fix: 修复了RDP的一个死锁问题

Plugins/FindNet.go

@@ -5,26 +5,25 @@ import (
 	"encoding/hex"
 	"fmt"
 	"github.com/shadow1ng/fscan/Common"
+	"net"
+	"regexp"
 	"strconv"
 	"strings"
 	"time"
+	"unicode"
 )
 
 var (
-	// RPC请求数据包
 	bufferV1, _ = hex.DecodeString("05000b03100000004800000001000000b810b810000000000100000000000100c4fefc9960521b10bbcb00aa0021347a00000000045d888aeb1cc9119fe808002b10486002000000")
 	bufferV2, _ = hex.DecodeString("050000031000000018000000010000000000000000000500")
 	bufferV3, _ = hex.DecodeString("0900ffff0000")
 )
 
-// Findnet 探测Windows网络主机信息的入口函数
 func Findnet(info *Common.HostInfo) error {
 	return FindnetScan(info)
 }
 
-// FindnetScan 通过RPC协议扫描网络主机信息
 func FindnetScan(info *Common.HostInfo) error {
-	// 连接目标RPC端口
 	target := fmt.Sprintf("%s:%v", info.Host, 135)
 	conn, err := Common.WrapperTcpWithTimeout("tcp", target, time.Duration(Common.Timeout)*time.Second)
 	if err != nil {
@@ -32,34 +31,28 @@ func FindnetScan(info *Common.HostInfo) error {
 	}
 	defer conn.Close()
 
-	// 设置连接超时
 	if err = conn.SetDeadline(time.Now().Add(time.Duration(Common.Timeout) * time.Second)); err != nil {
 		return fmt.Errorf("[-] 设置超时失败: %v", err)
 	}
 
-	// 发送第一个RPC请求
 	if _, err = conn.Write(bufferV1); err != nil {
 		return fmt.Errorf("[-] 发送RPC请求1失败: %v", err)
 	}
 
-	// 读取响应
 	reply := make([]byte, 4096)
 	if _, err = conn.Read(reply); err != nil {
 		return fmt.Errorf("[-] 读取RPC响应1失败: %v", err)
 	}
 
-	// 发送第二个RPC请求
 	if _, err = conn.Write(bufferV2); err != nil {
 		return fmt.Errorf("[-] 发送RPC请求2失败: %v", err)
 	}
 
-	// 读取并检查响应
 	n, err := conn.Read(reply)
 	if err != nil || n < 42 {
 		return fmt.Errorf("[-] 读取RPC响应2失败: %v", err)
 	}
 
-	// 解析响应数据
 	text := reply[42:]
 	found := false
 	for i := 0; i < len(text)-5; i++ {
@@ -71,53 +64,74 @@ func FindnetScan(info *Common.HostInfo) error {
 	}
 
 	if !found {
-		fmt.Println("[+] FindNet扫描模块结束...")
 		return fmt.Errorf("[-] 未找到有效的响应标记")
 	}
 
-	// 解析主机信息
 	return read(text, info.Host)
 }
 
-// HexUnicodeStringToString 将16进制Unicode字符串转换为可读字符串
 func HexUnicodeStringToString(src string) string {
-	// 确保输入长度是4的倍数
 	if len(src)%4 != 0 {
-		src += src[:len(src)-len(src)%4]
+		src += strings.Repeat("0", 4-len(src)%4)
 	}
 
-	// 转换为标准Unicode格式
-	var sText string
+	var result strings.Builder
 	for i := 0; i < len(src); i += 4 {
-		sText += "\\u" + src[i+2:i+4] + src[i:i+2] // 调整字节顺序
-	}
+		if i+4 > len(src) {
+			break
+		}
 
-	// 解析每个Unicode字符
-	unicodeChars := strings.Split(sText, "\\u")
-	var result string
-
-	for _, char := range unicodeChars {
-		// 跳过空字符
-		if len(char) < 1 {
+		charCode, err := strconv.ParseInt(src[i+2:i+4]+src[i:i+2], 16, 32)
+		if err != nil {
 			continue
 		}
 
-		// 将16进制转换为整数
-		codePoint, err := strconv.ParseInt(char, 16, 32)
-		if err != nil {
-			return ""
+		if unicode.IsPrint(rune(charCode)) {
+			result.WriteRune(rune(charCode))
 		}
-
-		// 转换为实际字符
-		result += fmt.Sprintf("%c", codePoint)
 	}
 
-	return result
+	return result.String()
+}
+
+func isValidHostname(name string) bool {
+	if len(name) == 0 || len(name) > 255 {
+		return false
+	}
+
+	validHostname := regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]$`)
+	return validHostname.MatchString(name)
+}
+
+func isValidNetworkAddress(addr string) bool {
+	// 检查是否为IPv4或IPv6
+	if ip := net.ParseIP(addr); ip != nil {
+		return true
+	}
+
+	// 检查是否为有效主机名
+	return isValidHostname(addr)
+}
+
+func cleanAndValidateAddress(data []byte) string {
+	// 转换为字符串并清理不可打印字符
+	addr := strings.Map(func(r rune) rune {
+		if unicode.IsPrint(r) {
+			return r
+		}
+		return -1
+	}, string(data))
+
+	// 移除前后空白
+	addr = strings.TrimSpace(addr)
+
+	if isValidNetworkAddress(addr) {
+		return addr
+	}
+	return ""
 }
 
-// read 解析并显示主机网络信息
 func read(text []byte, host string) error {
-	// 将原始数据转换为16进制字符串
 	encodedStr := hex.EncodeToString(text)
 
 	// 解析主机名
@@ -129,34 +143,72 @@ func read(text []byte, host string) error {
 		hostName += encodedStr[i : i+4]
 	}
 
-	// 转换主机名为可读字符串
 	name := HexUnicodeStringToString(hostName)
+	if !isValidHostname(name) {
+		name = ""
+	}
+
+	// 构建基础结果
+	result := fmt.Sprintf("[*] NetInfo 扫描结果")
+	result += fmt.Sprintf("\n[*] 目标主机: %s", host)
+	if name != "" {
+		result += fmt.Sprintf("\n[*] 主机名: %s", name)
+	}
+	result += "\n[*] 发现的网络接口:"
+
+	// 用于分类存储地址
+	var ipv4Addrs []string
+	var ipv6Addrs []string
+	seenAddresses := make(map[string]bool)
 
 	// 解析网络信息
 	netInfo := strings.Replace(encodedStr, "0700", "", -1)
-	hosts := strings.Split(netInfo, "000000")
-	hosts = hosts[1:] // 跳过第一个空元素
+	segments := strings.Split(netInfo, "000000")
 
-	// 构造输出结果
-	result := fmt.Sprintf("[*] NetInfo\n[*] %s", host)
-	if name != "" {
-		result += fmt.Sprintf("\n   [->] %s", name)
-	}
-
-	// 解析每个网络主机信息
-	for _, h := range hosts {
-		// 移除填充字节
-		h = strings.Replace(h, "00", "", -1)
-
-		// 解码主机信息
-		hostInfo, err := hex.DecodeString(h)
-		if err != nil {
-			return fmt.Errorf("[-] 解码主机信息失败: %v", err)
+	// 处理每个网络地址
+	for _, segment := range segments {
+		if len(segment) == 0 {
+			continue
+		}
+
+		if len(segment)%2 != 0 {
+			segment = segment + "0"
+		}
+
+		addrBytes, err := hex.DecodeString(segment)
+		if err != nil {
+			continue
+		}
+
+		addr := cleanAndValidateAddress(addrBytes)
+		if addr != "" && !seenAddresses[addr] {
+			seenAddresses[addr] = true
+
+			// 分类IPv4和IPv6地址
+			if strings.Contains(addr, ":") {
+				ipv6Addrs = append(ipv6Addrs, addr)
+			} else if net.ParseIP(addr) != nil {
+				ipv4Addrs = append(ipv4Addrs, addr)
+			}
+		}
+	}
+
+	// 输出IPv4地址
+	if len(ipv4Addrs) > 0 {
+		result += "\n   [+] IPv4地址:"
+		for _, addr := range ipv4Addrs {
+			result += fmt.Sprintf("\n      └─ %s", addr)
+		}
+	}
+
+	// 输出IPv6地址
+	if len(ipv6Addrs) > 0 {
+		result += "\n   [+] IPv6地址:"
+		for _, addr := range ipv6Addrs {
+			result += fmt.Sprintf("\n      └─ %s", addr)
 		}
-		result += fmt.Sprintf("\n   [->] %s", string(hostInfo))
 	}
 
-	// 输出结果
 	Common.LogSuccess(result)
 	return nil
 }

Plugins/RDP.go

@@ -38,38 +38,84 @@ func RdpScan(info *Common.HostInfo) (tmperr error) {
 	}
 
 	var (
-		wg     sync.WaitGroup
-		signal bool
-		num    = 0
-		all    = len(Common.Userdict["rdp"]) * len(Common.Passwords)
-		mutex  sync.Mutex
+		wg    sync.WaitGroup
+		num   = 0
+		all   = len(Common.Userdict["rdp"]) * len(Common.Passwords)
+		mutex sync.Mutex
 	)
 
-	// 创建任务通道
+	// 创建任务通道和结果通道
 	brlist := make(chan Brutelist)
+	resultChan := make(chan bool)
+
 	port, _ := strconv.Atoi(info.Ports)
 
 	// 启动工作协程
 	for i := 0; i < Common.BruteThreads; i++ {
 		wg.Add(1)
-		go worker(info.Host, Common.Domain, port, &wg, brlist, &signal, &num, all, &mutex, Common.Timeout)
+		go func() {
+			defer wg.Done()
+			for one := range brlist {
+				select {
+				case <-resultChan: // 检查是否已经找到有效凭据
+					return
+				default:
+				}
+
+				mutex.Lock()
+				num++
+				mutex.Unlock()
+
+				user, pass := one.user, one.pass
+				flag, err := RdpConn(info.Host, Common.Domain, user, pass, port, Common.Timeout)
+
+				if flag && err == nil {
+					// 连接成功
+					var result string
+					if Common.Domain != "" {
+						result = fmt.Sprintf("[+] RDP %v:%v:%v\\%v %v", info.Host, port, Common.Domain, user, pass)
+					} else {
+						result = fmt.Sprintf("[+] RDP %v:%v:%v %v", info.Host, port, user, pass)
+					}
+					Common.LogSuccess(result)
+					select {
+					case resultChan <- true: // 通知其他goroutine找到了有效凭据
+					default:
+					}
+					return
+				}
+
+				// 连接失败
+				errlog := fmt.Sprintf("[-] (%v/%v) RDP %v:%v %v %v %v", num, all, info.Host, port, user, pass, err)
+				Common.LogError(errlog)
+			}
+		}()
 	}
 
 	// 分发扫描任务
-	for _, user := range Common.Userdict["rdp"] {
-		for _, pass := range Common.Passwords {
-			pass = strings.Replace(pass, "{user}", user, -1)
-			brlist <- Brutelist{user, pass}
+	go func() {
+		for _, user := range Common.Userdict["rdp"] {
+			for _, pass := range Common.Passwords {
+				pass = strings.Replace(pass, "{user}", user, -1)
+				select {
+				case <-resultChan: // 如果已经找到有效凭据，停止分发任务
+					return
+				case brlist <- Brutelist{user, pass}:
+				}
+			}
 		}
-	}
-	close(brlist)
+		close(brlist)
+	}()
 
-	// 等待所有任务完成
+	// 等待任务完成或找到有效凭据
 	go func() {
 		wg.Wait()
-		signal = true
+		close(resultChan)
 	}()
-	for !signal {
+
+	// 等待结果
+	if <-resultChan {
+		return nil
 	}
 
 	return tmperr

Plugins/SMB.go

@@ -1,7 +1,6 @@
 package Plugins
 
 import (
-	"errors"
 	"fmt"
 	"github.com/shadow1ng/fscan/Common"
 	"github.com/stacktitan/smb/smb"
@@ -10,24 +9,20 @@ import (
 	"time"
 )
 
-// SmbScan 执行SMB服务的认证扫描
 func SmbScan(info *Common.HostInfo) (tmperr error) {
 	if Common.DisableBrute {
 		return nil
 	}
 
-	maxRetries := Common.MaxRetries
 	threads := Common.BruteThreads
+	totalTasks := len(Common.Userdict["smb"]) * len(Common.Passwords)
 
-	// 创建任务通道
 	taskChan := make(chan struct {
 		user string
 		pass string
-	}, len(Common.Userdict["smb"])*len(Common.Passwords))
+	}, totalTasks)
 
-	resultChan := make(chan error, threads)
-
-	// 生成所有用户名密码组合任务
+	// 生成任务
 	for _, user := range Common.Userdict["smb"] {
 		for _, pass := range Common.Passwords {
 			pass = strings.Replace(pass, "{user}", user, -1)
@@ -39,108 +34,48 @@ func SmbScan(info *Common.HostInfo) (tmperr error) {
 	}
 	close(taskChan)
 
-	// 启动工作线程
 	var wg sync.WaitGroup
+	successChan := make(chan struct{}, 1)
+
+	// 启动工作线程
 	for i := 0; i < threads; i++ {
 		wg.Add(1)
 		go func() {
 			defer wg.Done()
-			startTime := time.Now().Unix()
-
 			for task := range taskChan {
-				// 重试循环
-				for retryCount := 0; retryCount < maxRetries; retryCount++ {
-					// 检查是否超时
-					if time.Now().Unix()-startTime > int64(Common.Timeout) {
-						resultChan <- fmt.Errorf("扫描超时")
-						return
+				select {
+				case <-successChan:
+					return
+				default:
+				}
+
+				success, err := doWithTimeOut(info, task.user, task.pass)
+				if success {
+					if Common.Domain != "" {
+						Common.LogSuccess(fmt.Sprintf("[+] SMB认证成功 %v:%v Domain:%v\\%v Pass:%v",
+							info.Host, info.Ports, Common.Domain, task.user, task.pass))
+					} else {
+						Common.LogSuccess(fmt.Sprintf("[+] SMB认证成功 %v:%v User:%v Pass:%v",
+							info.Host, info.Ports, task.user, task.pass))
 					}
-
-					// 执行SMB认证
-					done := make(chan struct {
-						success bool
-						err     error
-					})
-
-					go func(user, pass string) {
-						success, err := doWithTimeOut(info, user, pass)
-						done <- struct {
-							success bool
-							err     error
-						}{success, err}
-					}(task.user, task.pass)
-
-					// 等待结果或超时
-					var err error
-					select {
-					case result := <-done:
-						err = result.err
-						if result.success && err == nil {
-							// 认证成功
-							var successLog string
-							if Common.Domain != "" {
-								successLog = fmt.Sprintf("[✓] SMB认证成功 %v:%v Domain:%v\\%v Pass:%v",
-									info.Host, info.Ports, Common.Domain, task.user, task.pass)
-							} else {
-								successLog = fmt.Sprintf("[✓] SMB认证成功 %v:%v User:%v Pass:%v",
-									info.Host, info.Ports, task.user, task.pass)
-							}
-							Common.LogSuccess(successLog)
-							resultChan <- nil
-							return
-						}
-					case <-time.After(time.Duration(Common.Timeout) * time.Second):
-						err = fmt.Errorf("连接超时")
-					}
-
-					// 处理错误情况
-					if err != nil {
-						errlog := fmt.Sprintf("[x] SMB认证失败 %v:%v User:%v Pass:%v Err:%v",
-							info.Host, info.Ports, task.user, task.pass,
-							strings.ReplaceAll(err.Error(), "\n", ""))
-						Common.LogError(errlog)
-
-						// 检查是否需要重试
-						if retryErr := Common.CheckErrs(err); retryErr != nil {
-							if retryCount == maxRetries-1 {
-								resultChan <- err
-								return
-							}
-							continue // 继续重试
-						}
-					}
-
-					break // 如果不需要重试，跳出重试循环
+					successChan <- struct{}{}
+					return
+				}
+				if err != nil {
+					Common.LogError(fmt.Sprintf("[-] SMB认证失败 %v:%v User:%v Pass:%v Err:%v",
+						info.Host, info.Ports, task.user, task.pass, err))
 				}
 			}
-			resultChan <- nil
 		}()
 	}
 
-	// 等待所有线程完成
-	go func() {
-		wg.Wait()
-		close(resultChan)
-	}()
-
-	// 检查结果
-	for err := range resultChan {
-		if err != nil {
-			tmperr = err
-			if retryErr := Common.CheckErrs(err); retryErr != nil {
-				return err
-			}
-		}
-	}
-
-	return tmperr
+	wg.Wait()
+	return nil
 }
 
-// SmblConn 尝试建立SMB连接并进行认证
 func SmblConn(info *Common.HostInfo, user string, pass string, signal chan struct{}) (flag bool, err error) {
 	flag = false
 
-	// 配置SMB连接选项
 	options := smb.Options{
 		Host:        info.Host,
 		Port:        445,
@@ -150,34 +85,69 @@ func SmblConn(info *Common.HostInfo, user string, pass string, signal chan struc
 		Workstation: "",
 	}
 
-	// 尝试建立SMB会话
 	session, err := smb.NewSession(options, false)
 	if err == nil {
 		defer session.Close()
 		if session.IsAuthenticated {
 			flag = true
+			return flag, nil
+		}
+		return flag, fmt.Errorf("认证失败")
+	}
+
+	// 清理错误信息中的换行符和多余空格
+	errMsg := strings.TrimSpace(strings.ReplaceAll(err.Error(), "\n", " "))
+	if strings.Contains(errMsg, "NT Status Error") {
+		switch {
+		case strings.Contains(errMsg, "STATUS_LOGON_FAILURE"):
+			err = fmt.Errorf("用户名或密码错误")
+		case strings.Contains(errMsg, "STATUS_ACCOUNT_LOCKED_OUT"):
+			err = fmt.Errorf("账号已锁定")
+		case strings.Contains(errMsg, "STATUS_ACCESS_DENIED"):
+			err = fmt.Errorf("访问被拒绝")
+		case strings.Contains(errMsg, "STATUS_ACCOUNT_DISABLED"):
+			err = fmt.Errorf("账号已禁用")
+		case strings.Contains(errMsg, "STATUS_PASSWORD_EXPIRED"):
+			err = fmt.Errorf("密码已过期")
+		case strings.Contains(errMsg, "STATUS_USER_SESSION_DELETED"):
+			return flag, fmt.Errorf("会话已断开")
+		default:
+			err = fmt.Errorf("认证失败") // 简化错误信息
 		}
 	}
 
-	// 发送完成信号
 	signal <- struct{}{}
 	return flag, err
 }
 
-// doWithTimeOut 执行带超时的SMB连接认证
 func doWithTimeOut(info *Common.HostInfo, user string, pass string) (flag bool, err error) {
-	signal := make(chan struct{})
+	signal := make(chan struct{}, 1)
+	result := make(chan struct {
+		success bool
+		err     error
+	}, 1)
 
-	// 在goroutine中执行SMB连接
 	go func() {
-		flag, err = SmblConn(info, user, pass, signal)
+		success, err := SmblConn(info, user, pass, signal)
+		select {
+		case result <- struct {
+			success bool
+			err     error
+		}{success, err}:
+		default:
+		}
 	}()
 
-	// 等待连接结果或超时
 	select {
-	case <-signal:
-		return flag, err
+	case r := <-result:
+		return r.success, r.err
 	case <-time.After(time.Duration(Common.Timeout) * time.Second):
-		return false, errors.New("[-] SMB连接超时")
+		// 尝试从result通道读取，避免协程泄露
+		select {
+		case r := <-result:
+			return r.success, r.err
+		default:
+			return false, fmt.Errorf("连接超时")
+		}
 	}
 }