mirror of
https://github.com/shadow1ng/fscan.git
synced 2025-07-13 21:02:44 +08:00
feat: 增加Rsync扫描和测试环境
This commit is contained in:
ZacharyZcR
parent
94121a796f
commit
0a9c732ee8
@ -21,6 +21,7 @@ var Userdict = map[string][]string{
|
||||
"imap": {"admin", "mail", "postmaster", "root", "user", "test"},
|
||||
"pop3": {"admin", "root", "mail", "user", "test", "postmaster"},
|
||||
"zabbix": {"Admin", "admin", "guest", "user"},
|
||||
"rsync": {"rsync", "root", "admin", "backup"},
|
||||
}
|
||||
|
||||
var Passwords = []string{"123456", "admin", "admin123", "root", "", "pass123", "pass@123", "password", "P@ssword123", "123123", "654321", "111111", "123", "1", "admin@123", "Admin@123", "admin123!@#", "{user}", "{user}1", "{user}111", "{user}123", "{user}@123", "{user}_123", "{user}#123", "{user}@111", "{user}@2019", "{user}@123#4", "P@ssw0rd!", "P@ssw0rd", "Passw0rd", "qwe123", "12345678", "test", "test123", "123qwe", "123qwe!@#", "123456789", "123321", "666666", "a123456.", "123456~a", "123456!a", "000000", "1234567890", "8888888", "!QAZ2wsx", "1qaz2wsx", "abc123", "abc123456", "1qaz@WSX", "a11111", "a12345", "Aa1234", "Aa1234.", "Aa12345", "a123456", "a123123", "Aa123123", "Aa123456", "Aa12345.", "sysadmin", "system", "1qaz!QAZ", "2wsx@WSX", "qwe123!@#", "Aa123456!", "A123456s!", "sa123456", "1q2w3e", "Charge123", "Aa123456789", "elastic123"}
|
||||
|
||||
@ -22,7 +22,7 @@ var pluginGroups = map[string][]string{
|
||||
"web", "fcgi", // web类
|
||||
"mysql", "mssql", "redis", "mongodb", "postgres", // 数据库类
|
||||
"oracle", "memcached", "elasticsearch", "rabbitmq", "kafka", "activemq", // 数据库类
|
||||
"ftp", "ssh", "telnet", "smb", "rdp", "vnc", "netbios", "ldap", "smtp", "imap", "pop3", "snmp", "zabbix", "modbus", // 服务类
|
||||
"ftp", "ssh", "telnet", "smb", "rdp", "vnc", "netbios", "ldap", "smtp", "imap", "pop3", "snmp", "zabbix", "modbus", "rsync", // 服务类
|
||||
"ms17010", "smbghost", "smb2", // 漏洞类
|
||||
"findnet", // 其他
|
||||
},
|
||||
@ -37,7 +37,7 @@ var pluginGroups = map[string][]string{
|
||||
"web", "fcgi",
|
||||
},
|
||||
ModeService: {
|
||||
"ftp", "ssh", "telnet", "smb", "rdp", "vnc", "netbios", "ldap", "smtp", "imap", "pop3", "zabbix", "modbus",
|
||||
"ftp", "ssh", "telnet", "smb", "rdp", "vnc", "netbios", "ldap", "smtp", "imap", "pop3", "zabbix", "modbus", "rsync",
|
||||
},
|
||||
ModeVul: {
|
||||
"ms17010", "smbghost", "smb2",
|
||||
|
||||
@ -5,12 +5,12 @@ import (
|
||||
"strings"
|
||||
)
|
||||
|
||||
var ServicePorts = "21,22,23,25,110,135,139,143,161,162,389,445,465,502,587,636,993,995,1433,1521,2222,3306,3389,5020,5432,5672,5671,6379,8161,8443,9000,9092,9093,9200,10051,11211,15672,15671,27017,61616,61613"
|
||||
var ServicePorts = "21,22,23,25,110,135,139,143,161,162,389,445,465,502,587,636,873,993,995,1433,1521,2222,3306,3389,5020,5432,5672,5671,6379,8161,8443,9000,9092,9093,9200,10051,11211,15672,15671,27017,61616,61613"
|
||||
var DbPorts = "1433,1521,3306,5432,5672,6379,9093,9200,11211,27017,61616"
|
||||
var WebPorts = "80,81,82,83,84,85,86,87,88,89,90,91,92,98,99,443,800,801,808,880,888,889,1000,1010,1080,1081,1082,1099,1118,1888,2008,2020,2100,2375,2379,3000,3008,3128,3505,5555,6080,6648,6868,7000,7001,7002,7003,7004,7005,7007,7008,7070,7071,7074,7078,7080,7088,7200,7680,7687,7688,7777,7890,8000,8001,8002,8003,8004,8005,8006,8008,8009,8010,8011,8012,8016,8018,8020,8028,8030,8038,8042,8044,8046,8048,8053,8060,8069,8070,8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8091,8092,8093,8094,8095,8096,8097,8098,8099,8100,8101,8108,8118,8161,8172,8180,8181,8200,8222,8244,8258,8280,8288,8300,8360,8443,8448,8484,8800,8834,8838,8848,8858,8868,8879,8880,8881,8888,8899,8983,8989,9000,9001,9002,9008,9010,9043,9060,9080,9081,9082,9083,9084,9085,9086,9087,9088,9089,9090,9091,9092,9093,9094,9095,9096,9097,9098,9099,9100,9200,9443,9448,9800,9981,9986,9988,9998,9999,10000,10001,10002,10004,10008,10010,10051,10250,12018,12443,14000,15672,15671,16080,18000,18001,18002,18004,18008,18080,18082,18088,18090,18098,19001,20000,20720,20880,21000,21501,21502,28018"
|
||||
var UDPPorts = "161"
|
||||
var AllPorts = "1-65535"
|
||||
var MainPorts = "21,22,23,80,81,110,135,139,143,161,389,443,445,502,993,995,1433,1521,3306,5432,5672,6379,7001,8000,8005,8009,8080,8089,8443,9000,9200,9092,10051,11211,15672,27017,61616"
|
||||
var MainPorts = "21,22,23,80,81,110,135,139,143,161,389,443,445,502,873,993,995,1433,1521,3306,5432,5672,6379,7001,8000,8005,8009,8080,8089,8443,9000,9200,9092,10051,11211,15672,27017,61616"
|
||||
|
||||
func ParsePortsFromString(portsStr string) []int {
|
||||
var ports []int
|
||||
|
||||
@ -127,6 +127,12 @@ func init() {
|
||||
ScanFunc: Plugins.ModbusScan,
|
||||
})
|
||||
|
||||
Common.RegisterPlugin("rsync", Common.ScanPlugin{
|
||||
Name: "Rsync",
|
||||
Ports: []int{873},
|
||||
ScanFunc: Plugins.RsyncScan,
|
||||
})
|
||||
|
||||
Common.RegisterPlugin("rdp", Common.ScanPlugin{
|
||||
Name: "RDP",
|
||||
Ports: []int{3389},
|
||||
|
||||
185
Plugins/Rsync.go
Normal file
185
Plugins/Rsync.go
Normal file
@ -0,0 +1,185 @@
|
||||
package Plugins
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"github.com/shadow1ng/fscan/Common"
|
||||
"net"
|
||||
"strings"
|
||||
"time"
|
||||
)
|
||||
|
||||
// RsyncScan 执行 Rsync 服务扫描
|
||||
func RsyncScan(info *Common.HostInfo) (tmperr error) {
|
||||
if Common.DisableBrute {
|
||||
return
|
||||
}
|
||||
|
||||
starttime := time.Now().Unix()
|
||||
|
||||
// 首先测试匿名访问
|
||||
flag, err := RsyncConn(info, "", "")
|
||||
if flag && err == nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// 尝试用户名密码组合
|
||||
for _, user := range Common.Userdict["rsync"] {
|
||||
for _, pass := range Common.Passwords {
|
||||
pass = strings.Replace(pass, "{user}", user, -1)
|
||||
|
||||
flag, err := RsyncConn(info, user, pass)
|
||||
if flag && err == nil {
|
||||
return err
|
||||
}
|
||||
|
||||
errlog := fmt.Sprintf("[-] Rsync服务 %v:%v 尝试失败 用户名: %v 密码: %v 错误: %v",
|
||||
info.Host, info.Ports, user, pass, err)
|
||||
Common.LogError(errlog)
|
||||
tmperr = err
|
||||
|
||||
if Common.CheckErrs(err) {
|
||||
return err
|
||||
}
|
||||
|
||||
if time.Now().Unix()-starttime > (int64(len(Common.Userdict["rsync"])*len(Common.Passwords)) * Common.Timeout) {
|
||||
return err
|
||||
}
|
||||
}
|
||||
}
|
||||
return tmperr
|
||||
}
|
||||
|
||||
func RsyncConn(info *Common.HostInfo, user string, pass string) (bool, error) {
|
||||
host, port := info.Host, info.Ports
|
||||
timeout := time.Duration(Common.Timeout) * time.Second
|
||||
|
||||
// 建立连接
|
||||
conn, err := net.DialTimeout("tcp", fmt.Sprintf("%s:%s", host, port), timeout)
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
defer conn.Close()
|
||||
|
||||
buffer := make([]byte, 1024)
|
||||
|
||||
// 1. 读取服务器初始greeting
|
||||
n, err := conn.Read(buffer)
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
|
||||
greeting := string(buffer[:n])
|
||||
if !strings.HasPrefix(greeting, "@RSYNCD:") {
|
||||
return false, fmt.Errorf("不是Rsync服务")
|
||||
}
|
||||
|
||||
// 获取服务器版本号
|
||||
version := strings.TrimSpace(strings.TrimPrefix(greeting, "@RSYNCD:"))
|
||||
|
||||
// 2. 回应相同的版本号
|
||||
_, err = conn.Write([]byte(fmt.Sprintf("@RSYNCD: %s\n", version)))
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
|
||||
// 3. 选择模块 - 先列出可用模块
|
||||
_, err = conn.Write([]byte("#list\n"))
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
|
||||
// 4. 读取模块列表
|
||||
var moduleList strings.Builder
|
||||
for {
|
||||
n, err = conn.Read(buffer)
|
||||
if err != nil {
|
||||
break
|
||||
}
|
||||
chunk := string(buffer[:n])
|
||||
moduleList.WriteString(chunk)
|
||||
if strings.Contains(chunk, "@RSYNCD: EXIT") {
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
modules := strings.Split(moduleList.String(), "\n")
|
||||
for _, module := range modules {
|
||||
if strings.HasPrefix(module, "@RSYNCD") || module == "" {
|
||||
continue
|
||||
}
|
||||
|
||||
// 获取模块名
|
||||
moduleName := strings.Fields(module)[0]
|
||||
|
||||
// 5. 为每个模块创建新连接尝试认证
|
||||
authConn, err := net.DialTimeout("tcp", fmt.Sprintf("%s:%s", host, port), timeout)
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
defer authConn.Close()
|
||||
|
||||
// 重复初始握手
|
||||
_, err = authConn.Read(buffer)
|
||||
if err != nil {
|
||||
authConn.Close()
|
||||
continue
|
||||
}
|
||||
|
||||
_, err = authConn.Write([]byte(fmt.Sprintf("@RSYNCD: %s\n", version)))
|
||||
if err != nil {
|
||||
authConn.Close()
|
||||
continue
|
||||
}
|
||||
|
||||
// 6. 选择模块
|
||||
_, err = authConn.Write([]byte(moduleName + "\n"))
|
||||
if err != nil {
|
||||
authConn.Close()
|
||||
continue
|
||||
}
|
||||
|
||||
// 7. 等待认证挑战
|
||||
n, err = authConn.Read(buffer)
|
||||
if err != nil {
|
||||
authConn.Close()
|
||||
continue
|
||||
}
|
||||
|
||||
authResponse := string(buffer[:n])
|
||||
if strings.Contains(authResponse, "@RSYNCD: OK") {
|
||||
// 模块不需要认证
|
||||
if user == "" && pass == "" {
|
||||
result := fmt.Sprintf("[+] Rsync服务 %v:%v 模块:%v 无需认证", host, port, moduleName)
|
||||
Common.LogSuccess(result)
|
||||
return true, nil
|
||||
}
|
||||
} else if strings.Contains(authResponse, "@RSYNCD: AUTHREQD") {
|
||||
if user != "" && pass != "" {
|
||||
// 8. 发送认证信息
|
||||
authString := fmt.Sprintf("%s %s\n", user, pass)
|
||||
_, err = authConn.Write([]byte(authString))
|
||||
if err != nil {
|
||||
authConn.Close()
|
||||
continue
|
||||
}
|
||||
|
||||
// 9. 读取认证结果
|
||||
n, err = authConn.Read(buffer)
|
||||
if err != nil {
|
||||
authConn.Close()
|
||||
continue
|
||||
}
|
||||
|
||||
if !strings.Contains(string(buffer[:n]), "@ERROR") {
|
||||
result := fmt.Sprintf("[+] Rsync服务 %v:%v 模块:%v 认证成功 用户名: %v 密码: %v",
|
||||
host, port, moduleName, user, pass)
|
||||
Common.LogSuccess(result)
|
||||
return true, nil
|
||||
}
|
||||
}
|
||||
}
|
||||
authConn.Close()
|
||||
}
|
||||
|
||||
return false, fmt.Errorf("认证失败或无可用模块")
|
||||
}
|
||||
39
TestDocker/Rsync/Dockerfile
Normal file
39
TestDocker/Rsync/Dockerfile
Normal file
@ -0,0 +1,39 @@
|
||||
FROM ubuntu:20.04
|
||||
|
||||
# 安装rsync
|
||||
RUN apt-get update && \
|
||||
apt-get install -y rsync
|
||||
|
||||
# 创建测试目录和用户
|
||||
RUN mkdir -p /data/public && \
|
||||
mkdir -p /data/secure && \
|
||||
useradd -m testuser && \
|
||||
echo "testuser:123456" | chpasswd
|
||||
|
||||
# 配置文件
|
||||
RUN echo 'pid file = /var/run/rsyncd.pid' > /etc/rsyncd.conf && \
|
||||
echo 'log file = /var/log/rsyncd.log' >> /etc/rsyncd.conf && \
|
||||
echo 'transfer logging = yes' >> /etc/rsyncd.conf && \
|
||||
echo 'use chroot = yes' >> /etc/rsyncd.conf && \
|
||||
echo '[public]' >> /etc/rsyncd.conf && \
|
||||
echo 'path = /data/public' >> /etc/rsyncd.conf && \
|
||||
echo 'comment = Public Share' >> /etc/rsyncd.conf && \
|
||||
echo 'read only = yes' >> /etc/rsyncd.conf && \
|
||||
echo 'auth users = *' >> /etc/rsyncd.conf && \
|
||||
echo 'secrets file = /etc/rsyncd.secrets' >> /etc/rsyncd.conf && \
|
||||
echo '[anonymous]' >> /etc/rsyncd.conf && \
|
||||
echo 'path = /data/public' >> /etc/rsyncd.conf && \
|
||||
echo 'comment = Anonymous Share' >> /etc/rsyncd.conf && \
|
||||
echo 'read only = yes' >> /etc/rsyncd.conf && \
|
||||
echo 'auth users = ' >> /etc/rsyncd.conf
|
||||
|
||||
# 创建密码文件
|
||||
RUN echo 'testuser:123456' > /etc/rsyncd.secrets && \
|
||||
echo 'root:root123' >> /etc/rsyncd.secrets && \
|
||||
chmod 600 /etc/rsyncd.secrets
|
||||
|
||||
# 暴露Rsync默认端口
|
||||
EXPOSE 873
|
||||
|
||||
# 启动rsync守护进程
|
||||
CMD ["rsync", "--daemon", "--no-detach", "--config=/etc/rsyncd.conf"]
|
||||
2
TestDocker/Rsync/README.txt
Normal file
2
TestDocker/Rsync/README.txt
Normal file
@ -0,0 +1,2 @@
|
||||
docker build -t rsync-weak .
|
||||
docker run -d --name rsync-test -p 873:873 rsync-weak
|
||||
Loading…
Reference in New Issue
Block a user