backup/Yasso
1
0
Fork 0
mirror of https://github.com/sairson/Yasso.git synced 2026-10-29 03:33:59 +08:00
Code Issues Projects Releases Wiki Activity

增加json格式结果输出

Browse Source
This commit is contained in:
sairson
2022-01-10 17:47:57 +08:00
parent c793ff4145
commit 31806fc814
7 changed files with 127 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
Yasso.json Normal file
View File

@@ -0,0 +1 @@
[{"HostName":"192.168.248.1","Ports":[8089,135,80,5985,139,445,3306],"WeakPass":[{"smb":{"administrator":"930517"}},{"mysql":{"root":"root"}}],"Web":["200 http://192.168.248.1 [Nginx] Index of /","200 http://192.168.248.1:8089 None"]},{"HostName":"192.168.248.212","Ports":[445,80,135,139,3389,5985],"WeakPass":[{"smb":{"administrator":"P@ssw0rd"}}],"Web":["200 http://192.168.248.212 [IIS] IIS Windows Server"]},{"HostName":"192.168.248.219","Ports":[22,27017,21,5432,6379,11211],"WeakPass":[{"ssh":{"root":"kali"}},{"mongodb":{"null":"null"}},{"mongodb":{"admin":"123456"}},{"ftp":{"kali":"kali"}},{"postgres":{"admin":"admin@123"}},{"redis":{"null":"null"}},{"Memcached":{"null":"null"}}],"Web":null}]

62
cmd/all.go
View File

@@ -16,7 +16,7 @@ var allCmd = &cobra.Command{
_ = cmd.Help()
return
}
allRun(Hosts, Ports, LogBool, Runtime, PingBool)
allRun(Hosts, Ports, JsonBool, Runtime, PingBool)
return
},
}
@@ -28,11 +28,12 @@ func init() {
allCmd.Flags().BoolVar(&RunICMP, "icmp", false, "Use icmp to scanner alive host")
allCmd.Flags().IntVar(&Runtime, "runtime", 100, "Set scanner ants pool thread")
allCmd.Flags().StringVar(&ProxyHost, "proxy", "", "Set socks5 proxy")
allCmd.Flags().BoolVar(&JsonBool, "json", false, "Output json file")
allCmd.Flags().DurationVar(&TimeDuration, "time", 1*time.Second, "Set timeout ")
rootCmd.AddCommand(allCmd)
}
func allRun(hostString string, portString string, log bool, runtime int, noping bool) {
func allRun(hostString string, portString string, jsonbool bool, runtime int, noping bool) {
defer func() {
fmt.Println("[Yasso] scan task is completed")
}()
@@ -42,6 +43,7 @@ func allRun(hostString string, portString string, log bool, runtime int, noping
webports []int
alive []string
wg sync.WaitGroup
lock sync.Mutex
)
if hostString != "" {
ips, _ = ResolveIPS(hostString) // 解析ip并获取ip列表
@@ -64,6 +66,8 @@ func allRun(hostString string, portString string, log bool, runtime int, noping
}
fmt.Println("[Yasoo get alive host] is", len(alive))
// 做漏洞扫描
var out []JsonOut
if len(alive) > 0 {
fmt.Println("----- [Yasso] Start do vuln scan -----")
VulScan(alive, false, true, false) // 做漏洞扫描
@@ -74,49 +78,68 @@ func allRun(hostString string, portString string, log bool, runtime int, noping
if len(PortResults) != 0 {
fmt.Println("----- [Yasso] Start do crack service -----")
for _, v := range PortResults {
var one JsonOut
// 对json各式数据复制
wg.Add(1)
go func(v PortResult) {
go func(v PortResult, one JsonOut) {
defer wg.Done()
one.Host = v.IP
one.Ports = v.Port
for _, p := range v.Port {
lock.Lock()
switch p {
case 21:
users, pass := ReadTextToDic("ftp", UserDic, PassDic)
burpTask(v.IP, "ftp", users, pass, p, runtime, 1*time.Second, "", false)
burpTask(v.IP, "ftp", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one)
case 22:
users, pass := ReadTextToDic("ssh", UserDic, PassDic)
burpTask(v.IP, "ssh", users, pass, p, runtime, 1*time.Second, "", false)
burpTask(v.IP, "ssh", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one)
case 3306:
users, pass := ReadTextToDic("mysql", UserDic, PassDic)
burpTask(v.IP, "mysql", users, pass, p, runtime, 1*time.Second, "", false)
burpTask(v.IP, "mysql", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one)
case 6379:
_, _, _ = RedisUnAuthConn(config.HostIn{Host: v.IP, Port: p, TimeOut: 1 * time.Second}, "test", "test")
_, b, _ := RedisUnAuthConn(config.HostIn{Host: v.IP, Port: p, TimeOut: TimeDuration}, "test", "test")
if b == true && jsonbool == true {
one.WeakPass = append(one.WeakPass, map[string]map[string]string{"redis": {"null": "null"}})
}
users, pass := ReadTextToDic("redis", UserDic, PassDic)
burpTask(v.IP, "redis", users, pass, p, runtime, 5*time.Second, "", false)
burpTask(v.IP, "redis", users, pass, p, runtime, 5*time.Second, "", false, jsonbool, &one)
case 1433:
users, pass := ReadTextToDic("mssql", UserDic, PassDic)
burpTask(v.IP, "mssql", users, pass, p, runtime, 1*time.Second, "", false)
burpTask(v.IP, "mssql", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one)
case 5432:
users, pass := ReadTextToDic("postgres", UserDic, PassDic)
burpTask(v.IP, "postgres", users, pass, p, runtime, 1*time.Second, "", false)
burpTask(v.IP, "postgres", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one)
case 27017:
_, _ = MongoUnAuth(config.HostIn{Host: v.IP, Port: p, TimeOut: 1 * time.Second}, "test", "test")
b, _ := MongoUnAuth(config.HostIn{Host: v.IP, Port: p, TimeOut: TimeDuration}, "test", "test")
if b == true && jsonbool == true {
one.WeakPass = append(one.WeakPass, map[string]map[string]string{"mongodb": {"null": "null"}})
}
users, pass := ReadTextToDic("mongodb", UserDic, PassDic)
burpTask(v.IP, "mongodb", users, pass, p, runtime, 1*time.Second, "", false)
burpTask(v.IP, "mongodb", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one)
case 445:
users, pass := ReadTextToDic("smb", UserDic, PassDic)
burpTask(v.IP, "smb", users, pass, p, runtime, 1*time.Second, "", false)
burpTask(v.IP, "smb", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one)
case 5985:
users, pass := ReadTextToDic("rdp", UserDic, PassDic) // winrm与本地rdp认证相同
burpTask(v.IP, "winrm", users, pass, p, runtime, 1*time.Second, "", false)
burpTask(v.IP, "winrm", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one)
case 11211:
//memcached 未授权
_, _ = MemcacheConn(config.HostIn{Host: v.IP, Port: p, TimeOut: 1 * time.Second})
b, _ := MemcacheConn(config.HostIn{Host: v.IP, Port: p, TimeOut: TimeDuration})
if b == true && jsonbool == true {
one.WeakPass = append(one.WeakPass, map[string]map[string]string{"Memcached": {"null": "null"}})
}
case 2181:
//zookeeper 未授权
_, _ = ZookeeperConn(config.HostIn{Host: v.IP, Port: p, TimeOut: 1 * time.Second})
b, _ := ZookeeperConn(config.HostIn{Host: v.IP, Port: p, TimeOut: TimeDuration})
if b == true && jsonbool == true {
one.WeakPass = append(one.WeakPass, map[string]map[string]string{"zookeeper": {"null": "null"}})
}
}
lock.Unlock()
}
}(v)
out = append(out, one)
}(v, one)
}
wg.Wait()
}
@@ -124,6 +147,9 @@ func allRun(hostString string, portString string, log bool, runtime int, noping
fmt.Println("----- [Yasso] Start do Windows service scan -----")
winscan(alive, true)
fmt.Println("----- [Yasso] Start do web service scan -----")
DisMapScan(alive, webports)
out = DisMapScanJson(&out, webports)
}
if jsonbool == true {
Out("Yasso.json", out)
}
}

15
cmd/brute.go
View File

@@ -102,7 +102,7 @@ func SwitchBurp(service string, users []string, pass []string, hosts []string, p
wg.Add(1)
_ = ants.Submit(func() {
ip := <-tunnel
burpTask(ip, service, users, pass, port, thread, timeout, Domain, true)
burpTask(ip, service, users, pass, port, thread, timeout, Domain, true, false, nil)
wg.Done()
})
}
@@ -116,7 +116,7 @@ func SwitchBurp(service string, users []string, pass []string, hosts []string, p
* 从新计算爆破方式，之前的爆破是采用分割user进行的，但是发现，user数量会远少于password，所以按照password进行分割
*/
func burpTask(host, service string, users []string, pass []string, port int, thread int, timeout time.Duration, Domain string, run bool) {
func burpTask(host, service string, users []string, pass []string, port int, thread int, timeout time.Duration, Domain string, run bool, jsonbool bool, out *JsonOut) {
var t int
var wg sync.WaitGroup
if len(pass) <= thread {
@@ -165,7 +165,7 @@ func burpTask(host, service string, users []string, pass []string, port int, thr
p = strings.ReplaceAll(p, "{user}", p)
}
result := BurpCall(BurpModule, service, config.HostIn{Host: host, Port: port, TimeOut: time.Duration(timeout), Domain: Domain}, u, p)
burpStatus(result, service, host, Domain, u, p)
burpStatus(result, service, host, Domain, u, p, jsonbool, out)
}
}
wg.Done()
@@ -174,7 +174,8 @@ func burpTask(host, service string, users []string, pass []string, port int, thr
wg.Wait()
}
func burpStatus(result []reflect.Value, service, host, domain, user, pass string) {
func burpStatus(result []reflect.Value, service, host, domain, user, pass string, jsonbool bool, out *JsonOut) {
var lock sync.Mutex
// 这里是判断类型并返回结果的函数
if len(result) > 0 {
for _, v := range result {
@@ -184,6 +185,12 @@ func burpStatus(result []reflect.Value, service, host, domain, user, pass string
if domain != "" {
domain = domain + "\\"
}
if jsonbool == true {
// 加锁
lock.Lock()
out.WeakPass = append(out.WeakPass, map[string]map[string]string{service: {user: pass}})
lock.Unlock()
}
Println(fmt.Sprintf(Clearln+`[+] %s brute %s success [%v%s:%s]`, host, service, domain, user, pass))
}
}

29
cmd/dismap.go
View File

@@ -22,6 +22,7 @@ func init() {
DisMapCmd.Flags().StringVar(&ProxyHost, "proxy", "", "Set socks5 proxy and use it ")
}
var lock sync.Mutex
var DisMapCmd = &cobra.Command{
Use: "webscan",
Short: "Use dismap module discover Web fingerprints (support proxy)",
@@ -60,12 +61,23 @@ func DisMapScan(host []string, ports []int) {
var wg sync.WaitGroup
for _, ip := range host {
wg.Add(1)
EachDisMap(ip, ports, &wg)
EachDisMap(ip, ports, &wg, nil)
}
wg.Wait()
}
func EachDisMap(host string, ports []int, w *sync.WaitGroup) {
func DisMapScanJson(in *[]JsonOut, ports []int) (out []JsonOut) {
var wg sync.WaitGroup
for _, v := range *in {
wg.Add(1)
s := EachDisMap(v.Host, ports, &wg, &v)
out = append(out, s)
}
wg.Wait()
return out
}
func EachDisMap(host string, ports []int, w *sync.WaitGroup, v *JsonOut) JsonOut {
defer w.Done()
var wg sync.WaitGroup
// 计算一个协程需要扫描多少端口
@@ -94,26 +106,29 @@ func EachDisMap(host string, ports []int, w *sync.WaitGroup) {
for i := 1; i <= thread; i++ {
wg.Add(1)
tmp := all[i]
go func() {
go func(out *JsonOut) {
defer wg.Done()
// 1,2 2,3
//Println(i,thread)
for _, port := range tmp {
// 遍历每一个端口列表
DisMapConn(host, port)
DisMapConn(host, port, v)
}
}()
}(v)
}
wg.Wait()
return *v
}
func DisMapConn(host string, port int) bool {
func DisMapConn(host string, port int, out *JsonOut) bool {
url := ParseUrl(host, strconv.Itoa(port))
for _, r := range Identify(url, TimeDuration) {
if r.RespCode != "" {
lock.Lock()
out.WebHosts = append(out.WebHosts, fmt.Sprintf("%v %v %v %v", r.RespCode, r.Url, r.Result, r.Title))
Println(fmt.Sprintf("[+] %v %v %v %v", r.RespCode, r.Url, r.Result, r.Title))
lock.Unlock()
}
}
return true

30
cmd/json.go Normal file
View File

@@ -0,0 +1,30 @@
package cmd
import (
"encoding/json"
"fmt"
"os"
)
// 输出json格式数据
type JsonOut struct {
Host string `json:"HostName"`
Ports []int `json:"Ports"`
WeakPass []map[string]map[string]string `json:"WeakPass"`
WebHosts []string `json:"Web"`
}
func Out(filename string, js []JsonOut) {
file, err := os.OpenFile(filename, os.O_APPEND|os.O_CREATE, 0666)
if err != nil {
Println(fmt.Sprintf("[!] create json file failed %v", err))
return
}
b, err := json.Marshal(&js)
if err != nil {
Println(fmt.Sprintf("[!] json marshal is failed %v", err))
return
}
_, _ = file.Write(b)
}

2
cmd/root.go
View File

@@ -13,7 +13,7 @@ var (
RunICMP bool // 是否执行ICMP
Ports string // 需要解析的端口
Runtime int // 运行的线程
LogBool bool // 是否使用日志
JsonBool bool // 是否使用日志
PingBool bool // 是否执行ping操作
UserDic string // 爆破的用户名路径
PassDic string // 爆破的密码路径

18
test/test_json.go Normal file
View File

@@ -0,0 +1,18 @@
package main
import "Yasso/cmd"
func main() {
_ = cmd.JsonOut{
Host: "123456",
Ports: []int{25, 12, 33, 14, 55, 80, 443},
WeakPass: []map[string]map[string]string{
{"redis": map[string]string{"admin": "123456"}},
},
HostVulcan: []map[string]string{
{"192.168.248.1": "MS17010"},
{"192.168.248.2": "smbghost"},
},
WebHosts: nil,
}
}