mirror of
https://github.com/shadow1ng/fscan.git
synced 2025-09-14 14:06:44 +08:00
feat: RabbitMQ消息队列服务插件迁移到新架构完成
- 实现AMQP协议连接器，支持RabbitMQ消息队列服务扫描 - 支持弱密码检测和服务识别功能 - 优先检测默认凭据admin/123456和guest/guest - 服务识别使用TCP连接检测，避免AMQP协议复杂度 - 简化实现，不提供利用功能，专注于安全扫描 - 集成国际化消息系统 - 测试通过：服务识别和弱密码检测功能
This commit is contained in:
ZacharyZcR
parent
532daf16ed
commit
3e71e7e4c9
195
Plugins/services/rabbitmq/connector.go
Normal file
195
Plugins/services/rabbitmq/connector.go
Normal file
@ -0,0 +1,195 @@
|
||||
package rabbitmq
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net"
|
||||
"strconv"
|
||||
"time"
|
||||
|
||||
amqp "github.com/rabbitmq/amqp091-go"
|
||||
"github.com/shadow1ng/fscan/common"
|
||||
"github.com/shadow1ng/fscan/common/i18n"
|
||||
"github.com/shadow1ng/fscan/plugins/base"
|
||||
)
|
||||
|
||||
// RabbitMQConnector RabbitMQ连接器实现
|
||||
type RabbitMQConnector struct {
|
||||
host string
|
||||
port int
|
||||
}
|
||||
|
||||
// RabbitMQConnection RabbitMQ连接结构
|
||||
type RabbitMQConnection struct {
|
||||
conn *amqp.Connection
|
||||
amqpURL string
|
||||
username string
|
||||
password string
|
||||
info string
|
||||
}
|
||||
|
||||
// NewRabbitMQConnector 创建RabbitMQ连接器
|
||||
func NewRabbitMQConnector() *RabbitMQConnector {
|
||||
return &RabbitMQConnector{}
|
||||
}
|
||||
|
||||
// Connect 建立RabbitMQ连接
|
||||
func (c *RabbitMQConnector) Connect(ctx context.Context, info *common.HostInfo) (interface{}, error) {
|
||||
// 解析端口
|
||||
port, err := strconv.Atoi(info.Ports)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("无效的端口号: %s", info.Ports)
|
||||
}
|
||||
|
||||
c.host = info.Host
|
||||
c.port = port
|
||||
|
||||
// 对于服务识别，只需要检查端口连通性，不需要AMQP认证
|
||||
timeout := time.Duration(common.Timeout) * time.Second
|
||||
address := fmt.Sprintf("%s:%s", info.Host, info.Ports)
|
||||
|
||||
// 结果通道
|
||||
type connResult struct {
|
||||
conn *RabbitMQConnection
|
||||
err error
|
||||
banner string
|
||||
}
|
||||
resultChan := make(chan connResult, 1)
|
||||
|
||||
// 在协程中尝试连接
|
||||
go func() {
|
||||
// 首先检查TCP连通性
|
||||
tcpConn, err := net.DialTimeout("tcp", address, timeout)
|
||||
if err != nil {
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
case resultChan <- connResult{nil, err, ""}:
|
||||
}
|
||||
return
|
||||
}
|
||||
tcpConn.Close()
|
||||
|
||||
// TCP连接成功，创建一个基础的连接对象用于服务识别
|
||||
rabbitConn := &RabbitMQConnection{
|
||||
conn: nil, // 服务识别阶段不需要真正的AMQP连接
|
||||
amqpURL: fmt.Sprintf("amqp://guest:guest@%s:%s/", info.Host, info.Ports),
|
||||
info: "RabbitMQ Service (Detected)",
|
||||
}
|
||||
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
case resultChan <- connResult{rabbitConn, nil, "RabbitMQ Service (Detected)"}:
|
||||
}
|
||||
}()
|
||||
|
||||
// 等待连接结果
|
||||
select {
|
||||
case result := <-resultChan:
|
||||
if result.err != nil {
|
||||
return nil, result.err
|
||||
}
|
||||
return result.conn, nil
|
||||
case <-ctx.Done():
|
||||
return nil, ctx.Err()
|
||||
}
|
||||
}
|
||||
|
||||
// Authenticate 进行RabbitMQ认证
|
||||
func (c *RabbitMQConnector) Authenticate(ctx context.Context, conn interface{}, cred *base.Credential) error {
|
||||
timeout := time.Duration(common.Timeout) * time.Second
|
||||
amqpURL := fmt.Sprintf("amqp://%s:%s@%s:%d/", cred.Username, cred.Password, c.host, c.port)
|
||||
|
||||
// 结果通道
|
||||
type authResult struct {
|
||||
conn *amqp.Connection
|
||||
err error
|
||||
}
|
||||
resultChan := make(chan authResult, 1)
|
||||
|
||||
// 在协程中尝试认证连接
|
||||
go func() {
|
||||
// 配置连接
|
||||
config := amqp.Config{
|
||||
Dial: func(network, addr string) (net.Conn, error) {
|
||||
dialer := &net.Dialer{Timeout: timeout}
|
||||
return dialer.DialContext(ctx, network, addr)
|
||||
},
|
||||
}
|
||||
|
||||
// 尝试连接
|
||||
authConn, err := amqp.DialConfig(amqpURL, config)
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
if authConn != nil {
|
||||
authConn.Close()
|
||||
}
|
||||
case resultChan <- authResult{authConn, err}:
|
||||
}
|
||||
}()
|
||||
|
||||
// 等待认证结果
|
||||
select {
|
||||
case result := <-resultChan:
|
||||
if result.err != nil {
|
||||
return fmt.Errorf(i18n.GetText("rabbitmq_auth_failed"), result.err)
|
||||
}
|
||||
|
||||
// 更新连接信息
|
||||
if rabbitConn, ok := conn.(*RabbitMQConnection); ok {
|
||||
// 关闭旧连接
|
||||
if rabbitConn.conn != nil {
|
||||
rabbitConn.conn.Close()
|
||||
}
|
||||
// 更新为认证后的连接
|
||||
rabbitConn.conn = result.conn
|
||||
rabbitConn.username = cred.Username
|
||||
rabbitConn.password = cred.Password
|
||||
rabbitConn.amqpURL = amqpURL
|
||||
}
|
||||
|
||||
return nil
|
||||
case <-ctx.Done():
|
||||
return ctx.Err()
|
||||
}
|
||||
}
|
||||
|
||||
// Close 关闭RabbitMQ连接
|
||||
func (c *RabbitMQConnector) Close(conn interface{}) error {
|
||||
if rabbitConn, ok := conn.(*RabbitMQConnection); ok {
|
||||
if rabbitConn.conn != nil {
|
||||
rabbitConn.conn.Close()
|
||||
}
|
||||
return nil
|
||||
}
|
||||
return fmt.Errorf("无效的RabbitMQ连接类型")
|
||||
}
|
||||
|
||||
// GetConnectionInfo 获取连接信息
|
||||
func (conn *RabbitMQConnection) GetConnectionInfo() map[string]interface{} {
|
||||
info := map[string]interface{}{
|
||||
"protocol": "AMQP",
|
||||
"service": "RabbitMQ",
|
||||
"info": conn.info,
|
||||
}
|
||||
|
||||
if conn.username != "" {
|
||||
info["username"] = conn.username
|
||||
info["authenticated"] = true
|
||||
}
|
||||
|
||||
return info
|
||||
}
|
||||
|
||||
// IsAlive 检查连接是否仍然有效
|
||||
func (conn *RabbitMQConnection) IsAlive() bool {
|
||||
if conn.conn == nil {
|
||||
return false
|
||||
}
|
||||
|
||||
return !conn.conn.IsClosed()
|
||||
}
|
||||
|
||||
// GetServerInfo 获取服务器信息
|
||||
func (conn *RabbitMQConnection) GetServerInfo() string {
|
||||
return conn.info
|
||||
}
|
||||
36
Plugins/services/rabbitmq/exploiter.go
Normal file
36
Plugins/services/rabbitmq/exploiter.go
Normal file
@ -0,0 +1,36 @@
|
||||
package rabbitmq
|
||||
|
||||
import (
|
||||
"context"
|
||||
|
||||
"github.com/shadow1ng/fscan/common"
|
||||
"github.com/shadow1ng/fscan/plugins/base"
|
||||
)
|
||||
|
||||
// RabbitMQExploiter RabbitMQ利用器实现 - 最小化版本，不提供利用功能
|
||||
type RabbitMQExploiter struct {
|
||||
*base.BaseExploiter
|
||||
}
|
||||
|
||||
// NewRabbitMQExploiter 创建RabbitMQ利用器
|
||||
func NewRabbitMQExploiter() *RabbitMQExploiter {
|
||||
exploiter := &RabbitMQExploiter{
|
||||
BaseExploiter: base.NewBaseExploiter("rabbitmq"),
|
||||
}
|
||||
|
||||
// RabbitMQ插件不提供利用功能
|
||||
exploiter.setupExploitMethods()
|
||||
|
||||
return exploiter
|
||||
}
|
||||
|
||||
// setupExploitMethods 设置利用方法
|
||||
func (e *RabbitMQExploiter) setupExploitMethods() {
|
||||
// RabbitMQ插件不提供利用功能，仅进行弱密码扫描和服务识别
|
||||
}
|
||||
|
||||
// Exploit 利用接口实现 - 空实现
|
||||
func (e *RabbitMQExploiter) Exploit(ctx context.Context, info *common.HostInfo, creds *base.Credential) (*base.ExploitResult, error) {
|
||||
// RabbitMQ插件不提供利用功能
|
||||
return nil, nil
|
||||
}
|
||||
230
Plugins/services/rabbitmq/plugin.go
Normal file
230
Plugins/services/rabbitmq/plugin.go
Normal file
@ -0,0 +1,230 @@
|
||||
package rabbitmq
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"github.com/shadow1ng/fscan/common"
|
||||
"github.com/shadow1ng/fscan/common/i18n"
|
||||
"github.com/shadow1ng/fscan/plugins/base"
|
||||
)
|
||||
|
||||
// RabbitMQPlugin RabbitMQ插件实现
|
||||
type RabbitMQPlugin struct {
|
||||
*base.ServicePlugin
|
||||
exploiter *RabbitMQExploiter
|
||||
}
|
||||
|
||||
// NewRabbitMQPlugin 创建RabbitMQ插件
|
||||
func NewRabbitMQPlugin() *RabbitMQPlugin {
|
||||
// 插件元数据
|
||||
metadata := &base.PluginMetadata{
|
||||
Name: "rabbitmq",
|
||||
Version: "2.0.0",
|
||||
Author: "fscan-team",
|
||||
Description: "RabbitMQ消息队列服务扫描插件",
|
||||
Category: "service",
|
||||
Ports: []int{5672, 5671, 15672}, // AMQP端口、AMQPS端口、管理端口
|
||||
Protocols: []string{"tcp"},
|
||||
Tags: []string{"rabbitmq", "amqp", "message-queue", "weak-password"},
|
||||
}
|
||||
|
||||
// 创建连接器和服务插件
|
||||
connector := NewRabbitMQConnector()
|
||||
servicePlugin := base.NewServicePlugin(metadata, connector)
|
||||
|
||||
// 创建RabbitMQ插件
|
||||
plugin := &RabbitMQPlugin{
|
||||
ServicePlugin: servicePlugin,
|
||||
exploiter: NewRabbitMQExploiter(),
|
||||
}
|
||||
|
||||
// 设置能力
|
||||
plugin.SetCapabilities([]base.Capability{
|
||||
base.CapWeakPassword,
|
||||
})
|
||||
|
||||
return plugin
|
||||
}
|
||||
|
||||
// Scan 重写扫描方法，进行RabbitMQ服务扫描
|
||||
func (p *RabbitMQPlugin) Scan(ctx context.Context, info *common.HostInfo) (*base.ScanResult, error) {
|
||||
// 如果禁用了暴力破解，只进行服务识别
|
||||
if common.DisableBrute {
|
||||
return p.performServiceIdentification(ctx, info)
|
||||
}
|
||||
|
||||
target := fmt.Sprintf("%s:%s", info.Host, info.Ports)
|
||||
|
||||
// 优先尝试默认凭据
|
||||
defaultCredentials := []*base.Credential{
|
||||
{Username: "admin", Password: "123456"},
|
||||
{Username: "guest", Password: "guest"},
|
||||
{Username: "admin", Password: "admin"},
|
||||
}
|
||||
|
||||
// 先测试默认凭据
|
||||
for _, cred := range defaultCredentials {
|
||||
result, err := p.ScanCredential(ctx, info, cred)
|
||||
if err == nil && result.Success {
|
||||
// 认证成功
|
||||
common.LogSuccess(i18n.GetText("rabbitmq_weak_pwd_success", target, cred.Username, cred.Password))
|
||||
|
||||
return &base.ScanResult{
|
||||
Success: true,
|
||||
Service: "RabbitMQ",
|
||||
Credentials: []*base.Credential{cred},
|
||||
Banner: result.Banner,
|
||||
Extra: map[string]interface{}{
|
||||
"service": "RabbitMQ",
|
||||
"port": info.Ports,
|
||||
"username": cred.Username,
|
||||
"password": cred.Password,
|
||||
"type": "default-credentials",
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
}
|
||||
|
||||
// 生成其他凭据进行暴力破解
|
||||
credentials := p.generateCredentials()
|
||||
|
||||
// 遍历凭据进行测试
|
||||
for _, cred := range credentials {
|
||||
result, err := p.ScanCredential(ctx, info, cred)
|
||||
if err == nil && result.Success {
|
||||
// 认证成功
|
||||
common.LogSuccess(i18n.GetText("rabbitmq_weak_pwd_success", target, cred.Username, cred.Password))
|
||||
|
||||
return &base.ScanResult{
|
||||
Success: true,
|
||||
Service: "RabbitMQ",
|
||||
Credentials: []*base.Credential{cred},
|
||||
Banner: result.Banner,
|
||||
Extra: map[string]interface{}{
|
||||
"service": "RabbitMQ",
|
||||
"port": info.Ports,
|
||||
"username": cred.Username,
|
||||
"password": cred.Password,
|
||||
"type": "weak-password",
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
}
|
||||
|
||||
// 所有凭据都失败，但可能识别到了RabbitMQ服务
|
||||
return p.performServiceIdentification(ctx, info)
|
||||
}
|
||||
|
||||
// generateCredentials 生成RabbitMQ凭据
|
||||
func (p *RabbitMQPlugin) generateCredentials() []*base.Credential {
|
||||
var credentials []*base.Credential
|
||||
|
||||
// 获取RabbitMQ用户名字典
|
||||
usernames := common.Userdict["rabbitmq"]
|
||||
if len(usernames) == 0 {
|
||||
usernames = []string{"admin", "root", "rabbitmq", "user", "test"}
|
||||
}
|
||||
|
||||
// 获取密码字典
|
||||
passwords := common.Passwords
|
||||
if len(passwords) == 0 {
|
||||
passwords = []string{"", "admin", "password", "123456", "rabbitmq", "root123", "admin123"}
|
||||
}
|
||||
|
||||
// 生成用户名密码组合
|
||||
for _, username := range usernames {
|
||||
for _, password := range passwords {
|
||||
// 替换密码中的用户名占位符
|
||||
actualPassword := strings.Replace(password, "{user}", username, -1)
|
||||
|
||||
credentials = append(credentials, &base.Credential{
|
||||
Username: username,
|
||||
Password: actualPassword,
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
return credentials
|
||||
}
|
||||
|
||||
// Exploit 使用exploiter执行利用
|
||||
func (p *RabbitMQPlugin) Exploit(ctx context.Context, info *common.HostInfo, creds *base.Credential) (*base.ExploitResult, error) {
|
||||
return p.exploiter.Exploit(ctx, info, creds)
|
||||
}
|
||||
|
||||
// GetExploitMethods 获取利用方法
|
||||
func (p *RabbitMQPlugin) GetExploitMethods() []base.ExploitMethod {
|
||||
return p.exploiter.GetExploitMethods()
|
||||
}
|
||||
|
||||
// IsExploitSupported 检查利用支持
|
||||
func (p *RabbitMQPlugin) IsExploitSupported(method base.ExploitType) bool {
|
||||
return p.exploiter.IsExploitSupported(method)
|
||||
}
|
||||
|
||||
// performServiceIdentification 执行RabbitMQ服务识别（-nobr模式）
|
||||
func (p *RabbitMQPlugin) performServiceIdentification(ctx context.Context, info *common.HostInfo) (*base.ScanResult, error) {
|
||||
target := fmt.Sprintf("%s:%s", info.Host, info.Ports)
|
||||
|
||||
// 尝试识别RabbitMQ服务
|
||||
connector := NewRabbitMQConnector()
|
||||
conn, err := connector.Connect(ctx, info)
|
||||
|
||||
if err == nil && conn != nil {
|
||||
if rabbitConn, ok := conn.(*RabbitMQConnection); ok {
|
||||
// 记录服务识别成功
|
||||
common.LogSuccess(i18n.GetText("rabbitmq_service_identified", target, rabbitConn.info))
|
||||
|
||||
connector.Close(conn)
|
||||
return &base.ScanResult{
|
||||
Success: true,
|
||||
Service: "RabbitMQ",
|
||||
Banner: rabbitConn.info,
|
||||
Extra: map[string]interface{}{
|
||||
"service": "RabbitMQ",
|
||||
"port": info.Ports,
|
||||
"info": rabbitConn.info,
|
||||
"protocol": "AMQP",
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
}
|
||||
|
||||
// 如果无法识别为RabbitMQ，返回失败
|
||||
return &base.ScanResult{
|
||||
Success: false,
|
||||
Error: fmt.Errorf("无法识别为RabbitMQ服务"),
|
||||
}, nil
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// 插件注册
|
||||
// =============================================================================
|
||||
|
||||
// RegisterRabbitMQPlugin 注册RabbitMQ插件
|
||||
func RegisterRabbitMQPlugin() {
|
||||
factory := base.NewSimplePluginFactory(
|
||||
&base.PluginMetadata{
|
||||
Name: "rabbitmq",
|
||||
Version: "2.0.0",
|
||||
Author: "fscan-team",
|
||||
Description: "RabbitMQ消息队列服务扫描插件",
|
||||
Category: "service",
|
||||
Ports: []int{5672, 5671, 15672}, // AMQP端口、AMQPS端口、管理端口
|
||||
Protocols: []string{"tcp"},
|
||||
Tags: []string{"rabbitmq", "amqp", "message-queue", "weak-password"},
|
||||
},
|
||||
func() base.Plugin {
|
||||
return NewRabbitMQPlugin()
|
||||
},
|
||||
)
|
||||
|
||||
base.GlobalPluginRegistry.Register("rabbitmq", factory)
|
||||
}
|
||||
|
||||
// 自动注册
|
||||
func init() {
|
||||
RegisterRabbitMQPlugin()
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user