fix Plugins/ssh.go

Signed-off-by: 大米 <xxddpac@gmail.com>

Plugins/ssh.go

@@ -1,6 +1,7 @@
 package Plugins
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"github.com/shadow1ng/fscan/common"
@@ -8,90 +9,120 @@ import (
 	"io/ioutil"
 	"net"
 	"strings"
+	"sync"
 	"time"
 )
 
-func SshScan(info *common.HostInfo) (tmperr error) {
+type SshScanInfo struct {
-	if common.IsBrute {
+	Host, User, Password, Port string
-		return
+}
+
+func SshScan(info *common.HostInfo) error {
+	var (
+		wg              sync.WaitGroup
+		sshScanInfoChan chan SshScanInfo
+	)
+	if common.IsBrute {
+		return nil
+	}
+	sshScanInfoChan = make(chan SshScanInfo, 50)
+	defer close(sshScanInfoChan)
+	for i := 0; i < 50; i++ {
+		SshConn(&wg, sshScanInfoChan)
 	}
-	starttime := time.Now().Unix()
 	for _, user := range common.Userdict["ssh"] {
 		for _, pass := range common.Passwords {
 			pass = strings.Replace(pass, "{user}", user, -1)
-			flag, err := SshConn(info, user, pass)
+			wg.Add(1)
-			if flag == true && err == nil {
+			sshScanInfoChan <- SshScanInfo{
-				return err
+				Host:     info.Host,
-			} else {
+				Port:     info.Ports,
-				errlog := fmt.Sprintf("[-] ssh %v:%v %v %v %v", info.Host, info.Ports, user, pass, err)
+				User:     user,
-				common.LogError(errlog)
+				Password: pass,
-				tmperr = err
-				if common.CheckErrs(err) {
-					return err
-				}
-				if time.Now().Unix()-starttime > (int64(len(common.Userdict["ssh"])*len(common.Passwords)) * common.Timeout) {
-					return err
-				}
-			}
-			if common.SshKey != "" {
-				return err
 			}
 		}
 	}
-	return tmperr
+	wg.Wait()
+	return nil
 }
 
-func SshConn(info *common.HostInfo, user string, pass string) (flag bool, err error) {
+func SshConn(wg *sync.WaitGroup, sshScanInfoChan chan SshScanInfo) {
-	flag = false
+	go func() {
-	Host, Port, Username, Password := info.Host, info.Ports, user, pass
+		var (
-	Auth := []ssh.AuthMethod{}
+			Auth   []ssh.AuthMethod
+			ctx    context.Context
+			cancel context.CancelFunc
+		)
+		for info := range sshScanInfoChan {
+			func() {
+				defer wg.Done()
+				ch := make(chan struct{})
+				ctx, cancel = context.WithTimeout(context.Background(), time.Second*5)
 				if common.SshKey != "" {
 					pemBytes, err := ioutil.ReadFile(common.SshKey)
 					if err != nil {
-			return false, errors.New("read key failed" + err.Error())
+						common.LogError(errors.New("read key failed" + err.Error()))
+						return
 					}
 					signer, err := ssh.ParsePrivateKey(pemBytes)
 					if err != nil {
-			return false, errors.New("parse key failed" + err.Error())
+						common.LogError(errors.New("parse key failed" + err.Error()))
+						return
 					}
 					Auth = []ssh.AuthMethod{ssh.PublicKeys(signer)}
 				} else {
-		Auth = []ssh.AuthMethod{ssh.Password(Password)}
+					Auth = []ssh.AuthMethod{ssh.Password(info.Password)}
 				}
-
 				config := &ssh.ClientConfig{
-		User:    Username,
+					User:    info.User,
 					Auth:    Auth,
 					Timeout: time.Duration(common.Timeout) * time.Second,
 					HostKeyCallback: func(hostname string, remote net.Addr, key ssh.PublicKey) error {
 						return nil
 					},
 				}
+				select {
+				case <-ctx.Done(): //如果5秒未返回结果(有概率出现连接假死不释放)，强行结束此协程,避免主协程无法接收wg.done,一直阻塞
+					common.LogError(fmt.Errorf("host %v port %v connect hang", info.Host, info.Port))
+					cancel()
+					return
+				case <-startScan(info, config, ch):
+				}
+			}()
+		}
+	}()
+}
 
-	client, err := ssh.Dial("tcp", fmt.Sprintf("%v:%v", Host, Port), config)
+func startScan(info SshScanInfo, config *ssh.ClientConfig, ch chan struct{}) <-chan struct{} {
+	go func() {
+		client, err := ssh.Dial("tcp", fmt.Sprintf("%v:%v", info.Host, info.Port), config)
 		if err == nil {
-		defer client.Close()
+			defer func() {
+				_ = client.Close()
+			}()
 			session, err := client.NewSession()
 			if err == nil {
-			defer session.Close()
+				defer func() {
-			flag = true
+					_ = session.Close()
+				}()
 				var result string
 				if common.Command != "" {
 					combo, _ := session.CombinedOutput(common.Command)
-				result = fmt.Sprintf("[+] SSH:%v:%v:%v %v \n %v", Host, Port, Username, Password, string(combo))
+					result = fmt.Sprintf("[+] SSH:%v:%v:%v %v \n %v", info.Host, info.Port, info.User, info.Password, string(combo))
 					if common.SshKey != "" {
-					result = fmt.Sprintf("[+] SSH:%v:%v sshkey correct \n %v", Host, Port, string(combo))
+						result = fmt.Sprintf("[+] SSH:%v:%v sshkey correct \n %v", info.Host, info.Port, string(combo))
 					}
 					common.LogSuccess(result)
 				} else {
-				result = fmt.Sprintf("[+] SSH:%v:%v:%v %v", Host, Port, Username, Password)
+					result = fmt.Sprintf("[+] SSH:%v:%v:%v %v", info.Host, info.Port, info.User, info.Password)
 					if common.SshKey != "" {
-					result = fmt.Sprintf("[+] SSH:%v:%v sshkey correct", Host, Port)
+						result = fmt.Sprintf("[+] SSH:%v:%v sshkey correct", info.Host, info.Port)
 					}
 					common.LogSuccess(result)
 				}
 			}
+			ch <- struct{}{}
 		}
-	return flag, err
+	}()
-
+	return ch
 }