backup/Yasso
1
0
Fork 0
mirror of https://github.com/sairson/Yasso.git synced 2026-02-12 23:06:02 +08:00
Code Issues Projects Releases Wiki Activity

增加文件支持127.0.0.1:8080格式

Browse Source
This commit is contained in:
SaiRson
2022-03-15 14:39:02 +08:00
committed by GitHub
parent d78e94cc46
commit 6766fbc163
10 changed files with 1538 additions and 273 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
Yasso.json
View File

@@ -1 +1,51 @@
[{"HostName":"192.168.248.1","Ports":[8089,135,80,5985,139,445,3306],"WeakPass":[{"smb":{"administrator":"930517"}},{"mysql":{"root":"root"}}],"Web":["200 http://192.168.248.1 [Nginx] Index of /","200 http://192.168.248.1:8089 None"]},{"HostName":"192.168.248.212","Ports":[445,80,135,139,3389,5985],"WeakPass":[{"smb":{"administrator":"P@ssw0rd"}}],"Web":["200 http://192.168.248.212 [IIS] IIS Windows Server"]},{"HostName":"192.168.248.219","Ports":[22,27017,21,5432,6379,11211],"WeakPass":[{"ssh":{"root":"kali"}},{"mongodb":{"null":"null"}},{"mongodb":{"admin":"123456"}},{"ftp":{"kali":"kali"}},{"postgres":{"admin":"admin@123"}},{"redis":{"null":"null"}},{"Memcached":{"null":"null"}}],"Web":null}]
[
{
"HostName": "192.168.248.219",
"Ports": [
21,
27017,
6379,
22,
11211,
5432
],
"WeakPass": [
{
"ftp": {
"kali": "kali"
}
},
{
"mongodb": {
"null": "null"
}
},
{
"mongodb": {
"admin": "123456"
}
},
{
"redis": {
"null": "null"
}
},
{
"ssh": {
"root": "kali"
}
},
{
"Memcached": {
"null": "null"
}
},
{
"postgres": {
"admin": "admin@123"
}
}
],
"Web": null
}
]

1185
Yasso.log Normal file
View File

File diff suppressed because it is too large Load Diff

4
cmd/all.go
View File

@@ -64,10 +64,10 @@ func allRun(hostString string, portString string, jsonbool bool, runtime int, no
fmt.Println("----- [Yasso] Start do ping scan -----")
alive = execute(ips, RunICMP)
}
fmt.Println("[Yasoo get alive host] is", len(alive))
fmt.Println("[Yasso get alive host] is", len(alive))
// 做漏洞扫描
var out []JsonOut
//TODO:
if len(alive) > 0 {
fmt.Println("----- [Yasso] Start do vuln scan -----")
VulScan(alive, false, true, false) // 做漏洞扫描

514
cmd/brute.go
View File

@@ -1,257 +1,257 @@
package cmd
import (
"Yasso/config"
"bufio"
"fmt"
"github.com/panjf2000/ants/v2"
"github.com/spf13/cobra"
"io"
"log"
"math"
"os"
"reflect"
"strings"
"sync"
"time"
)
// 爆破模块
const (
Clearln = "\r\x1b[2K"
)
var BruteCmd = &cobra.Command{
Use: "crack",
Short: "crack module and extend tool",
Run: func(cmd *cobra.Command, args []string) {
cmd.DisableFlagsInUseLine = true
_ = cmd.Help()
},
}
func init() {
// 添加全局变量
BruteCmd.PersistentFlags().StringVarP(&Hosts, "hosts", "H", "", "to crack hosts address or ips.txt path (crack Must)")
BruteCmd.PersistentFlags().IntVar(&BrutePort, "port", 0, "to crack hosts port (if not set use default)")
BruteCmd.PersistentFlags().IntVar(&Runtime, "runtime", 100, "set crack thread number")
BruteCmd.PersistentFlags().BoolVarP(&BruteFlag, "crack", "", false, "make sure to use crack")
BruteCmd.PersistentFlags().DurationVar(&TimeDuration, "timeout", 1*time.Second, "crack module timeout(.eg) 1s (ns,ms,s,m,h)")
BruteCmd.PersistentFlags().StringVar(&PassDic, "pd", "", "pass dic path (.eg) pass.txt")
BruteCmd.PersistentFlags().StringVar(&UserDic, "ud", "", "user dic path (.eg) user.txt")
BruteCmd.PersistentFlags().StringVar(&ProxyHost, "proxy", "", "set socks5 proxy address")
BruteCmd.AddCommand(SshCmd)
BruteCmd.AddCommand(WinRMCmd)
BruteCmd.AddCommand(SmbCmd)
BruteCmd.AddCommand(Log4jCmd)
BruteCmd.AddCommand(RedisCmd)
BruteCmd.AddCommand(RdpCmd)
BruteCmd.AddCommand(MysqlCmd)
BruteCmd.AddCommand(MssqlCmd)
BruteCmd.AddCommand(FtpCmd)
BruteCmd.AddCommand(PostgreCmd)
BruteCmd.AddCommand(MongoCmd)
rootCmd.AddCommand(BruteCmd)
}
var BurpModule = map[string]interface{}{
"ssh": SshConnByUser,
"mysql": MySQLConn,
"mssql": MssqlConn,
"redis": RedisAuthConn,
"unredis": RedisUnAuthConn, // redis 未授权
"postgres": PostgreConn,
"smb": SmbConn,
"ftp": FtpConn,
"rdp": RdpConn,
"winrm": WinRMAuth,
"mongodb": MongoAuth,
"unmongodb": MongoUnAuth, // mongodb 未授权
}
func BurpCall(EncryptMap map[string]interface{}, name string, params ...interface{}) []reflect.Value {
f := reflect.ValueOf(EncryptMap[name]) // 获取map键位name的值
if len(params) != f.Type().NumIn() { // 如果参数的值不等于函数所需要的值
log.Println(fmt.Sprintf("[ERROR] Burp Call Func key name %s is failed", name))
os.Exit(1)
}
args := make([]reflect.Value, len(params))
for k, param := range params {
if param == "" || param == 0 {
continue
}
//Println()(param)
args[k] = reflect.ValueOf(param)
}
//Println()(args)
//fmt.Println(args)
return f.Call(args) // 调用函数并返回结果
}
func SwitchBurp(service string, users []string, pass []string, hosts []string, port int, thread int, timeout time.Duration, Domain string) {
// 传入的参数均为3个
// 调用方式
var tunnel = make(chan string, 20)
var wg sync.WaitGroup
go func() {
for _, ip := range hosts {
tunnel <- ip
}
}()
for i := 0; i < len(hosts); i++ {
wg.Add(1)
_ = ants.Submit(func() {
ip := <-tunnel
burpTask(ip, service, users, pass, port, thread, timeout, Domain, true, false, nil)
wg.Done()
})
}
wg.Wait()
Println(fmt.Sprintf(Clearln+"[*] brute %s done", service))
//Println()(service,users,pass,hosts,port,thread,BurpModule)
}
/***
* 从新计算爆破方式，之前的爆破是采用分割user进行的，但是发现，user数量会远少于password，所以按照password进行分割
*/
func burpTask(host, service string, users []string, pass []string, port int, thread int, timeout time.Duration, Domain string, run bool, jsonbool bool, out *JsonOut) {
var t int
var wg sync.WaitGroup
if len(pass) <= thread {
t = len(pass)
} else {
// 计算user数量
t = thread // 协程数量
}
num := int(math.Ceil(float64(len(pass)) / float64(thread))) // 每个协程的user数量
// 分割用户名
all := map[int][]string{}
for i := 1; i <= t; i++ {
for j := 0; j < num; j++ {
tmp := (i-1)*num + j
if tmp < len(pass) {
all[i] = append(all[i], pass[tmp])
}
}
}
if run {
go func() {
for {
for _, r := range `-\|/` {
fmt.Printf("\r%c brute: wating ... %c", r, r)
time.Sleep(200 * time.Millisecond)
}
}
}()
}
if service == "redis" && run == true {
BurpCall(BurpModule, "unredis", config.HostIn{Host: host, Port: BrutePort, TimeOut: TimeDuration}, "test", "test")
}
if service == "mongodb" && run == true {
BurpCall(BurpModule, "unmongodb", config.HostIn{Host: host, Port: BrutePort, TimeOut: TimeDuration}, "test", "test")
}
//Println()(all,num,t)
for i := 1; i <= t; i++ {
wg.Add(1)
tmp := all[i]
_ = ants.Submit(func() {
for _, p := range tmp {
for _, u := range users {
if strings.Contains(p, "{user}") {
p = strings.ReplaceAll(p, "{user}", p)
}
if u == "" || p == "" {
continue
} else {
result := BurpCall(BurpModule, service, config.HostIn{Host: host, Port: port, TimeOut: time.Duration(timeout), Domain: Domain}, u, p)
burpStatus(result, service, host, Domain, u, p, jsonbool, out)
}
}
}
wg.Done()
})
}
wg.Wait()
}
func burpStatus(result []reflect.Value, service, host, domain, user, pass string, jsonbool bool, out *JsonOut) {
var lock sync.Mutex
// 这里是判断类型并返回结果的函数
if len(result) > 0 {
for _, v := range result {
switch v.Kind() {
case reflect.Bool:
if v.Bool() == true {
if domain != "" {
domain = domain + "\\"
}
if jsonbool == true {
// 加锁
lock.Lock()
out.WeakPass = append(out.WeakPass, map[string]map[string]string{service: {user: pass}})
lock.Unlock()
}
Println(fmt.Sprintf(Clearln+`[+] %s brute %s success [%v%s:%s]`, host, service, domain, user, pass))
}
}
}
}
}
func Readiness(file *os.File) []string {
var readiness []string /*定义一个空切片用于存储遍历后的数据*/
buf := bufio.NewReader(file) /*建立一个缓冲区，将文本内容写入缓冲区*/
for {
data, errR := buf.ReadBytes('\n') /*读取到\n截至*/
if errR != nil {
if errR == io.EOF {
break
}
return readiness
}
str := strings.TrimSpace(string(data))
// 修复读取时出现空的导致抛出panic
if str == "" {
continue
}
readiness = append(readiness, str) /*将去除换行符的字符串写入切片*/
}
return readiness
}
func ReadTextToDic(service, user, pass string) ([]string, []string) {
var (
userdic = config.Userdict[service]
passdic = config.Passwords
)
// 入过不包含.txt的话，按照用户名和密码来算。其中
if user != "" && !strings.Contains(user, ".txt") {
userdic = strings.Split(user, ",")
}
if pass != "" && !strings.Contains(pass, ".txt") {
passdic = strings.Split(pass, ",")
}
if user != "" && strings.Contains(user, ".txt") {
userive, err := os.Open(user)
if err != nil {
Println(fmt.Sprintf(Clearln+"[ERROR] Open %s is failed,please check your user dic path", UserDic))
return []string{}, []string{}
}
userdic = Readiness(userive)
}
if pass != "" && strings.Contains(pass, ".txt") {
passive, err := os.Open(pass)
if err != nil {
Println(fmt.Sprintf(Clearln+"[ERROR] Open %s is failed,please check your pass dic path", PassDic))
return []string{}, []string{}
}
passdic = Readiness(passive)
}
return userdic, passdic
}
package cmd
import (
"Yasso/config"
"bufio"
"fmt"
"github.com/panjf2000/ants/v2"
"github.com/spf13/cobra"
"io"
"log"
"math"
"os"
"reflect"
"strings"
"sync"
"time"
)
// 爆破模块
const (
Clearln = "\r\x1b[2K"
)
var BruteCmd = &cobra.Command{
Use: "crack",
Short: "crack module and extend tool",
Run: func(cmd *cobra.Command, args []string) {
cmd.DisableFlagsInUseLine = true
_ = cmd.Help()
},
}
func init() {
// 添加全局变量
BruteCmd.PersistentFlags().StringVarP(&Hosts, "hosts", "H", "", "to crack hosts address or ips.txt path (crack Must)")
BruteCmd.PersistentFlags().IntVar(&BrutePort, "port", 0, "to crack hosts port (if not set use default)")
BruteCmd.PersistentFlags().IntVar(&Runtime, "runtime", 100, "set crack thread number")
BruteCmd.PersistentFlags().BoolVarP(&BruteFlag, "crack", "", false, "make sure to use crack")
BruteCmd.PersistentFlags().DurationVar(&TimeDuration, "timeout", 1*time.Second, "crack module timeout(.eg) 1s (ns,ms,s,m,h)")
BruteCmd.PersistentFlags().StringVar(&PassDic, "pd", "", "pass dic path (.eg) pass.txt")
BruteCmd.PersistentFlags().StringVar(&UserDic, "ud", "", "user dic path (.eg) user.txt")
BruteCmd.PersistentFlags().StringVar(&ProxyHost, "proxy", "", "set socks5 proxy address")
BruteCmd.AddCommand(SshCmd)
BruteCmd.AddCommand(WinRMCmd)
BruteCmd.AddCommand(SmbCmd)
BruteCmd.AddCommand(Log4jCmd)
BruteCmd.AddCommand(RedisCmd)
BruteCmd.AddCommand(RdpCmd)
BruteCmd.AddCommand(MysqlCmd)
BruteCmd.AddCommand(MssqlCmd)
BruteCmd.AddCommand(FtpCmd)
BruteCmd.AddCommand(PostgreCmd)
BruteCmd.AddCommand(MongoCmd)
rootCmd.AddCommand(BruteCmd)
}
var BurpModule = map[string]interface{}{
"ssh": SshConnByUser,
"mysql": MySQLConn,
"mssql": MssqlConn,
"redis": RedisAuthConn,
"unredis": RedisUnAuthConn, // redis 未授权
"postgres": PostgreConn,
"smb": SmbConn,
"ftp": FtpConn,
"rdp": RdpConn,
"winrm": WinRMAuth,
"mongodb": MongoAuth,
"unmongodb": MongoUnAuth, // mongodb 未授权
}
func BurpCall(EncryptMap map[string]interface{}, name string, params ...interface{}) []reflect.Value {
f := reflect.ValueOf(EncryptMap[name]) // 获取map键位name的值
if len(params) != f.Type().NumIn() { // 如果参数的值不等于函数所需要的值
log.Println(fmt.Sprintf("[ERROR] Burp Call Func key name %s is failed", name))
os.Exit(1)
}
args := make([]reflect.Value, len(params))
for k, param := range params {
if param == "" || param == 0 {
continue
}
//Println()(param)
args[k] = reflect.ValueOf(param)
}
//Println()(args)
//fmt.Println(args)
return f.Call(args) // 调用函数并返回结果
}
func SwitchBurp(service string, users []string, pass []string, hosts []string, port int, thread int, timeout time.Duration, Domain string) {
// 传入的参数均为3个
// 调用方式
var tunnel = make(chan string, 20)
var wg sync.WaitGroup
go func() {
for _, ip := range hosts {
tunnel <- ip
}
}()
for i := 0; i < len(hosts); i++ {
wg.Add(1)
_ = ants.Submit(func() {
ip := <-tunnel
burpTask(ip, service, users, pass, port, thread, timeout, Domain, true, false, nil)
wg.Done()
})
}
wg.Wait()
Println(fmt.Sprintf(Clearln+"[*] brute %s done", service))
//Println()(service,users,pass,hosts,port,thread,BurpModule)
}
/***
* 从新计算爆破方式，之前的爆破是采用分割user进行的，但是发现，user数量会远少于password，所以按照password进行分割
*/
func burpTask(host, service string, users []string, pass []string, port int, thread int, timeout time.Duration, Domain string, run bool, jsonbool bool, out *JsonOut) {
var t int
var wg sync.WaitGroup
if len(pass) <= thread {
t = len(pass)
} else {
// 计算user数量
t = thread // 协程数量
}
num := int(math.Ceil(float64(len(pass)) / float64(thread))) // 每个协程的user数量
// 分割用户名
all := map[int][]string{}
for i := 1; i <= t; i++ {
for j := 0; j < num; j++ {
tmp := (i-1)*num + j
if tmp < len(pass) {
all[i] = append(all[i], pass[tmp])
}
}
}
if run {
go func() {
for {
for _, r := range `-\|/` {
fmt.Printf("\r%c brute: wating ... %c", r, r)
time.Sleep(200 * time.Millisecond)
}
}
}()
}
if service == "redis" && run == true {
BurpCall(BurpModule, "unredis", config.HostIn{Host: host, Port: BrutePort, TimeOut: TimeDuration}, "test", "test")
}
if service == "mongodb" && run == true {
BurpCall(BurpModule, "unmongodb", config.HostIn{Host: host, Port: BrutePort, TimeOut: TimeDuration}, "test", "test")
}
//Println()(all,num,t)
for i := 1; i <= t; i++ {
wg.Add(1)
tmp := all[i]
_ = ants.Submit(func() {
for _, p := range tmp {
for _, u := range users {
if strings.Contains(p, "{user}") {
p = strings.ReplaceAll(p, "{user}", p)
}
if u == "" || p == "" {
continue
} else {
result := BurpCall(BurpModule, service, config.HostIn{Host: host, Port: port, TimeOut: time.Duration(timeout), Domain: Domain}, u, p)
burpStatus(result, service, host, Domain, u, p, jsonbool, out)
}
}
}
wg.Done()
})
}
wg.Wait()
}
func burpStatus(result []reflect.Value, service, host, domain, user, pass string, jsonbool bool, out *JsonOut) {
var lock sync.Mutex
// 这里是判断类型并返回结果的函数
if len(result) > 0 {
for _, v := range result {
switch v.Kind() {
case reflect.Bool:
if v.Bool() == true {
if domain != "" {
domain = domain + "\\"
}
if jsonbool == true {
// 加锁
lock.Lock()
out.WeakPass = append(out.WeakPass, map[string]map[string]string{service: {user: pass}})
lock.Unlock()
}
Println(fmt.Sprintf(Clearln+`[+] %s brute %s success [%v%s:%s]`, host, service, domain, user, pass))
}
}
}
}
}
func Readiness(file *os.File) []string {
var readiness []string /*定义一个空切片用于存储遍历后的数据*/
buf := bufio.NewReader(file) /*建立一个缓冲区，将文本内容写入缓冲区*/
for {
data, errR := buf.ReadBytes('\n') /*读取到\n截至*/
if errR != nil {
if errR == io.EOF {
break
}
return readiness
}
str := strings.TrimSpace(string(data))
// 修复读取时出现空的导致抛出panic
if str == "" {
continue
}
readiness = append(readiness, str) /*将去除换行符的字符串写入切片*/
}
return readiness
}
func ReadTextToDic(service, user, pass string) ([]string, []string) {
var (
userdic = config.Userdict[service]
passdic = config.Passwords
)
// 如果不包含.txt的话，按照用户名和密码来算。其中
if user != "" && !strings.Contains(user, ".txt") {
userdic = strings.Split(user, ",")
}
if pass != "" && !strings.Contains(pass, ".txt") {
passdic = strings.Split(pass, ",")
}
if user != "" && strings.Contains(user, ".txt") {
userive, err := os.Open(user)
if err != nil {
Println(fmt.Sprintf(Clearln+"[ERROR] Open %s is failed,please check your user dic path", UserDic))
return []string{}, []string{}
}
userdic = Readiness(userive)
}
if pass != "" && strings.Contains(pass, ".txt") {
passive, err := os.Open(pass)
if err != nil {
Println(fmt.Sprintf(Clearln+"[ERROR] Open %s is failed,please check your pass dic path", PassDic))
return []string{}, []string{}
}
passdic = Readiness(passive)
}
return userdic, passdic
}

16
cmd/icmp.go
View File

@@ -47,13 +47,25 @@ func execute(ips []string, r bool) []string {
var wg sync.WaitGroup
// 修改ants池的并发方式
p, _ := ants.NewPoolWithFunc(len(ips), func(ip interface{}) {
var ipt string
if r == true {
if icmp(ip.(string)) {
// 127.0.0.1:8080格式
if strings.Contains(ip.(string), ":") {
ipt = strings.Split(ip.(string), ":")[0]
} else {
ipt = ip.(string)
}
if icmp(ipt) {
Println(fmt.Sprintf("[+] Find %v (icmp)", ip))
Alive = append(Alive, ip.(string))
}
} else {
if ping(ip.(string)) {
if strings.Contains(ip.(string), ":") {
ipt = strings.Split(ip.(string), ":")[0]
} else {
ipt = ip.(string)
}
if ping(ipt) {
Println(fmt.Sprintf("[+] Find %v (ping)", ip))
Alive = append(Alive, ip.(string))
}

15
cmd/ps.go
View File

@@ -6,6 +6,8 @@ import (
"github.com/spf13/cobra"
"math"
"net"
"strconv"
"strings"
"sync"
"time"
)
@@ -74,8 +76,17 @@ func PortScan(host []string, ports []int) []PortResult {
})
})
for _, ip := range host {
wg.Add(1)
_ = p.Invoke(ip)
if strings.Contains(ip, ":") {
addr := strings.Split(ip, ":")[0]
port, _ := strconv.Atoi(strings.Split(ip, ":")[1])
if portConn(addr, port) {
Println(fmt.Sprintf("[+] %v %v open", addr, port))
tempPort = append(tempPort, PortResult{addr, []int{port}})
}
} else {
wg.Add(1)
_ = p.Invoke(ip)
}
}
wg.Wait()
return tempPort

4
cmd/vuln.go
View File

@@ -5,6 +5,7 @@ import (
"fmt"
"github.com/panjf2000/ants/v2"
"github.com/spf13/cobra"
"strings"
"sync"
)
@@ -67,6 +68,9 @@ func VulScan(ips []string, ms17010bool bool, allbool bool, smbGohstbool bool) {
})
for _, ip := range ips {
if strings.Contains(ip, ":") && !strings.Contains(ip, ":445") {
continue
}
wg.Add(1)
_ = p.Invoke(ip)
}

3
ips.txt
View File

@@ -2,3 +2,6 @@
192.168.248.219
192.168.248.212
192.168.248.128
127.0.0.1:445
127.0.0.1:5985

8
pass.txt
View File

@@ -1,4 +1,4 @@
123456
P@ssw0rd
930517
kali
123456
P@ssw0rd
930517
kali

10
user.txt
View File

@@ -1,5 +1,5 @@
administrator
Oadmin
kali
root
administrator
Oadmin
kali
root