fscan二开（一）

源码下载地址：(https://github.com/shadow1ng/fscan)。

var Userdict = map[string][]string{"ftp":        {"ftp", "admin", "www", "web", "root", "db", "wwwroot", "data"},"mysql":      {"root", "mysql"},"mssql":      {"sa", "sql"},"smb":        {"administrator", "admin", "guest"},"rdp":        {"administrator", "admin", "guest"},"postgresql": {"postgres", "admin"},"ssh":        {"root", "admin"},"mongodb":    {"root", "admin"},"oracle":     {"sys", "system", "admin", "test", "web", "orcl"},   }

var Passwords = []string{"123456", "admin", "admin123", "root", "", "pass123", "pass@123", "password", "123123", "654321", "111111", "123", "1", "admin@123", "Admin@123", "admin123!@#", "{user}", "{user}1", "{user}111", "{user}123", "{user}@123", "{user}_123", "{user}#123", "{user}@111", "{user}@2019", "{user}@123#4", "P@ssw0rd!", "P@ssw0rd", "Passw0rd", "qwe123", "12345678", "test", "test123", "123qwe", "123qwe!@#", "123456789", "123321", "666666", "a123456.", "123456~a", "123456!a", "000000", "1234567890", "8888888", "!QAZ2wsx", "1qaz2wsx", "abc123", "abc123456", "1qaz@WSX", "a11111", "a12345", "Aa1234", "Aa1234.", "Aa12345", "a123456", "a123123", "Aa123123", "Aa123456", "Aa12345.", "sysadmin", "system", "1qaz!QAZ", "2wsx@WSX", "qwe123!@#", "Aa123456!", "A123456s!", "sa123456", "1q2w3e", "Charge123", "Aa123456789"}

var PortGroup = map[string]string{"ftp":         "21","ssh":         "22","findnet":     "135","netbios":     "139","smb":         "445","mssql":       "1433","oracle":      "1521","mysql":       "3306","rdp":         "3389","psql":        "5432","redis":       "6379","fcgi":        "9000",// 省略部分以简洁展示}

varOutputfile = "result.txt"varIsSave = truevarWebport = "80,81,82,83,84,85,86,87,88,89,90,91,92,98,99,443,800,801,808,880,888,889,1000,1010,1080,1081,1082,1099,1118,1888,2008,2020,2100,2375,2379,3000,3008,3128,3505,5900,59015555,6080,6648,6868,7000,7001,7002,7003,7004,7005,7007,7008,7070,7071,7074,7078,7080,7088,7200,7680,7687,7688,7777,7890,8000,8001,8002,8003,8004,8006,8008,8009,8010,8011,8012,8016,8018,8020,8028,8030,8038,8042,8044,8046,8048,8053,8060,8069,8070,8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8091,8092,8093,8094,8095,8096,8097,8098,8099,8100,8101,8108,8118,8161,8172,8180,8181,8200,8222,8244,8258,8280,8288,8300,8360,8443,8448,8484,8800,8834,8838,8848,8858,8868,8879,8880,8881,8888,8899,8983,8989,9000,9001,9002,9008,9010,9043,9060,9080,9081,9082,9083,9084,9085,9086,9087,9088,9089,9090,9091,9092,9093,9094,9095,9096,9097,9098,9099,9100,9200,9443,9448,9800,9981,9986,9988,9998,9999,10000,10001,10002,10004,10008,10010,10250,12018,12443,14000,16080,18000,18001,18002,18004,18008,18080,18082,18088,18090,18098,19001,20000,20720,21000,21501,21502,28018,20880"varDefaultPorts = "21,22,80,81,135,139,443,445,1433,1521,3306,5432,6379,7001,8000,8080,8089,9000,9200,11211,27017"

var PORTList = map[string]int{     ......    // 省略部分以简洁展示"mem":         11211,"mgo":         27017,"ms17010":     1000001,"cve20200796": 1000002,"web":         1000003,"webonly":     1000003,"webpoc":      1000003,"smb2":        1000004,"wmiexec":     1000005,"all":         0,"portscan":    0,"icmp":        0,"main":        0,}

funcScan(info common.HostInfo) {   fmt.Println("start infoscan")   Hosts, err := common.ParseIP(info.Host, common.HostFile, common.NoHosts)if err != nil {      fmt.Println("len(hosts)==0", err)return   }   lib.Inithttp()var ch = make(chanstruct{}, common.Threads)var wg = sync.WaitGroup{}   web := strconv.Itoa(common.PORTList["web"])   ms17010 := strconv.Itoa(common.PORTList["ms17010"])iflen(Hosts) > 0 || len(common.HostPort) > 0 {if common.NoPing == false && len(Hosts) > 1 || common.Scantype == "icmp" {          Hosts = CheckLive(Hosts, common.Ping)          fmt.Println("[*] Icmp alive hosts len is:", len(Hosts))      }if common.Scantype == "icmp" {          common.LogWG.Wait()return   }var AlivePorts []stringif common.Scantype == "webonly" || common.Scantype == "webpoc" {   AlivePorts = NoPortScan(Hosts, common.Ports)   } elseif common.Scantype == "hostname" {         common.Ports = "139"         AlivePorts = NoPortScan(Hosts, common.Ports)   } elseiflen(Hosts) > 0 {         AlivePorts = PortScan(Hosts, common.Ports, common.Timeout)         fmt.Println("[*] alive ports len is:", len(AlivePorts))if common.Scantype == "portscan" {              common.LogWG.Wait()return         }    } iflen(common.HostPort) > 0 {       AlivePorts = append(AlivePorts, common.HostPort...)       AlivePorts = common.RemoveDuplicate(AlivePorts)       common.HostPort = nil       fmt.Println("[*] AlivePorts len is:", len(AlivePorts))   }

web := strconv.Itoa(common.PORTList["web"])ms17010 := strconv.Itoa(common.PORTList["ms17010"])

var severports []string //severports := []string{"21","22","135"."445","1433","3306","5432","6379","9200","11211","27017"...}for _, port := range common.PORTList {       severports = append(severports, strconv.Itoa(port))   }   fmt.Println("start vulscan")for _, targetIP := range AlivePorts {       info.Host, info.Ports = strings.Split(targetIP, ":")[0], strings.Split(targetIP, ":")[1]if common.Scantype == "all" || common.Scantype == "main" {           switch {case info.Ports == "135":               AddScan(info.Ports, info, &ch, &wg) //findnetif common.IsWmi {                   AddScan("1000005", info, &ch, &wg) //wmiexec               }case info.Ports == "445":               AddScan(ms17010, info, &ch, &wg) //ms17010               //AddScan(info.Ports, info, ch, &wg)  //smb               //AddScan("1000002", info, ch, &wg) //smbghostcase info.Ports == "9000":               AddScan(web, info, &ch, &wg)        //http               AddScan(info.Ports, info, &ch, &wg) //fcgiscancase IsContain(severports, info.Ports):               AddScan(info.Ports, info, &ch, &wg) //plugins scan           default:               AddScan(web, info, &ch, &wg) //webtitle               }       } else {           scantype := strconv.Itoa(common.PORTList[common.Scantype])           AddScan(scantype, info, &ch, &wg)           }      }  }for _, url := range common.Urls {      info.Url = url      AddScan(web, info, &ch, &wg)  }  wg.Wait()  common.LogWG.Wait()  close(common.Results)  fmt.Printf("已完成 %v/%vn", common.End, common.Num)}

funcAddScan(scantype string, info common.HostInfo, ch *chanstruct{}, wg *sync.WaitGroup) {   *ch <- struct{}{}   wg.Add(1)gofunc() {       Mutex.Lock()       common.Num += 1       Mutex.Unlock()       ScanFunc(&scantype, &info)       Mutex.Lock()       common.End += 1       Mutex.Unlock()       wg.Done()       <-*ch   }()}

funcScanFunc(name *string, info *common.HostInfo) {    f := reflect.ValueOf(PluginList[*name])    in := []reflect.Value{reflect.ValueOf(info)}    f.Call(in)}

var PluginList = map[string]interface{}{   ......   // 省略部分以简洁展示"9000":    FcgiScan,"11211":   MemcachedScan,"27017":   MongodbScan,"1000001": MS17010,"1000002": SmbGhost,"1000003": WebTitle,"1000004": SmbScan2,"1000005": WmiExec,}