mirror of
https://github.com/shadow1ng/fscan.git
synced 2025-09-14 14:06:44 +08:00
6cf5719e8a
- 删除整个legacy插件系统(7794行代码) - 完成所有插件向单文件架构迁移 - 移除19个插件的虚假Exploit功能，只保留真实利用: * Redis: 文件写入、SSH密钥注入、计划任务 * SSH: 命令执行 * MS17010: EternalBlue漏洞利用 - 统一插件接口，简化架构复杂度 - 清理临时文件和备份文件 重构效果： - 代码行数: -7794行 - 插件文件数: 从3文件架构→单文件架构 - 真实利用插件: 从22个→3个 - 架构复杂度: 大幅简化
472 lines
10 KiB
Go
472 lines
10 KiB
Go
package services
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"io"
|
|
"net"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/shadow1ng/fscan/common"
|
|
"github.com/shadow1ng/fscan/common/i18n"
|
|
)
|
|
|
|
// MongoDBPlugin MongoDB数据库扫描和利用插件 - 包含数据查询利用功能
|
|
type MongoDBPlugin struct {
|
|
name string
|
|
ports []int
|
|
}
|
|
|
|
// NewMongoDBPlugin 创建MongoDB插件
|
|
func NewMongoDBPlugin() *MongoDBPlugin {
|
|
return &MongoDBPlugin{
|
|
name: "mongodb",
|
|
ports: []int{27017, 27018, 27019}, // MongoDB端口
|
|
}
|
|
}
|
|
|
|
// GetName 实现Plugin接口
|
|
func (p *MongoDBPlugin) GetName() string {
|
|
return p.name
|
|
}
|
|
|
|
// GetPorts 实现Plugin接口
|
|
func (p *MongoDBPlugin) GetPorts() []int {
|
|
return p.ports
|
|
}
|
|
|
|
// Scan 执行MongoDB扫描 - 未授权访问检测
|
|
func (p *MongoDBPlugin) Scan(ctx context.Context, info *common.HostInfo) *ScanResult {
|
|
target := fmt.Sprintf("%s:%s", info.Host, info.Ports)
|
|
|
|
// 如果禁用暴力破解，只做服务识别
|
|
if common.DisableBrute {
|
|
return p.identifyService(ctx, info)
|
|
}
|
|
|
|
// MongoDB主要检查未授权访问
|
|
if result := p.testUnauthorizedAccess(ctx, info); result != nil && result.Success {
|
|
common.LogSuccess(i18n.GetText("mongodb_unauth_success", target))
|
|
return result
|
|
}
|
|
|
|
// 未授权访问失败
|
|
return &ScanResult{
|
|
Success: false,
|
|
Service: "mongodb",
|
|
Error: fmt.Errorf("MongoDB需要认证或连接失败"),
|
|
}
|
|
}
|
|
|
|
|
|
// testUnauthorizedAccess 测试未授权访问
|
|
func (p *MongoDBPlugin) testUnauthorizedAccess(ctx context.Context, info *common.HostInfo) *ScanResult {
|
|
conn := p.connectToMongoDB(ctx, info)
|
|
if conn == nil {
|
|
return nil
|
|
}
|
|
defer conn.Close()
|
|
|
|
// 尝试执行基本查询测试
|
|
if p.testBasicQuery(conn) {
|
|
return &ScanResult{
|
|
Success: true,
|
|
Service: "mongodb",
|
|
Banner: "未授权访问",
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// connectToMongoDB 连接到MongoDB服务
|
|
func (p *MongoDBPlugin) connectToMongoDB(ctx context.Context, info *common.HostInfo) net.Conn {
|
|
target := fmt.Sprintf("%s:%s", info.Host, info.Ports)
|
|
timeout := time.Duration(common.Timeout) * time.Second
|
|
|
|
conn, err := net.DialTimeout("tcp", target, timeout)
|
|
if err != nil {
|
|
return nil
|
|
}
|
|
|
|
// 设置操作超时
|
|
conn.SetDeadline(time.Now().Add(timeout))
|
|
|
|
return conn
|
|
}
|
|
|
|
// testBasicQuery 测试基本查询
|
|
func (p *MongoDBPlugin) testBasicQuery(conn net.Conn) bool {
|
|
// 创建MongoDB查询消息
|
|
queryMsg := p.createListDatabasesQuery()
|
|
|
|
if _, err := conn.Write(queryMsg); err != nil {
|
|
return false
|
|
}
|
|
|
|
// 读取响应
|
|
response := make([]byte, 4096)
|
|
n, err := conn.Read(response)
|
|
if err != nil && err != io.EOF {
|
|
return false
|
|
}
|
|
|
|
// 检查响应是否有效
|
|
return n > 36 && p.isValidMongoResponse(response[:n])
|
|
}
|
|
|
|
// isValidMongoResponse 检查是否为有效的MongoDB响应
|
|
func (p *MongoDBPlugin) isValidMongoResponse(data []byte) bool {
|
|
if len(data) < 36 {
|
|
return false
|
|
}
|
|
|
|
// 检查MongoDB协议标志
|
|
responseStr := string(data)
|
|
return strings.Contains(responseStr, "databases") ||
|
|
strings.Contains(responseStr, "totalSize") ||
|
|
strings.Contains(responseStr, "name") ||
|
|
strings.Contains(responseStr, "sizeOnDisk")
|
|
}
|
|
|
|
// getServerStatus 获取服务器状态
|
|
func (p *MongoDBPlugin) getServerStatus(conn net.Conn) string {
|
|
// 创建serverStatus命令
|
|
statusMsg := p.createServerStatusQuery()
|
|
|
|
if _, err := conn.Write(statusMsg); err != nil {
|
|
return ""
|
|
}
|
|
|
|
response := make([]byte, 2048)
|
|
n, err := conn.Read(response)
|
|
if err != nil && err != io.EOF {
|
|
return ""
|
|
}
|
|
|
|
responseStr := string(response[:n])
|
|
|
|
var status strings.Builder
|
|
if strings.Contains(responseStr, "version") {
|
|
status.WriteString("MongoDB服务运行中\n")
|
|
}
|
|
if strings.Contains(responseStr, "uptime") {
|
|
status.WriteString("服务器运行正常\n")
|
|
}
|
|
|
|
return status.String()
|
|
}
|
|
|
|
// getDatabases 获取数据库列表
|
|
func (p *MongoDBPlugin) getDatabases(conn net.Conn) []string {
|
|
// 创建listDatabases查询
|
|
queryMsg := p.createListDatabasesQuery()
|
|
|
|
if _, err := conn.Write(queryMsg); err != nil {
|
|
return nil
|
|
}
|
|
|
|
response := make([]byte, 4096)
|
|
n, err := conn.Read(response)
|
|
if err != nil && err != io.EOF {
|
|
return nil
|
|
}
|
|
|
|
responseStr := string(response[:n])
|
|
|
|
// 解析数据库名称
|
|
var databases []string
|
|
if strings.Contains(responseStr, "admin") {
|
|
databases = append(databases, "admin")
|
|
}
|
|
if strings.Contains(responseStr, "local") {
|
|
databases = append(databases, "local")
|
|
}
|
|
if strings.Contains(responseStr, "config") {
|
|
databases = append(databases, "config")
|
|
}
|
|
|
|
return databases
|
|
}
|
|
|
|
// getCollections 获取指定数据库的集合列表
|
|
func (p *MongoDBPlugin) getCollections(conn net.Conn, database string) []string {
|
|
// 创建listCollections查询
|
|
queryMsg := p.createListCollectionsQuery(database)
|
|
|
|
if _, err := conn.Write(queryMsg); err != nil {
|
|
return nil
|
|
}
|
|
|
|
response := make([]byte, 2048)
|
|
n, err := conn.Read(response)
|
|
if err != nil && err != io.EOF {
|
|
return nil
|
|
}
|
|
|
|
responseStr := string(response[:n])
|
|
|
|
// 解析集合名称
|
|
var collections []string
|
|
if strings.Contains(responseStr, "system") {
|
|
collections = append(collections, "system.users")
|
|
collections = append(collections, "system.roles")
|
|
}
|
|
|
|
return collections
|
|
}
|
|
|
|
// getUsers 获取用户信息
|
|
func (p *MongoDBPlugin) getUsers(conn net.Conn) string {
|
|
// 尝试查询admin.system.users
|
|
userQuery := p.createFindUsersQuery()
|
|
|
|
if _, err := conn.Write(userQuery); err != nil {
|
|
return ""
|
|
}
|
|
|
|
response := make([]byte, 1024)
|
|
n, err := conn.Read(response)
|
|
if err != nil && err != io.EOF {
|
|
return ""
|
|
}
|
|
|
|
responseStr := string(response[:n])
|
|
|
|
if strings.Contains(responseStr, "user") || strings.Contains(responseStr, "role") {
|
|
return "发现用户数据"
|
|
}
|
|
|
|
return "无用户信息或权限不足"
|
|
}
|
|
|
|
// getBuildInfo 获取版本信息
|
|
func (p *MongoDBPlugin) getBuildInfo(conn net.Conn) string {
|
|
buildInfoMsg := p.createBuildInfoQuery()
|
|
|
|
if _, err := conn.Write(buildInfoMsg); err != nil {
|
|
return ""
|
|
}
|
|
|
|
response := make([]byte, 1024)
|
|
n, err := conn.Read(response)
|
|
if err != nil && err != io.EOF {
|
|
return ""
|
|
}
|
|
|
|
responseStr := string(response[:n])
|
|
|
|
if strings.Contains(responseStr, "version") {
|
|
return "MongoDB服务器信息可用"
|
|
}
|
|
|
|
return ""
|
|
}
|
|
|
|
// createListDatabasesQuery 创建listDatabases查询
|
|
func (p *MongoDBPlugin) createListDatabasesQuery() []byte {
|
|
// 简化的MongoDB Wire Protocol消息
|
|
// OP_QUERY消息结构
|
|
query := make([]byte, 100)
|
|
|
|
// 消息头 (16字节)
|
|
query[0] = 0x64 // 消息长度
|
|
query[4] = 0x01 // 请求ID
|
|
query[12] = 0x04 // OP_QUERY操作码
|
|
query[13] = 0x20
|
|
query[14] = 0x00
|
|
query[15] = 0x00
|
|
|
|
// 查询标志
|
|
query[16] = 0x00
|
|
query[17] = 0x00
|
|
query[18] = 0x00
|
|
query[19] = 0x00
|
|
|
|
// 集合名称 "admin.$cmd"
|
|
copy(query[20:], "admin.$cmd\x00")
|
|
|
|
// BSON查询文档 {listDatabases: 1}
|
|
bsonQuery := []byte{
|
|
0x1A, 0x00, 0x00, 0x00, // 文档长度
|
|
0x10, // int32类型
|
|
0x6C, 0x69, 0x73, 0x74, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x73, 0x00, // "listDatabases"
|
|
0x01, 0x00, 0x00, 0x00, // 值为1
|
|
0x00, // 文档结束
|
|
}
|
|
|
|
copy(query[32:], bsonQuery)
|
|
return query[:58]
|
|
}
|
|
|
|
// createServerStatusQuery 创建serverStatus查询
|
|
func (p *MongoDBPlugin) createServerStatusQuery() []byte {
|
|
query := make([]byte, 100)
|
|
|
|
// 消息头
|
|
query[0] = 0x60
|
|
query[4] = 0x02
|
|
query[12] = 0x04
|
|
query[13] = 0x20
|
|
query[14] = 0x00
|
|
query[15] = 0x00
|
|
|
|
// 查询标志
|
|
query[16] = 0x00
|
|
query[17] = 0x00
|
|
query[18] = 0x00
|
|
query[19] = 0x00
|
|
|
|
// 集合名称
|
|
copy(query[20:], "admin.$cmd\x00")
|
|
|
|
// BSON查询文档 {serverStatus: 1}
|
|
bsonQuery := []byte{
|
|
0x18, 0x00, 0x00, 0x00,
|
|
0x10,
|
|
0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x00,
|
|
0x01, 0x00, 0x00, 0x00,
|
|
0x00,
|
|
}
|
|
|
|
copy(query[32:], bsonQuery)
|
|
return query[:56]
|
|
}
|
|
|
|
// createListCollectionsQuery 创建listCollections查询
|
|
func (p *MongoDBPlugin) createListCollectionsQuery(database string) []byte {
|
|
query := make([]byte, 100)
|
|
|
|
// 消息头
|
|
query[0] = 0x70
|
|
query[4] = 0x03
|
|
query[12] = 0x04
|
|
query[13] = 0x20
|
|
query[14] = 0x00
|
|
query[15] = 0x00
|
|
|
|
// 查询标志
|
|
query[16] = 0x00
|
|
query[17] = 0x00
|
|
query[18] = 0x00
|
|
query[19] = 0x00
|
|
|
|
// 集合名称
|
|
collectionName := database + ".$cmd\x00"
|
|
copy(query[20:], collectionName)
|
|
|
|
// BSON查询文档 {listCollections: 1}
|
|
bsonQuery := []byte{
|
|
0x1C, 0x00, 0x00, 0x00,
|
|
0x10,
|
|
0x6C, 0x69, 0x73, 0x74, 0x43, 0x6F, 0x6C, 0x6C, 0x65, 0x63, 0x74, 0x69, 0x6F, 0x6E, 0x73, 0x00,
|
|
0x01, 0x00, 0x00, 0x00,
|
|
0x00,
|
|
}
|
|
|
|
copy(query[20+len(collectionName):], bsonQuery)
|
|
return query[:46+len(collectionName)]
|
|
}
|
|
|
|
// createFindUsersQuery 创建查找用户查询
|
|
func (p *MongoDBPlugin) createFindUsersQuery() []byte {
|
|
query := make([]byte, 120)
|
|
|
|
// 消息头
|
|
query[0] = 0x78
|
|
query[4] = 0x04
|
|
query[12] = 0x04
|
|
query[13] = 0x20
|
|
query[14] = 0x00
|
|
query[15] = 0x00
|
|
|
|
// 查询标志
|
|
query[16] = 0x00
|
|
query[17] = 0x00
|
|
query[18] = 0x00
|
|
query[19] = 0x00
|
|
|
|
// 集合名称 "admin.system.users"
|
|
copy(query[20:], "admin.system.users\x00")
|
|
|
|
// 空的查询文档 {}
|
|
bsonQuery := []byte{0x05, 0x00, 0x00, 0x00, 0x00}
|
|
|
|
copy(query[39:], bsonQuery)
|
|
return query[:44]
|
|
}
|
|
|
|
// createBuildInfoQuery 创建buildInfo查询
|
|
func (p *MongoDBPlugin) createBuildInfoQuery() []byte {
|
|
query := make([]byte, 100)
|
|
|
|
// 消息头
|
|
query[0] = 0x5C
|
|
query[4] = 0x05
|
|
query[12] = 0x04
|
|
query[13] = 0x20
|
|
query[14] = 0x00
|
|
query[15] = 0x00
|
|
|
|
// 查询标志
|
|
query[16] = 0x00
|
|
query[17] = 0x00
|
|
query[18] = 0x00
|
|
query[19] = 0x00
|
|
|
|
// 集合名称
|
|
copy(query[20:], "admin.$cmd\x00")
|
|
|
|
// BSON查询文档 {buildInfo: 1}
|
|
bsonQuery := []byte{
|
|
0x15, 0x00, 0x00, 0x00,
|
|
0x10,
|
|
0x62, 0x75, 0x69, 0x6C, 0x64, 0x49, 0x6E, 0x66, 0x6F, 0x00,
|
|
0x01, 0x00, 0x00, 0x00,
|
|
0x00,
|
|
}
|
|
|
|
copy(query[32:], bsonQuery)
|
|
return query[:53]
|
|
}
|
|
|
|
// identifyService 服务识别 - 检测MongoDB服务
|
|
func (p *MongoDBPlugin) identifyService(ctx context.Context, info *common.HostInfo) *ScanResult {
|
|
target := fmt.Sprintf("%s:%s", info.Host, info.Ports)
|
|
|
|
conn := p.connectToMongoDB(ctx, info)
|
|
if conn == nil {
|
|
return &ScanResult{
|
|
Success: false,
|
|
Service: "mongodb",
|
|
Error: fmt.Errorf("无法连接到MongoDB服务"),
|
|
}
|
|
}
|
|
defer conn.Close()
|
|
|
|
// 尝试识别MongoDB协议
|
|
if p.testBasicQuery(conn) {
|
|
banner := "MongoDB数据库服务"
|
|
common.LogSuccess(i18n.GetText("mongodb_service_identified", target, banner))
|
|
|
|
return &ScanResult{
|
|
Success: true,
|
|
Service: "mongodb",
|
|
Banner: banner,
|
|
}
|
|
}
|
|
|
|
return &ScanResult{
|
|
Success: false,
|
|
Service: "mongodb",
|
|
Error: fmt.Errorf("无法识别为MongoDB服务"),
|
|
}
|
|
}
|
|
|
|
// init 自动注册插件
|
|
func init() {
|
|
RegisterPlugin("mongodb", func() Plugin {
|
|
return NewMongoDBPlugin()
|
|
})
|
|
} |