(",\n")...)
106120
_, err = fl.Write(jsonData)
107121
} else {
108122
_, err = fl.Write([]byte(result + "\n"))
109123
}
110-
fl.Close()
124+
111125
if err != nil {
112-
fmt.Printf("Write %s error, %v\n", filename, err)
126+
fmt.Printf("[!] 写入文件失败 %s: %v\n", filename, err)
113127
}
114128
}
115129

130+
// LogError 记录错误信息
116131
func LogError(errinfo interface{}) {
117132
if WaitTime == 0 {
118-
fmt.Printf("已完成 %v/%v %v \n", End, Num, errinfo)
133+
fmt.Printf("[*] 已完成 %v/%v %v\n", End, Num, errinfo)
119134
} else if (time.Now().Unix()-LogSucTime) > WaitTime && (time.Now().Unix()-LogErrTime) > WaitTime {
120-
fmt.Printf("已完成 %v/%v %v \n", End, Num, errinfo)
135+
fmt.Printf("[*] 已完成 %v/%v %v\n", End, Num, errinfo)
121136
LogErrTime = time.Now().Unix()
122137
}
123138
}
124139

140+
// CheckErrs 检查是否为已知错误
125141
func CheckErrs(err error) bool {
126142
if err == nil {
127143
return false
128144
}
145+
146+
// 已知错误列表
129147
errs := []string{
130148
"closed by the remote host", "too many connections",
131149
"i/o timeout", "EOF", "A connection attempt failed",
@@ -136,10 +154,14 @@ func CheckErrs(err error) bool {
136154
"invalid packet size",
137155
"bad connection",
138156
}
157+
158+
// 检查错误是否匹配
159+
errLower := strings.ToLower(err.Error())
139160
for _, key := range errs {
140-
if strings.Contains(strings.ToLower(err.Error()), strings.ToLower(key)) {
161+
if strings.Contains(errLower, strings.ToLower(key)) {
141162
return true
142163
}
143164
}
165+
144166
return false
145167
}

0 commit comments

Comments
 (0)