mirror of
https://github.com/shadow1ng/fscan.git
synced 2025-09-14 05:56:46 +08:00

- 新建本地插件统一架构,包含接口定义和基础类 - 实现三个本地插件:fileinfo(文件信息收集)、dcinfo(域控信息收集)、minidump(内存转储) - 添加-localplugin参数,支持指定单个本地插件执行 - 完善参数验证机制,本地模式必须指定插件 - 集成新插件系统到核心扫描策略 - 修复Go方法调用机制导致的插件执行问题 - 支持跨平台和权限检查功能 支持的本地插件: - fileinfo: 敏感文件扫描 - dcinfo: Windows域控信息收集 - minidump: lsass进程内存转储 使用方式: fscan -local -localplugin <plugin_name>
163 lines
3.8 KiB
Go
163 lines
3.8 KiB
Go
package local
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"os"
|
|
"runtime"
|
|
"path/filepath"
|
|
"github.com/shadow1ng/fscan/common"
|
|
)
|
|
|
|
// BaseLocalConnector 基础本地连接器实现
|
|
type BaseLocalConnector struct {
|
|
workingDir string
|
|
homeDir string
|
|
systemInfo map[string]string
|
|
}
|
|
|
|
// LocalConnection 本地连接对象
|
|
type LocalConnection struct {
|
|
WorkingDir string
|
|
HomeDir string
|
|
SystemInfo map[string]string
|
|
TempDir string
|
|
}
|
|
|
|
// NewBaseLocalConnector 创建基础本地连接器
|
|
func NewBaseLocalConnector() (*BaseLocalConnector, error) {
|
|
homeDir, err := os.UserHomeDir()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
workingDir, err := os.Getwd()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return &BaseLocalConnector{
|
|
workingDir: workingDir,
|
|
homeDir: homeDir,
|
|
systemInfo: make(map[string]string),
|
|
}, nil
|
|
}
|
|
|
|
// Connect 建立本地连接
|
|
func (c *BaseLocalConnector) Connect(ctx context.Context, info *common.HostInfo) (interface{}, error) {
|
|
// 初始化系统信息
|
|
c.initSystemInfo()
|
|
|
|
tempDir := os.TempDir()
|
|
|
|
conn := &LocalConnection{
|
|
WorkingDir: c.workingDir,
|
|
HomeDir: c.homeDir,
|
|
SystemInfo: c.systemInfo,
|
|
TempDir: tempDir,
|
|
}
|
|
|
|
return conn, nil
|
|
}
|
|
|
|
// Close 关闭连接
|
|
func (c *BaseLocalConnector) Close(conn interface{}) error {
|
|
// 本地连接无需特殊关闭操作
|
|
return nil
|
|
}
|
|
|
|
// GetSystemInfo 获取系统信息
|
|
func (c *BaseLocalConnector) GetSystemInfo(conn interface{}) (map[string]string, error) {
|
|
localConn, ok := conn.(*LocalConnection)
|
|
if !ok {
|
|
return nil, fmt.Errorf("无效的连接类型")
|
|
}
|
|
|
|
return localConn.SystemInfo, nil
|
|
}
|
|
|
|
// initSystemInfo 初始化系统信息
|
|
func (c *BaseLocalConnector) initSystemInfo() {
|
|
c.systemInfo["os"] = runtime.GOOS
|
|
c.systemInfo["arch"] = runtime.GOARCH
|
|
c.systemInfo["home_dir"] = c.homeDir
|
|
c.systemInfo["working_dir"] = c.workingDir
|
|
c.systemInfo["temp_dir"] = os.TempDir()
|
|
|
|
// 获取用户名
|
|
if username := os.Getenv("USER"); username != "" {
|
|
c.systemInfo["username"] = username
|
|
} else if username := os.Getenv("USERNAME"); username != "" {
|
|
c.systemInfo["username"] = username
|
|
}
|
|
|
|
// 获取主机名
|
|
if hostname, err := os.Hostname(); err == nil {
|
|
c.systemInfo["hostname"] = hostname
|
|
}
|
|
}
|
|
|
|
// GetCommonDirectories 获取常见目录路径
|
|
func (c *BaseLocalConnector) GetCommonDirectories() []string {
|
|
var dirs []string
|
|
|
|
switch runtime.GOOS {
|
|
case "windows":
|
|
dirs = []string{
|
|
c.homeDir,
|
|
filepath.Join(c.homeDir, "Desktop"),
|
|
filepath.Join(c.homeDir, "Documents"),
|
|
filepath.Join(c.homeDir, "Downloads"),
|
|
"C:\\Users\\Public\\Documents",
|
|
"C:\\Users\\Public\\Desktop",
|
|
"C:\\Program Files",
|
|
"C:\\Program Files (x86)",
|
|
}
|
|
case "linux", "darwin":
|
|
dirs = []string{
|
|
c.homeDir,
|
|
filepath.Join(c.homeDir, "Desktop"),
|
|
filepath.Join(c.homeDir, "Documents"),
|
|
filepath.Join(c.homeDir, "Downloads"),
|
|
"/opt",
|
|
"/usr/local",
|
|
"/var/www",
|
|
"/var/log",
|
|
}
|
|
}
|
|
|
|
return dirs
|
|
}
|
|
|
|
// GetSensitiveFiles 获取敏感文件路径
|
|
func (c *BaseLocalConnector) GetSensitiveFiles() []string {
|
|
var files []string
|
|
|
|
switch runtime.GOOS {
|
|
case "windows":
|
|
files = []string{
|
|
"C:\\boot.ini",
|
|
"C:\\windows\\system32\\inetsrv\\MetaBase.xml",
|
|
"C:\\windows\\repair\\sam",
|
|
"C:\\windows\\system32\\config\\sam",
|
|
filepath.Join(c.homeDir, "AppData", "Local", "Google", "Chrome", "User Data", "Default", "Login Data"),
|
|
filepath.Join(c.homeDir, "AppData", "Local", "Microsoft", "Edge", "User Data", "Default", "Login Data"),
|
|
filepath.Join(c.homeDir, "AppData", "Roaming", "Mozilla", "Firefox", "Profiles"),
|
|
}
|
|
case "linux", "darwin":
|
|
files = []string{
|
|
"/etc/passwd",
|
|
"/etc/shadow",
|
|
"/etc/hosts",
|
|
"/etc/ssh/ssh_config",
|
|
"/root/.ssh/id_rsa",
|
|
"/root/.ssh/authorized_keys",
|
|
"/root/.bash_history",
|
|
filepath.Join(c.homeDir, ".ssh/id_rsa"),
|
|
filepath.Join(c.homeDir, ".ssh/authorized_keys"),
|
|
filepath.Join(c.homeDir, ".bash_history"),
|
|
}
|
|
}
|
|
|
|
return files
|
|
} |