From 1906acf5512ea33dc29e2e586847bbfdb7b6eb35 Mon Sep 17 00:00:00 2001
From: ZacharyZcR <2903735704@qq.com>
Date: Mon, 23 Dec 2024 03:15:14 +0800
Subject: [PATCH] =?UTF-8?q?perf:=20=E4=BC=98=E5=8C=96UDP=E6=89=AB=E6=8F=8F?=
 =?UTF-8?q?=E9=80=BB=E8=BE=91?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Common/Flag.go          |  1 +
 Common/ParsePort.go     |  1 +
 Common/ParseScanMode.go |  6 +++++-
 Common/Ports.go         |  1 +
 Core/PortScan.go        | 40 +++++++++++++++++++++++-----------------
 Plugins/SNMP.go         |  1 -
 6 files changed, 31 insertions(+), 19 deletions(-)

diff --git a/Common/Flag.go b/Common/Flag.go
index 6121125..a308c44 100644
--- a/Common/Flag.go
+++ b/Common/Flag.go
@@ -65,6 +65,7 @@ func Flag(Info *HostInfo) {
 		"  - Port: 端口扫描模式\n"+
 		"  - ICMP: ICMP存活探测\n"+
 		"  - Local: 本地信息收集\n\n"+
+		"  - UDP: UDP扫描模式\n\n"+
 		"单个插件模式(小写):\n"+
 		"  Web类: web, fcgi\n"+
 		"  数据库类: mysql, mssql, redis, mongodb, postgres, oracle, memcached\n"+
diff --git a/Common/ParsePort.go b/Common/ParsePort.go
index 770b97b..f8a3453 100644
--- a/Common/ParsePort.go
+++ b/Common/ParsePort.go
@@ -14,6 +14,7 @@ func ParsePort(ports string) []int {
 		"service": ServicePorts,
 		"db":      DbPorts,
 		"web":     WebPorts,
+		"udp":     UDPPorts,
 		"all":     AllPorts,
 		"main":    MainPorts,
 	}
diff --git a/Common/ParseScanMode.go b/Common/ParseScanMode.go
index d22add6..4a12ee9 100644
--- a/Common/ParseScanMode.go
+++ b/Common/ParseScanMode.go
@@ -13,6 +13,7 @@ const (
 	ModePort     = "Port"     // 端口扫描
 	ModeICMP     = "ICMP"     // ICMP探测
 	ModeLocal    = "Local"    // 本地信息收集
+	ModeUDP      = "UDP"      //UDP扫描
 )
 
 // 插件分类映射表 - 所有插件名使用小写
@@ -36,7 +37,7 @@ var pluginGroups = map[string][]string{
 		"web", "fcgi",
 	},
 	ModeService: {
-		"ftp", "ssh", "telnet", "smb", "rdp", "vnc", "netbios", "ldap", "smtp", "imap", "pop3", "snmp",
+		"ftp", "ssh", "telnet", "smb", "rdp", "vnc", "netbios", "ldap", "smtp", "imap", "pop3",
 	},
 	ModeVul: {
 		"ms17010", "smbghost", "smb2",
@@ -44,6 +45,9 @@ var pluginGroups = map[string][]string{
 	ModeLocal: {
 		"localinfo",
 	},
+	ModeUDP: {
+		"snmp",
+	},
 }
 
 // ParseScanMode 解析扫描模式
diff --git a/Common/Ports.go b/Common/Ports.go
index 648e932..a71bedc 100644
--- a/Common/Ports.go
+++ b/Common/Ports.go
@@ -8,6 +8,7 @@ import (
 var ServicePorts = "21,22,23,25,110,135,139,143,161,162,389,445,465,587,636,993,995,1433,1521,2222,3306,3389,5432,5672,5671,6379,8161,9000,9092,9093,9200,11211,15672,15671,27017,61616,61613"
 var DbPorts = "1433,1521,3306,5432,5672,6379,9093,9200,11211,27017,61616"
 var WebPorts = "80,81,82,83,84,85,86,87,88,89,90,91,92,98,99,443,800,801,808,880,888,889,1000,1010,1080,1081,1082,1099,1118,1888,2008,2020,2100,2375,2379,3000,3008,3128,3505,5555,6080,6648,6868,7000,7001,7002,7003,7004,7005,7007,7008,7070,7071,7074,7078,7080,7088,7200,7680,7687,7688,7777,7890,8000,8001,8002,8003,8004,8006,8008,8009,8010,8011,8012,8016,8018,8020,8028,8030,8038,8042,8044,8046,8048,8053,8060,8069,8070,8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8091,8092,8093,8094,8095,8096,8097,8098,8099,8100,8101,8108,8118,8161,8172,8180,8181,8200,8222,8244,8258,8280,8288,8300,8360,8443,8448,8484,8800,8834,8838,8848,8858,8868,8879,8880,8881,8888,8899,8983,8989,9000,9001,9002,9008,9010,9043,9060,9080,9081,9082,9083,9084,9085,9086,9087,9088,9089,9090,9091,9092,9093,9094,9095,9096,9097,9098,9099,9100,9200,9443,9448,9800,9981,9986,9988,9998,9999,10000,10001,10002,10004,10008,10010,10250,12018,12443,14000,15672,15671,16080,18000,18001,18002,18004,18008,18080,18082,18088,18090,18098,19001,20000,20720,21000,21501,21502,28018,20880"
+var UDPPorts = "161"
 var AllPorts = "1-65535"
 var MainPorts = "21,22,23,80,81,110,135,139,143,161,389,443,445,993,995,1433,1521,3306,5432,5672,6379,7001,8000,8080,8089,9000,9200,9092,11211,15672,27017,61616"
 
diff --git a/Core/PortScan.go b/Core/PortScan.go
index 6c47933..37fa60c 100644
--- a/Core/PortScan.go
+++ b/Core/PortScan.go
@@ -316,44 +316,50 @@ func calculateTCPChecksum(tcpHeader []byte, srcIP, dstIP net.IP) uint16 {
 }
 
 func UDPScan(ip string, port int, timeout int64) (bool, error) {
-	// 创建UDP套接字
 	sendConn, err := net.ListenPacket("udp4", "0.0.0.0:0")
 	if err != nil {
 		return false, fmt.Errorf("创建UDP套接字失败: %v", err)
 	}
 	defer sendConn.Close()
 
-	// 设置目标地址
 	dstAddr := &net.UDPAddr{
 		IP:   net.ParseIP(ip),
 		Port: port,
 	}
 
-	// 发送空包
-	_, err = sendConn.WriteTo([]byte{0x00}, dstAddr)
+	// 根据端口发送对应的探测包
+	var probe []byte
+	switch port {
+	case 161: // SNMP
+		// SNMP GetRequest
+		probe = []byte{
+			0x30, 0x26, 0x02, 0x01, 0x01, 0x04, 0x06, 0x70,
+			0x75, 0x62, 0x6c, 0x69, 0x63, 0xa0, 0x19, 0x02,
+			0x04, 0x6b, 0x8b, 0x44, 0x5b, 0x02, 0x01, 0x00,
+			0x02, 0x01, 0x00, 0x30, 0x0b, 0x30, 0x09, 0x06,
+			0x05, 0x2b, 0x06, 0x01, 0x02, 0x01, 0x05, 0x00,
+		}
+	default:
+		probe = []byte{0x00}
+	}
+
+	_, err = sendConn.WriteTo(probe, dstAddr)
 	if err != nil {
 		return false, fmt.Errorf("发送UDP包失败: %v", err)
 	}
 
-	// 设置读取超时
 	sendConn.SetReadDeadline(time.Now().Add(time.Duration(timeout) * time.Second))
 
-	// 尝试读取响应
-	buffer := make([]byte, 65507) // UDP最大包大小
+	buffer := make([]byte, 65507)
 	n, _, err := sendConn.ReadFrom(buffer)
 
-	// 如果收到ICMP不可达，说明端口关闭
-	if err != nil {
-		if netErr, ok := err.(net.Error); ok && netErr.Timeout() {
-			// 超时可能意味着端口开放但没有响应
-			return true, nil
-		}
-		// 其他错误说明端口可能关闭
-		return false, nil
+	// 收到响应则认为端口开放
+	if err == nil && n > 0 {
+		return true, nil
 	}
 
-	// 收到响应说明端口开放
-	return n > 0, nil
+	// ICMP Unreachable 或其他错误都认为端口关闭
+	return false, nil
 }
 
 // 获取系统对应的接口名
diff --git a/Plugins/SNMP.go b/Plugins/SNMP.go
index 6e067c3..f9ab158 100644
--- a/Plugins/SNMP.go
+++ b/Plugins/SNMP.go
@@ -9,7 +9,6 @@ import (
 	"time"
 )
 
-// SNMPScan 执行SNMP服务扫描
 // SNMPScan 执行SNMP服务扫描
 func SNMPScan(info *Common.HostInfo) (tmperr error) {
 	if Common.DisableBrute {