fscan/plugins/services/postgresql.go

package services

import (
	"context"
	"database/sql"
	"fmt"
	"strings"
	"time"

	_ "github.com/lib/pq"
	"github.com/shadow1ng/fscan/common"
	"github.com/shadow1ng/fscan/plugins"
)

type PostgreSQLPlugin struct {
	plugins.BasePlugin
}

func NewPostgreSQLPlugin() *PostgreSQLPlugin {
	return &PostgreSQLPlugin{
		BasePlugin: plugins.NewBasePlugin("postgresql"),
	}
}



func (p *PostgreSQLPlugin) Scan(ctx context.Context, info *common.HostInfo) *ScanResult {
	target := fmt.Sprintf("%s:%s", info.Host, info.Ports)

	if common.DisableBrute {
		return p.identifyService(ctx, info)
	}

	credentials := GenerateCredentials("postgresql")
	if len(credentials) == 0 {
		return &ScanResult{
			Success: false,
			Service: "postgresql",
			Error:   fmt.Errorf("没有可用的测试凭据"),
		}
	}

	for _, cred := range credentials {
		if db := p.testCredential(ctx, info, cred); db != nil {
			db.Close()
			
			common.LogSuccess(fmt.Sprintf("PostgreSQL %s %s:%s", target, cred.Username, cred.Password))

			return &ScanResult{
				Success:  true,
				Service:  "postgresql",
				Username: cred.Username,
				Password: cred.Password,
			}
		}
	}

	return &ScanResult{
		Success: false,
		Service: "postgresql",
		Error:   fmt.Errorf("未发现弱密码"),
	}
}


func (p *PostgreSQLPlugin) testCredential(ctx context.Context, info *common.HostInfo, cred Credential) *sql.DB {
	connStr := fmt.Sprintf("postgres://%s:%s@%s:%s/postgres?sslmode=disable&connect_timeout=%d",
		cred.Username, cred.Password, info.Host, info.Ports, common.Timeout)

	db, err := sql.Open("postgres", connStr)
	if err != nil {
		return nil
	}

	db.SetConnMaxLifetime(time.Duration(common.Timeout) * time.Second)
	db.SetMaxOpenConns(1)
	db.SetMaxIdleConns(0)

	pingCtx, cancel := context.WithTimeout(ctx, time.Duration(common.Timeout)*time.Second)
	defer cancel()

	err = db.PingContext(pingCtx)
	if err != nil {
		db.Close()
		return nil
	}

	return db
}






func (p *PostgreSQLPlugin) identifyService(ctx context.Context, info *common.HostInfo) *ScanResult {
	target := fmt.Sprintf("%s:%s", info.Host, info.Ports)

	connStr := fmt.Sprintf("postgres://invalid:invalid@%s:%s/postgres?sslmode=disable&connect_timeout=%d",
		info.Host, info.Ports, common.Timeout)

	db, err := sql.Open("postgres", connStr)
	if err != nil {
		return &ScanResult{
			Success: false,
			Service: "postgresql",
			Error:   err,
		}
	}
	defer db.Close()

	pingCtx, cancel := context.WithTimeout(ctx, time.Duration(common.Timeout)*time.Second)
	defer cancel()

	err = db.PingContext(pingCtx)
	
	// 改进识别逻辑：任何PostgreSQL相关的响应都认为是有效服务
	var banner string
	if err != nil {
		errMsg := strings.ToLower(err.Error())
		// PostgreSQL常见错误关键词
		if strings.Contains(errMsg, "postgres") || 
		   strings.Contains(errMsg, "authentication") || 
		   strings.Contains(errMsg, "database") ||
		   strings.Contains(errMsg, "password") ||
		   strings.Contains(errMsg, "role") ||
		   strings.Contains(errMsg, "user") ||
		   strings.Contains(errMsg, "pq:") {
			banner = "PostgreSQL"
		} else {
			return &ScanResult{
				Success: false,
				Service: "postgresql", 
				Error:   fmt.Errorf("无法识别为PostgreSQL服务: %s", err.Error()),
			}
		}
	} else {
		banner = "PostgreSQL (连接成功)"
	}

	common.LogSuccess(fmt.Sprintf("PostgreSQL %s %s", target, banner))

	return &ScanResult{
		Success: true,
		Service: "postgresql",
		Banner:  banner,
	}
}

func init() {
	// 使用高效注册方式：直接传递端口信息，避免实例创建
	RegisterPluginWithPorts("postgresql", func() Plugin {
		return NewPostgreSQLPlugin()
	}, []int{5432, 5433, 5434})
}