From 31806fc814d6a55e9771701fa5e5a92caa95b30c Mon Sep 17 00:00:00 2001 From: sairson Date: Mon, 10 Jan 2022 17:47:57 +0800 Subject: [PATCH] =?UTF-8?q?=E5=A2=9E=E5=8A=A0json=E6=A0=BC=E5=BC=8F?= =?UTF-8?q?=E7=BB=93=E6=9E=9C=E8=BE=93=E5=87=BA?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Yasso.json | 1 + cmd/all.go | 62 +++++++++++++++++++++++++++++++++-------------- cmd/brute.go | 15 +++++++++--- cmd/dismap.go | 29 ++++++++++++++++------ cmd/json.go | 30 +++++++++++++++++++++++ cmd/root.go | 2 +- test/test_json.go | 18 ++++++++++++++ 7 files changed, 127 insertions(+), 30 deletions(-) create mode 100644 Yasso.json create mode 100644 cmd/json.go create mode 100644 test/test_json.go diff --git a/Yasso.json b/Yasso.json new file mode 100644 index 0000000..425cee6 --- /dev/null +++ b/Yasso.json @@ -0,0 +1 @@ +[{"HostName":"192.168.248.1","Ports":[8089,135,80,5985,139,445,3306],"WeakPass":[{"smb":{"administrator":"930517"}},{"mysql":{"root":"root"}}],"Web":["200 http://192.168.248.1 [Nginx] Index of /","200 http://192.168.248.1:8089 None"]},{"HostName":"192.168.248.212","Ports":[445,80,135,139,3389,5985],"WeakPass":[{"smb":{"administrator":"P@ssw0rd"}}],"Web":["200 http://192.168.248.212 [IIS] IIS Windows Server"]},{"HostName":"192.168.248.219","Ports":[22,27017,21,5432,6379,11211],"WeakPass":[{"ssh":{"root":"kali"}},{"mongodb":{"null":"null"}},{"mongodb":{"admin":"123456"}},{"ftp":{"kali":"kali"}},{"postgres":{"admin":"admin@123"}},{"redis":{"null":"null"}},{"Memcached":{"null":"null"}}],"Web":null}] \ No newline at end of file diff --git a/cmd/all.go b/cmd/all.go index 114a212..5a0bdb4 100644 --- a/cmd/all.go +++ b/cmd/all.go @@ -16,7 +16,7 @@ var allCmd = &cobra.Command{ _ = cmd.Help() return } - allRun(Hosts, Ports, LogBool, Runtime, PingBool) + allRun(Hosts, Ports, JsonBool, Runtime, PingBool) return }, } @@ -28,11 +28,12 @@ func init() { allCmd.Flags().BoolVar(&RunICMP, "icmp", false, "Use icmp to scanner alive host") allCmd.Flags().IntVar(&Runtime, "runtime", 100, "Set scanner ants pool thread") allCmd.Flags().StringVar(&ProxyHost, "proxy", "", "Set socks5 proxy") + allCmd.Flags().BoolVar(&JsonBool, "json", false, "Output json file") allCmd.Flags().DurationVar(&TimeDuration, "time", 1*time.Second, "Set timeout ") rootCmd.AddCommand(allCmd) } -func allRun(hostString string, portString string, log bool, runtime int, noping bool) { +func allRun(hostString string, portString string, jsonbool bool, runtime int, noping bool) { defer func() { fmt.Println("[Yasso] scan task is completed") }() @@ -42,6 +43,7 @@ func allRun(hostString string, portString string, log bool, runtime int, noping webports []int alive []string wg sync.WaitGroup + lock sync.Mutex ) if hostString != "" { ips, _ = ResolveIPS(hostString) // 解析ip并获取ip列表 @@ -64,6 +66,8 @@ func allRun(hostString string, portString string, log bool, runtime int, noping } fmt.Println("[Yasoo get alive host] is", len(alive)) // 做漏洞扫描 + var out []JsonOut + if len(alive) > 0 { fmt.Println("----- [Yasso] Start do vuln scan -----") VulScan(alive, false, true, false) // 做漏洞扫描 @@ -74,49 +78,68 @@ func allRun(hostString string, portString string, log bool, runtime int, noping if len(PortResults) != 0 { fmt.Println("----- [Yasso] Start do crack service -----") for _, v := range PortResults { + var one JsonOut + // 对json各式数据复制 wg.Add(1) - go func(v PortResult) { + go func(v PortResult, one JsonOut) { defer wg.Done() + one.Host = v.IP + one.Ports = v.Port for _, p := range v.Port { + lock.Lock() switch p { case 21: users, pass := ReadTextToDic("ftp", UserDic, PassDic) - burpTask(v.IP, "ftp", users, pass, p, runtime, 1*time.Second, "", false) + burpTask(v.IP, "ftp", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one) case 22: users, pass := ReadTextToDic("ssh", UserDic, PassDic) - burpTask(v.IP, "ssh", users, pass, p, runtime, 1*time.Second, "", false) + burpTask(v.IP, "ssh", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one) case 3306: users, pass := ReadTextToDic("mysql", UserDic, PassDic) - burpTask(v.IP, "mysql", users, pass, p, runtime, 1*time.Second, "", false) + burpTask(v.IP, "mysql", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one) case 6379: - _, _, _ = RedisUnAuthConn(config.HostIn{Host: v.IP, Port: p, TimeOut: 1 * time.Second}, "test", "test") + _, b, _ := RedisUnAuthConn(config.HostIn{Host: v.IP, Port: p, TimeOut: TimeDuration}, "test", "test") + if b == true && jsonbool == true { + one.WeakPass = append(one.WeakPass, map[string]map[string]string{"redis": {"null": "null"}}) + } users, pass := ReadTextToDic("redis", UserDic, PassDic) - burpTask(v.IP, "redis", users, pass, p, runtime, 5*time.Second, "", false) + burpTask(v.IP, "redis", users, pass, p, runtime, 5*time.Second, "", false, jsonbool, &one) case 1433: users, pass := ReadTextToDic("mssql", UserDic, PassDic) - burpTask(v.IP, "mssql", users, pass, p, runtime, 1*time.Second, "", false) + burpTask(v.IP, "mssql", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one) case 5432: users, pass := ReadTextToDic("postgres", UserDic, PassDic) - burpTask(v.IP, "postgres", users, pass, p, runtime, 1*time.Second, "", false) + burpTask(v.IP, "postgres", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one) case 27017: - _, _ = MongoUnAuth(config.HostIn{Host: v.IP, Port: p, TimeOut: 1 * time.Second}, "test", "test") + b, _ := MongoUnAuth(config.HostIn{Host: v.IP, Port: p, TimeOut: TimeDuration}, "test", "test") + if b == true && jsonbool == true { + one.WeakPass = append(one.WeakPass, map[string]map[string]string{"mongodb": {"null": "null"}}) + } users, pass := ReadTextToDic("mongodb", UserDic, PassDic) - burpTask(v.IP, "mongodb", users, pass, p, runtime, 1*time.Second, "", false) + burpTask(v.IP, "mongodb", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one) case 445: users, pass := ReadTextToDic("smb", UserDic, PassDic) - burpTask(v.IP, "smb", users, pass, p, runtime, 1*time.Second, "", false) + burpTask(v.IP, "smb", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one) case 5985: users, pass := ReadTextToDic("rdp", UserDic, PassDic) // winrm与本地rdp认证相同 - burpTask(v.IP, "winrm", users, pass, p, runtime, 1*time.Second, "", false) + burpTask(v.IP, "winrm", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one) case 11211: //memcached 未授权 - _, _ = MemcacheConn(config.HostIn{Host: v.IP, Port: p, TimeOut: 1 * time.Second}) + b, _ := MemcacheConn(config.HostIn{Host: v.IP, Port: p, TimeOut: TimeDuration}) + if b == true && jsonbool == true { + one.WeakPass = append(one.WeakPass, map[string]map[string]string{"Memcached": {"null": "null"}}) + } case 2181: //zookeeper 未授权 - _, _ = ZookeeperConn(config.HostIn{Host: v.IP, Port: p, TimeOut: 1 * time.Second}) + b, _ := ZookeeperConn(config.HostIn{Host: v.IP, Port: p, TimeOut: TimeDuration}) + if b == true && jsonbool == true { + one.WeakPass = append(one.WeakPass, map[string]map[string]string{"zookeeper": {"null": "null"}}) + } } + lock.Unlock() } - }(v) + out = append(out, one) + }(v, one) } wg.Wait() } @@ -124,6 +147,9 @@ func allRun(hostString string, portString string, log bool, runtime int, noping fmt.Println("----- [Yasso] Start do Windows service scan -----") winscan(alive, true) fmt.Println("----- [Yasso] Start do web service scan -----") - DisMapScan(alive, webports) + out = DisMapScanJson(&out, webports) + } + if jsonbool == true { + Out("Yasso.json", out) } } diff --git a/cmd/brute.go b/cmd/brute.go index 3eda4e2..0c4b802 100644 --- a/cmd/brute.go +++ b/cmd/brute.go @@ -102,7 +102,7 @@ func SwitchBurp(service string, users []string, pass []string, hosts []string, p wg.Add(1) _ = ants.Submit(func() { ip := <-tunnel - burpTask(ip, service, users, pass, port, thread, timeout, Domain, true) + burpTask(ip, service, users, pass, port, thread, timeout, Domain, true, false, nil) wg.Done() }) } @@ -116,7 +116,7 @@ func SwitchBurp(service string, users []string, pass []string, hosts []string, p * 从新计算爆破方式，之前的爆破是采用分割user进行的，但是发现，user数量会远少于password，所以按照password进行分割 */ -func burpTask(host, service string, users []string, pass []string, port int, thread int, timeout time.Duration, Domain string, run bool) { +func burpTask(host, service string, users []string, pass []string, port int, thread int, timeout time.Duration, Domain string, run bool, jsonbool bool, out *JsonOut) { var t int var wg sync.WaitGroup if len(pass) <= thread { @@ -165,7 +165,7 @@ func burpTask(host, service string, users []string, pass []string, port int, thr p = strings.ReplaceAll(p, "{user}", p) } result := BurpCall(BurpModule, service, config.HostIn{Host: host, Port: port, TimeOut: time.Duration(timeout), Domain: Domain}, u, p) - burpStatus(result, service, host, Domain, u, p) + burpStatus(result, service, host, Domain, u, p, jsonbool, out) } } wg.Done() @@ -174,7 +174,8 @@ func burpTask(host, service string, users []string, pass []string, port int, thr wg.Wait() } -func burpStatus(result []reflect.Value, service, host, domain, user, pass string) { +func burpStatus(result []reflect.Value, service, host, domain, user, pass string, jsonbool bool, out *JsonOut) { + var lock sync.Mutex // 这里是判断类型并返回结果的函数 if len(result) > 0 { for _, v := range result { @@ -184,6 +185,12 @@ func burpStatus(result []reflect.Value, service, host, domain, user, pass string if domain != "" { domain = domain + "\\" } + if jsonbool == true { + // 加锁 + lock.Lock() + out.WeakPass = append(out.WeakPass, map[string]map[string]string{service: {user: pass}}) + lock.Unlock() + } Println(fmt.Sprintf(Clearln+`[+] %s brute %s success [%v%s:%s]`, host, service, domain, user, pass)) } } diff --git a/cmd/dismap.go b/cmd/dismap.go index 7f7449f..97fa690 100644 --- a/cmd/dismap.go +++ b/cmd/dismap.go @@ -22,6 +22,7 @@ func init() { DisMapCmd.Flags().StringVar(&ProxyHost, "proxy", "", "Set socks5 proxy and use it ") } +var lock sync.Mutex var DisMapCmd = &cobra.Command{ Use: "webscan", Short: "Use dismap module discover Web fingerprints (support proxy)", @@ -60,12 +61,23 @@ func DisMapScan(host []string, ports []int) { var wg sync.WaitGroup for _, ip := range host { wg.Add(1) - EachDisMap(ip, ports, &wg) + EachDisMap(ip, ports, &wg, nil) } wg.Wait() } -func EachDisMap(host string, ports []int, w *sync.WaitGroup) { +func DisMapScanJson(in *[]JsonOut, ports []int) (out []JsonOut) { + var wg sync.WaitGroup + for _, v := range *in { + wg.Add(1) + s := EachDisMap(v.Host, ports, &wg, &v) + out = append(out, s) + } + wg.Wait() + return out +} + +func EachDisMap(host string, ports []int, w *sync.WaitGroup, v *JsonOut) JsonOut { defer w.Done() var wg sync.WaitGroup // 计算一个协程需要扫描多少端口 @@ -94,26 +106,29 @@ func EachDisMap(host string, ports []int, w *sync.WaitGroup) { for i := 1; i <= thread; i++ { wg.Add(1) tmp := all[i] - go func() { + go func(out *JsonOut) { defer wg.Done() // 1,2 2,3 //Println(i,thread) for _, port := range tmp { // 遍历每一个端口列表 - DisMapConn(host, port) + DisMapConn(host, port, v) } - - }() + }(v) } wg.Wait() + return *v } -func DisMapConn(host string, port int) bool { +func DisMapConn(host string, port int, out *JsonOut) bool { url := ParseUrl(host, strconv.Itoa(port)) for _, r := range Identify(url, TimeDuration) { if r.RespCode != "" { + lock.Lock() + out.WebHosts = append(out.WebHosts, fmt.Sprintf("%v %v %v %v", r.RespCode, r.Url, r.Result, r.Title)) Println(fmt.Sprintf("[+] %v %v %v %v", r.RespCode, r.Url, r.Result, r.Title)) + lock.Unlock() } } return true diff --git a/cmd/json.go b/cmd/json.go new file mode 100644 index 0000000..cee7929 --- /dev/null +++ b/cmd/json.go @@ -0,0 +1,30 @@ +package cmd + +import ( + "encoding/json" + "fmt" + "os" +) + +// 输出json格式数据 + +type JsonOut struct { + Host string `json:"HostName"` + Ports []int `json:"Ports"` + WeakPass []map[string]map[string]string `json:"WeakPass"` + WebHosts []string `json:"Web"` +} + +func Out(filename string, js []JsonOut) { + file, err := os.OpenFile(filename, os.O_APPEND|os.O_CREATE, 0666) + if err != nil { + Println(fmt.Sprintf("[!] create json file failed %v", err)) + return + } + b, err := json.Marshal(&js) + if err != nil { + Println(fmt.Sprintf("[!] json marshal is failed %v", err)) + return + } + _, _ = file.Write(b) +} diff --git a/cmd/root.go b/cmd/root.go index 6392128..fd6cfa1 100644 --- a/cmd/root.go +++ b/cmd/root.go @@ -13,7 +13,7 @@ var ( RunICMP bool // 是否执行ICMP Ports string // 需要解析的端口 Runtime int // 运行的线程 - LogBool bool // 是否使用日志 + JsonBool bool // 是否使用日志 PingBool bool // 是否执行ping操作 UserDic string // 爆破的用户名路径 PassDic string // 爆破的密码路径 diff --git a/test/test_json.go b/test/test_json.go new file mode 100644 index 0000000..10397fd --- /dev/null +++ b/test/test_json.go @@ -0,0 +1,18 @@ +package main + +import "Yasso/cmd" + +func main() { + _ = cmd.JsonOut{ + Host: "123456", + Ports: []int{25, 12, 33, 14, 55, 80, 443}, + WeakPass: []map[string]map[string]string{ + {"redis": map[string]string{"admin": "123456"}}, + }, + HostVulcan: []map[string]string{ + {"192.168.248.1": "MS17010"}, + {"192.168.248.2": "smbghost"}, + }, + WebHosts: nil, + } +}