mirror of
https://github.com/shadow1ng/fscan.git
synced 2025-09-14 14:06:44 +08:00
feat: 添加Rsync和SMTP插件实现文件
包含新架构下的连接器、利用器和插件主体实现： - rsync服务插件：支持RSYNCD协议和模块扫描 - smtp服务插件：支持SMTP协议和PLAIN认证 - PostgreSQL插件文件（之前遗漏） - Docker测试环境配置文件
This commit is contained in:
ZacharyZcR
parent
188f949f09
commit
fbc75bb709
229
Plugins/services/postgresql/connector.go
Normal file
229
Plugins/services/postgresql/connector.go
Normal file
@ -0,0 +1,229 @@
|
||||
package postgresql
|
||||
|
||||
import (
|
||||
"context"
|
||||
"database/sql"
|
||||
"database/sql/driver"
|
||||
"fmt"
|
||||
"net"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/lib/pq"
|
||||
"github.com/shadow1ng/fscan/common"
|
||||
"github.com/shadow1ng/fscan/plugins/base"
|
||||
)
|
||||
|
||||
// PostgreSQLProxyDialer 自定义PostgreSQL代理拨号器
|
||||
type PostgreSQLProxyDialer struct {
|
||||
timeout time.Duration
|
||||
}
|
||||
|
||||
// Dial 实现pq.Dialer接口，支持socks代理
|
||||
func (d *PostgreSQLProxyDialer) Dial(network, address string) (net.Conn, error) {
|
||||
return common.WrapperTcpWithTimeout(network, address, d.timeout)
|
||||
}
|
||||
|
||||
// DialTimeout 实现具有超时的连接
|
||||
func (d *PostgreSQLProxyDialer) DialTimeout(network, address string, timeout time.Duration) (net.Conn, error) {
|
||||
return common.WrapperTcpWithTimeout(network, address, timeout)
|
||||
}
|
||||
|
||||
// PostgreSQLConnection PostgreSQL连接包装器
|
||||
type PostgreSQLConnection struct {
|
||||
db *sql.DB
|
||||
target string
|
||||
info string
|
||||
}
|
||||
|
||||
// PostgreSQLConnector PostgreSQL连接器实现
|
||||
type PostgreSQLConnector struct{}
|
||||
|
||||
// NewPostgreSQLConnector 创建PostgreSQL连接器
|
||||
func NewPostgreSQLConnector() *PostgreSQLConnector {
|
||||
return &PostgreSQLConnector{}
|
||||
}
|
||||
|
||||
// Connect 连接到PostgreSQL服务器（不进行认证）
|
||||
func (c *PostgreSQLConnector) Connect(ctx context.Context, info *common.HostInfo) (interface{}, error) {
|
||||
target := fmt.Sprintf("%s:%s", info.Host, info.Ports)
|
||||
|
||||
// 尝试建立连接但不进行认证，使用空凭据进行连接尝试
|
||||
db, dbInfo, err := c.createConnection(ctx, info.Host, info.Ports, "", "")
|
||||
if err != nil {
|
||||
// 检查是否是PostgreSQL服务相关错误
|
||||
if c.isPostgreSQLError(err) {
|
||||
// 即使连接失败，但可以识别为PostgreSQL服务
|
||||
return &PostgreSQLConnection{
|
||||
db: nil,
|
||||
target: target,
|
||||
info: "PostgreSQL Database (Service Detected)",
|
||||
}, nil
|
||||
}
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return &PostgreSQLConnection{
|
||||
db: db,
|
||||
target: target,
|
||||
info: dbInfo,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// Authenticate 使用凭据进行认证
|
||||
func (c *PostgreSQLConnector) Authenticate(ctx context.Context, conn interface{}, cred *base.Credential) error {
|
||||
pgConn, ok := conn.(*PostgreSQLConnection)
|
||||
if !ok {
|
||||
return fmt.Errorf("invalid connection type")
|
||||
}
|
||||
|
||||
// 解析目标地址
|
||||
parts := strings.Split(pgConn.target, ":")
|
||||
if len(parts) != 2 {
|
||||
return fmt.Errorf("invalid target format")
|
||||
}
|
||||
|
||||
host := parts[0]
|
||||
port := parts[1]
|
||||
|
||||
// 使用提供的凭据创建新连接
|
||||
db, info, err := c.createConnection(ctx, host, port, cred.Username, cred.Password)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// 更新连接信息
|
||||
if pgConn.db != nil {
|
||||
pgConn.db.Close()
|
||||
}
|
||||
pgConn.db = db
|
||||
pgConn.info = info
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// Close 关闭连接
|
||||
func (c *PostgreSQLConnector) Close(conn interface{}) error {
|
||||
if pgConn, ok := conn.(*PostgreSQLConnection); ok && pgConn.db != nil {
|
||||
return pgConn.db.Close()
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// createConnection 创建PostgreSQL数据库连接
|
||||
func (c *PostgreSQLConnector) createConnection(ctx context.Context, host, port, username, password string) (*sql.DB, string, error) {
|
||||
timeout := time.Duration(common.Timeout) * time.Second
|
||||
|
||||
// 构造连接字符串
|
||||
connStr := fmt.Sprintf(
|
||||
"postgres://%s:%s@%s:%s/postgres?sslmode=disable&connect_timeout=%d",
|
||||
username, password, host, port, int(timeout.Seconds()),
|
||||
)
|
||||
|
||||
var db *sql.DB
|
||||
var err error
|
||||
|
||||
// 检查是否需要使用socks代理
|
||||
if common.Socks5Proxy != "" {
|
||||
// 使用自定义dialer通过socks代理连接
|
||||
dialer := &PostgreSQLProxyDialer{
|
||||
timeout: timeout,
|
||||
}
|
||||
|
||||
// 使用pq.DialOpen通过自定义dialer建立连接
|
||||
conn, err := pq.DialOpen(dialer, connStr)
|
||||
if err != nil {
|
||||
return nil, "", err
|
||||
}
|
||||
|
||||
// 转换为sql.DB进行测试
|
||||
db = sql.OpenDB(&postgresConnector{conn: conn})
|
||||
} else {
|
||||
// 使用标准连接方式
|
||||
db, err = sql.Open("postgres", connStr)
|
||||
if err != nil {
|
||||
return nil, "", err
|
||||
}
|
||||
}
|
||||
|
||||
// 设置连接参数
|
||||
db.SetConnMaxLifetime(timeout)
|
||||
db.SetMaxOpenConns(1)
|
||||
db.SetMaxIdleConns(0)
|
||||
|
||||
// 创建ping上下文
|
||||
pingCtx, pingCancel := context.WithTimeout(ctx, timeout)
|
||||
defer pingCancel()
|
||||
|
||||
// 使用上下文测试连接
|
||||
err = db.PingContext(pingCtx)
|
||||
if err != nil {
|
||||
db.Close()
|
||||
return nil, "", err
|
||||
}
|
||||
|
||||
// 获取数据库信息
|
||||
info := c.getDatabaseInfo(db, pingCtx)
|
||||
return db, info, nil
|
||||
}
|
||||
|
||||
// getDatabaseInfo 获取PostgreSQL数据库信息
|
||||
func (c *PostgreSQLConnector) getDatabaseInfo(db *sql.DB, ctx context.Context) string {
|
||||
var version string
|
||||
err := db.QueryRowContext(ctx, "SELECT version()").Scan(&version)
|
||||
if err != nil {
|
||||
return "PostgreSQL Database"
|
||||
}
|
||||
|
||||
// 提取版本信息的关键部分
|
||||
if strings.Contains(version, "PostgreSQL") {
|
||||
parts := strings.Fields(version)
|
||||
if len(parts) >= 2 {
|
||||
return fmt.Sprintf("%s %s", parts[0], parts[1])
|
||||
}
|
||||
}
|
||||
|
||||
return version
|
||||
}
|
||||
|
||||
// isPostgreSQLError 检查是否是PostgreSQL相关错误
|
||||
func (c *PostgreSQLConnector) isPostgreSQLError(err error) bool {
|
||||
if err == nil {
|
||||
return false
|
||||
}
|
||||
|
||||
errorStr := strings.ToLower(err.Error())
|
||||
postgresErrorIndicators := []string{
|
||||
"postgres",
|
||||
"postgresql",
|
||||
"authentication failed",
|
||||
"password authentication failed",
|
||||
"database",
|
||||
"connection refused",
|
||||
"pq:",
|
||||
"invalid authorization specification",
|
||||
"role",
|
||||
"does not exist",
|
||||
}
|
||||
|
||||
for _, indicator := range postgresErrorIndicators {
|
||||
if strings.Contains(errorStr, indicator) {
|
||||
return true
|
||||
}
|
||||
}
|
||||
|
||||
return false
|
||||
}
|
||||
|
||||
// postgresConnector 封装driver.Conn为sql.driver.Connector
|
||||
type postgresConnector struct {
|
||||
conn driver.Conn
|
||||
}
|
||||
|
||||
func (c *postgresConnector) Connect(ctx context.Context) (driver.Conn, error) {
|
||||
return c.conn, nil
|
||||
}
|
||||
|
||||
func (c *postgresConnector) Driver() driver.Driver {
|
||||
return &pq.Driver{}
|
||||
}
|
||||
42
Plugins/services/postgresql/exploiter.go
Normal file
42
Plugins/services/postgresql/exploiter.go
Normal file
@ -0,0 +1,42 @@
|
||||
package postgresql
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
|
||||
"github.com/shadow1ng/fscan/common"
|
||||
"github.com/shadow1ng/fscan/plugins/base"
|
||||
)
|
||||
|
||||
// PostgreSQLExploiter PostgreSQL利用器实现
|
||||
type PostgreSQLExploiter struct{}
|
||||
|
||||
// NewPostgreSQLExploiter 创建PostgreSQL利用器
|
||||
func NewPostgreSQLExploiter() *PostgreSQLExploiter {
|
||||
return &PostgreSQLExploiter{}
|
||||
}
|
||||
|
||||
// Exploit 执行PostgreSQL利用
|
||||
func (e *PostgreSQLExploiter) Exploit(ctx context.Context, info *common.HostInfo, creds *base.Credential) (*base.ExploitResult, error) {
|
||||
// PostgreSQL插件主要用于服务识别和认证测试，不进行进一步利用
|
||||
return &base.ExploitResult{
|
||||
Success: false,
|
||||
Error: fmt.Errorf("PostgreSQL插件不支持进一步利用"),
|
||||
}, nil
|
||||
}
|
||||
|
||||
// GetExploitMethods 获取支持的利用方法
|
||||
func (e *PostgreSQLExploiter) GetExploitMethods() []base.ExploitMethod {
|
||||
return []base.ExploitMethod{
|
||||
{
|
||||
Name: "信息收集",
|
||||
Type: base.ExploitDataExtraction,
|
||||
Description: "收集PostgreSQL数据库信息",
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// IsExploitSupported 检查是否支持指定的利用类型
|
||||
func (e *PostgreSQLExploiter) IsExploitSupported(method base.ExploitType) bool {
|
||||
return method == base.ExploitDataExtraction
|
||||
}
|
||||
200
Plugins/services/postgresql/plugin.go
Normal file
200
Plugins/services/postgresql/plugin.go
Normal file
@ -0,0 +1,200 @@
|
||||
package postgresql
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"github.com/shadow1ng/fscan/common"
|
||||
"github.com/shadow1ng/fscan/common/i18n"
|
||||
"github.com/shadow1ng/fscan/plugins/base"
|
||||
)
|
||||
|
||||
// PostgreSQLPlugin PostgreSQL插件实现
|
||||
type PostgreSQLPlugin struct {
|
||||
*base.ServicePlugin
|
||||
exploiter *PostgreSQLExploiter
|
||||
}
|
||||
|
||||
// NewPostgreSQLPlugin 创建PostgreSQL插件
|
||||
func NewPostgreSQLPlugin() *PostgreSQLPlugin {
|
||||
// 插件元数据
|
||||
metadata := &base.PluginMetadata{
|
||||
Name: "postgresql",
|
||||
Version: "2.0.0",
|
||||
Author: "fscan-team",
|
||||
Description: "PostgreSQL数据库扫描和利用插件",
|
||||
Category: "service",
|
||||
Ports: []int{5432}, // 默认PostgreSQL端口
|
||||
Protocols: []string{"tcp"},
|
||||
Tags: []string{"postgresql", "postgres", "database", "weak-password"},
|
||||
}
|
||||
|
||||
// 创建连接器和服务插件
|
||||
connector := NewPostgreSQLConnector()
|
||||
servicePlugin := base.NewServicePlugin(metadata, connector)
|
||||
|
||||
// 创建PostgreSQL插件
|
||||
plugin := &PostgreSQLPlugin{
|
||||
ServicePlugin: servicePlugin,
|
||||
exploiter: NewPostgreSQLExploiter(),
|
||||
}
|
||||
|
||||
// 设置能力
|
||||
plugin.SetCapabilities([]base.Capability{
|
||||
base.CapWeakPassword,
|
||||
base.CapDataExtraction,
|
||||
})
|
||||
|
||||
return plugin
|
||||
}
|
||||
|
||||
// Scan 重写扫描方法，进行PostgreSQL服务扫描
|
||||
func (p *PostgreSQLPlugin) Scan(ctx context.Context, info *common.HostInfo) (*base.ScanResult, error) {
|
||||
// 如果禁用了暴力破解，只进行服务识别
|
||||
if common.DisableBrute {
|
||||
return p.performServiceIdentification(ctx, info)
|
||||
}
|
||||
|
||||
target := fmt.Sprintf("%s:%s", info.Host, info.Ports)
|
||||
|
||||
// 生成凭据进行暴力破解
|
||||
credentials := p.generateCredentials()
|
||||
|
||||
// 遍历凭据进行测试
|
||||
for _, cred := range credentials {
|
||||
result, err := p.ScanCredential(ctx, info, cred)
|
||||
if err == nil && result.Success {
|
||||
// 认证成功
|
||||
common.LogSuccess(i18n.GetText("postgresql_auth_success", target, cred.Username, cred.Password))
|
||||
|
||||
return &base.ScanResult{
|
||||
Success: true,
|
||||
Service: "PostgreSQL",
|
||||
Credentials: []*base.Credential{cred},
|
||||
Banner: result.Banner,
|
||||
Extra: map[string]interface{}{
|
||||
"service": "PostgreSQL",
|
||||
"port": info.Ports,
|
||||
"username": cred.Username,
|
||||
"password": cred.Password,
|
||||
"type": "weak-password",
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
}
|
||||
|
||||
// 所有凭据都失败，但可能识别到了PostgreSQL服务
|
||||
return p.performServiceIdentification(ctx, info)
|
||||
}
|
||||
|
||||
// generateCredentials 生成PostgreSQL凭据
|
||||
func (p *PostgreSQLPlugin) generateCredentials() []*base.Credential {
|
||||
var credentials []*base.Credential
|
||||
|
||||
// 获取PostgreSQL用户名字典
|
||||
usernames := common.Userdict["postgresql"]
|
||||
if len(usernames) == 0 {
|
||||
usernames = []string{"postgres", "admin", "administrator", "root", "user"}
|
||||
}
|
||||
|
||||
// 获取密码字典
|
||||
passwords := common.Passwords
|
||||
if len(passwords) == 0 {
|
||||
passwords = []string{"", "postgres", "admin", "password", "123456", "root"}
|
||||
}
|
||||
|
||||
// 生成用户名密码组合
|
||||
for _, username := range usernames {
|
||||
for _, password := range passwords {
|
||||
// 替换密码中的用户名占位符
|
||||
actualPassword := strings.Replace(password, "{user}", username, -1)
|
||||
|
||||
credentials = append(credentials, &base.Credential{
|
||||
Username: username,
|
||||
Password: actualPassword,
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
return credentials
|
||||
}
|
||||
|
||||
// Exploit 使用exploiter执行利用
|
||||
func (p *PostgreSQLPlugin) Exploit(ctx context.Context, info *common.HostInfo, creds *base.Credential) (*base.ExploitResult, error) {
|
||||
return p.exploiter.Exploit(ctx, info, creds)
|
||||
}
|
||||
|
||||
// GetExploitMethods 获取利用方法
|
||||
func (p *PostgreSQLPlugin) GetExploitMethods() []base.ExploitMethod {
|
||||
return p.exploiter.GetExploitMethods()
|
||||
}
|
||||
|
||||
// IsExploitSupported 检查利用支持
|
||||
func (p *PostgreSQLPlugin) IsExploitSupported(method base.ExploitType) bool {
|
||||
return p.exploiter.IsExploitSupported(method)
|
||||
}
|
||||
|
||||
// performServiceIdentification 执行PostgreSQL服务识别（-nobr模式）
|
||||
func (p *PostgreSQLPlugin) performServiceIdentification(ctx context.Context, info *common.HostInfo) (*base.ScanResult, error) {
|
||||
target := fmt.Sprintf("%s:%s", info.Host, info.Ports)
|
||||
|
||||
// 尝试识别PostgreSQL服务
|
||||
connector := NewPostgreSQLConnector()
|
||||
conn, err := connector.Connect(ctx, info)
|
||||
|
||||
if err == nil && conn != nil {
|
||||
if pgConn, ok := conn.(*PostgreSQLConnection); ok {
|
||||
// 记录服务识别成功
|
||||
common.LogSuccess(i18n.GetText("postgresql_service_identified", target, pgConn.info))
|
||||
|
||||
connector.Close(conn)
|
||||
return &base.ScanResult{
|
||||
Success: true,
|
||||
Service: "PostgreSQL",
|
||||
Banner: pgConn.info,
|
||||
Extra: map[string]interface{}{
|
||||
"service": "PostgreSQL",
|
||||
"port": info.Ports,
|
||||
"info": pgConn.info,
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
}
|
||||
|
||||
// 如果无法识别为PostgreSQL，返回失败
|
||||
return &base.ScanResult{
|
||||
Success: false,
|
||||
Error: fmt.Errorf("无法识别为PostgreSQL服务"),
|
||||
}, nil
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// 插件注册
|
||||
// =============================================================================
|
||||
|
||||
// RegisterPostgreSQLPlugin 注册PostgreSQL插件
|
||||
func RegisterPostgreSQLPlugin() {
|
||||
factory := base.NewSimplePluginFactory(
|
||||
&base.PluginMetadata{
|
||||
Name: "postgresql",
|
||||
Version: "2.0.0",
|
||||
Author: "fscan-team",
|
||||
Description: "PostgreSQL数据库扫描和利用插件",
|
||||
Category: "service",
|
||||
Ports: []int{5432}, // 默认PostgreSQL端口
|
||||
Protocols: []string{"tcp"},
|
||||
Tags: []string{"postgresql", "postgres", "database", "weak-password"},
|
||||
},
|
||||
func() base.Plugin {
|
||||
return NewPostgreSQLPlugin()
|
||||
},
|
||||
)
|
||||
|
||||
base.GlobalPluginRegistry.Register("postgresql", factory)
|
||||
}
|
||||
|
||||
// 自动注册
|
||||
func init() {
|
||||
RegisterPostgreSQLPlugin()
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user