mirror of
https://github.com/shadow1ng/fscan.git
synced 2025-09-14 05:56:46 +08:00
daa7fb2dcb
- 创建通用SMB框架，包含抽象接口、凭据管理和并发扫描引擎 - SMB2插件代码量从492行减少到159行，减少68%代码量 - 统一错误分类和处理机制，提高代码可维护性 - 支持密码和哈希两种认证方式，保持向后兼容性 - 模块化设计便于单元测试和功能扩展
95 lines
2.2 KiB
Go
95 lines
2.2 KiB
Go
package Plugins
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"time"
|
|
|
|
smbcommon "github.com/shadow1ng/fscan/plugins/legacy/smb/common"
|
|
"github.com/shadow1ng/fscan/plugins/legacy/smb/smb1"
|
|
"github.com/shadow1ng/fscan/common"
|
|
"github.com/shadow1ng/fscan/common/output"
|
|
)
|
|
|
|
// SmbScan 执行SMB1服务的认证扫描(重构版本)
|
|
func SmbScan(info *common.HostInfo) error {
|
|
if common.DisableBrute {
|
|
return nil
|
|
}
|
|
|
|
// 创建目标信息
|
|
target := &smbcommon.TargetInfo{
|
|
Host: info.Host,
|
|
Port: 445,
|
|
Domain: common.Domain,
|
|
}
|
|
|
|
// 设置全局超时上下文
|
|
ctx, cancel := context.WithTimeout(context.Background(),
|
|
time.Duration(common.GlobalTimeout)*time.Second)
|
|
defer cancel()
|
|
|
|
// 创建连接器、凭据管理器和扫描器
|
|
connector := smb1.NewSmb1Connector()
|
|
credMgr := smbcommon.NewPasswordCredentialManager()
|
|
scanner := smbcommon.NewScanner()
|
|
|
|
// 配置扫描参数
|
|
config := &smbcommon.ScanConfig{
|
|
MaxConcurrent: common.ModuleThreadNum,
|
|
Timeout: time.Duration(common.Timeout) * time.Second,
|
|
GlobalTimeout: time.Duration(common.GlobalTimeout) * time.Second,
|
|
}
|
|
|
|
// 执行扫描
|
|
result, err := scanner.Scan(ctx, target, connector, credMgr, config)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
// 处理扫描结果
|
|
if result != nil && result.Success {
|
|
saveSmbResult(info, result.Credential)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// saveSmbResult 保存SMB扫描结果
|
|
func saveSmbResult(info *common.HostInfo, cred smbcommon.Credential) {
|
|
target := fmt.Sprintf("%s:%s", info.Host, info.Ports)
|
|
|
|
// 构建结果消息
|
|
var successMsg string
|
|
details := map[string]interface{}{
|
|
"port": info.Ports,
|
|
"service": "smb",
|
|
"username": cred.Username,
|
|
"password": cred.Password,
|
|
"type": "weak-password",
|
|
}
|
|
|
|
if common.Domain != "" {
|
|
successMsg = fmt.Sprintf("SMB认证成功 %s %s\\%s:%s",
|
|
target, common.Domain, cred.Username, cred.Password)
|
|
details["domain"] = common.Domain
|
|
} else {
|
|
successMsg = fmt.Sprintf("SMB认证成功 %s %s:%s",
|
|
target, cred.Username, cred.Password)
|
|
}
|
|
|
|
// 记录成功日志
|
|
common.LogSuccess(successMsg)
|
|
|
|
// 保存结果
|
|
result := &output.ScanResult{
|
|
Time: time.Now(),
|
|
Type: output.TypeVuln,
|
|
Target: info.Host,
|
|
Status: "vulnerable",
|
|
Details: details,
|
|
}
|
|
common.SaveResult(result)
|
|
}
|
|
|