fscan 幻境梦游记

func main() {
	start := time.Now()
	var Info common.HostInfo
	common.Flag(&Info)
	common.Parse(&Info)
	Plugins.Scan(Info)
	fmt.Printf("[*] 扫描结束,耗时: %s\n", time.Since(start))
}

func Scan(info common.HostInfo) {
	fmt.Println("start infoscan")
	Hosts, err := common.ParseIP(info.Host, common.HostFile, common.NoHosts)
	if err != nil {
		fmt.Println("len(hosts)==0", err)
		return
	}
    // ...
}

func ParseIP(host string, filename string, nohosts ...string) (hosts []string, err error) {
	if filename == "" && strings.Contains(host, ":") {
		//192.168.0.0/16:80
		hostport := strings.Split(host, ":")
		if len(hostport) == 2 {
			host = hostport[0]
			hosts = ParseIPs(host)
			Ports = hostport[1]
		}
	} else {
		hosts = ParseIPs(host)
		if filename != "" {
			var filehost []string
			filehost, _ = Readipfile(filename)
			hosts = append(hosts, filehost...)
		}
	}
    //...
}

func ParseIPs(ip string) (hosts []string) {
	if strings.Contains(ip, ",") {
		IPList := strings.Split(ip, ",")
		var ips []string
		for _, ip := range IPList {
			ips = parseIP(ip)
			hosts = append(hosts, ips...)
		}
	} else {
		hosts = parseIP(ip)
	}
	return hosts
}

func parseIP(ip string) []string {
	reg := regexp.MustCompile(`[a-zA-Z]+`)
	switch {
	case ip == "192":
		return parseIP("192.168.0.0/8")
	case ip == "172":
		return parseIP("172.16.0.0/12")
	case ip == "10":
		return parseIP("10.0.0.0/8")
	// 扫描/8时,只扫网关和随机IP,避免扫描过多IP
	case strings.HasSuffix(ip, "/8"):
		return parseIP8(ip)
    //...
    }
}

func parseIP(ip string) []string {
    // ...
	case strings.HasSuffix(ip, "/8"):
		return parseIP8(ip)
    // ...
}

func CheckLive(hostslist []string, Ping bool) []string {
	chanHosts := make(chan string, len(hostslist))
	go func() {
		for ip := range chanHosts {
			if _, ok := ExistHosts[ip]; !ok && IsContain(hostslist, ip) {
				ExistHosts[ip] = struct{}{}
    //...

func IsContain(items []string, item string) bool {
	for _, eachItem := range items {
		if eachItem == item {
			return true
		}
	}
	return false
}

func ExecCommandPing(ip string) bool {
	var command *exec.Cmd
	switch runtime.GOOS {
	case "windows":
		command = exec.Command("cmd", "/c", "ping -n 1 -w 1 "+ip+" && echo true || echo false") //ping -c 1 -i 0.5 -t 4 -W 2 -w 5 "+ip+" >/dev/null && echo true || echo false"
	case "darwin":
		command = exec.Command("/bin/bash", "-c", "ping -c 1 -W 1 "+ip+" && echo true || echo false") //ping -c 1 -i 0.5 -t 4 -W 2 -w 5 "+ip+" >/dev/null && echo true || echo false"
	default: //linux
		command = exec.Command("/bin/bash", "-c", "ping -c 1 -w 1 "+ip+" && echo true || echo false") //ping -c 1 -i 0.5 -t 4 -W 2 -w 5 "+ip+" >/dev/null && echo true || echo false"
	}
    //...
}

//接收结果
go func() {
    for found := range results {
        AliveAddress = append(AliveAddress, found)
        wg.Done()
    }
}()

//多线程扫描
for i := 0; i < workers; i++ {
    go func() {
        for addr := range Addrs {
            PortConnect(addr, results, timeout, &wg)
            wg.Done()
        }
    }()
}

//添加扫描目标
for _, port := range probePorts {
    for _, host := range hostslist {
        wg.Add(1)
        Addrs <- Addr{host, port}
    }
}
wg.Wait()

func PortConnect(addr Addr, respondingHosts chan<- string, adjustedTimeout int64, wg *sync.WaitGroup) {
	host, port := addr.ip, addr.port
	conn, err := common.WrapperTcpWithTimeout("tcp4", fmt.Sprintf("%s:%v", host, port), time.Duration(adjustedTimeout)*time.Second)
	if err == nil {
		defer conn.Close()
		address := host + ":" + strconv.Itoa(port)
		result := fmt.Sprintf("%s open", address)
		common.LogSuccess(result)
		wg.Add(1)
		respondingHosts <- address
	}
}

func SynScan(ip string, port int, timeout int64) (bool, error) {
	ifName := getInterfaceName()

	sendConn, err := net.ListenPacket("ip4:tcp", "0.0.0.0")
	if err != nil {
		return false, fmt.Errorf("发送套接字错误: %v", err)
	}
	defer sendConn.Close()

	rawConn, err := ipv4.NewRawConn(sendConn)
	if err != nil {
		return false, fmt.Errorf("原始连接错误: %v", err)
	}

	dstIP := net.ParseIP(ip)
	if dstIP == nil {
		return false, fmt.Errorf("IP地址无效: %s", ip)
	}

	handle, err := pcap.OpenLive(ifName, 65536, true, pcap.BlockForever)
	// ...
}

// 获取系统对应的接口名
func getInterfaceName() string {
	switch runtime.GOOS {
	case "windows":
		return "\\Device\\NPF_Loopback"
	case "linux":
		return "lo"
	case "darwin":
		return "lo0"
	default:
		return "lo"
	}
}

func SynScan(ip string, port int, timeout int64) (bool, error) {
	// ...
	// TCP头部设置保持不变
	tcpHeader := &ipv4.Header{
		Version:  4,
		Len:      20,
		TotalLen: 40,
		TTL:      64,
		Protocol: 6,
		Dst:      dstIP,
	}

	// SYN包构造保持不变
	synPacket := make([]byte, 20)
	binary.BigEndian.PutUint16(synPacket[0:2], uint16(srcPort))
	binary.BigEndian.PutUint16(synPacket[2:4], uint16(port))
	binary.BigEndian.PutUint32(synPacket[4:8], uint32(1))
	binary.BigEndian.PutUint32(synPacket[8:12], uint32(0))
	synPacket[12] = 0x50
	synPacket[13] = 0x02
	binary.BigEndian.PutUint16(synPacket[14:16], uint16(8192))
	binary.BigEndian.PutUint16(synPacket[16:18], uint16(0))
	binary.BigEndian.PutUint16(synPacket[18:20], uint16(0))

	checksum := calculateTCPChecksum(synPacket, tcpHeader.Src, tcpHeader.Dst)
	// ...
}

func calculateTCPChecksum(tcpHeader []byte, srcIP, dstIP net.IP) uint16 {
	// 创建伪首部
	pseudoHeader := make([]byte, 12)
	copy(pseudoHeader[0:4], srcIP.To4())
	copy(pseudoHeader[4:8], dstIP.To4())
	pseudoHeader[8] = 0
	pseudoHeader[9] = 6 // TCP协议号
	pseudoHeader[10] = byte(len(tcpHeader) >> 8)
	pseudoHeader[11] = byte(len(tcpHeader))

	// 计算校验和
	var sum uint32

	// 计算伪首部的校验和
	for i := 0; i < len(pseudoHeader)-1; i += 2 {
		sum += uint32(pseudoHeader[i])<<8 | uint32(pseudoHeader[i+1])
	}

	// 计算TCP头的校验和
	for i := 0; i < len(tcpHeader)-1; i += 2 {
		sum += uint32(tcpHeader[i])<<8 | uint32(tcpHeader[i+1])
	}

	// 如果长度为奇数，处理最后一个字节
	if len(tcpHeader)%2 == 1 {
		sum += uint32(tcpHeader[len(tcpHeader)-1]) << 8
	}

	// 将高16位加到低16位
	for sum > 0xffff {
		sum = (sum >> 16) + (sum & 0xffff)
	}

	// 取反
	return ^uint16(sum)
}

func SshScan(info *Common.HostInfo) (tmperr error) {
	// ...
	// 遍历所有用户名密码组合
	for _, user := range Common.Userdict["ssh"] {
		for _, pass := range Common.Passwords {
			tried++
			pass = strings.Replace(pass, "{user}", user, -1)
			Common.LogDebug(fmt.Sprintf("[%d/%d] 尝试: %s:%s", tried, total, user, pass))

			// 重试循环
			for retryCount := 0; retryCount < maxRetries; retryCount++ {
				if retryCount > 0 {
					Common.LogDebug(fmt.Sprintf("第%d次重试: %s:%s", retryCount+1, user, pass))
				}

				ctx, cancel := context.WithTimeout(context.Background(), time.Duration(Common.Timeout)*time.Second)
				done := make(chan struct {
					success bool
					err     error
				}, 1)

				go func(user, pass string) {
					success, err := SshConn(info, user, pass)
					select {
					case <-ctx.Done():
					case done <- struct {
						success bool
						err     error
					}{success, err}:
					}
				}(user, pass)

				var err error
				select {
				case result := <-done:
					err = result.err
					if result.success {
						successLog := fmt.Sprintf("SSH认证成功 %v:%v User:%v Pass:%v",
							info.Host, info.Ports, user, pass)
						Common.LogSuccess(successLog)
						time.Sleep(100 * time.Millisecond)
						cancel()
						return nil
					}
				case <-ctx.Done():
					err = fmt.Errorf("连接超时")
				}
				// ...
			}
		}
	}

	Common.LogDebug(fmt.Sprintf("扫描完成，共尝试 %d 个组合", tried))
	return tmperr
}

func SshConn(info *Common.HostInfo, user string, pass string) (flag bool, err error) {
	// ...
	config := &ssh.ClientConfig{
		User: user,
		Auth: auth,
		HostKeyCallback: func(hostname string, remote net.Addr, key ssh.PublicKey) error {
			return nil
		},
		Timeout: time.Duration(Common.Timeout) * time.Millisecond,
	}

	client, err := ssh.Dial("tcp", fmt.Sprintf("%v:%v", info.Host, info.Ports), config)
	if err != nil {
		return false, err
	}
	defer client.Close()
	// ...
}

flag.Int64Var(&Timeout, "time", 3, "设置连接超时时间(单位:秒)")

time.Duration(Common.Timeout) * time.Millisecond //内
time.Duration(Common.Timeout)*time.Second //外

if err != nil {
	errlog := fmt.Sprintf("SSH认证失败 %v:%v User:%v Pass:%v Err:%v",
		info.Host, info.Ports, user, pass, err)
	Common.LogError(errlog)

	if retryErr := Common.CheckErrs(err); retryErr != nil {
		if retryCount == maxRetries-1 {
			return err
		}
		continue
	}
}

// CheckErrs 检查是否为需要重试的错误
func CheckErrs(err error) error {
	if err == nil {
		return nil
	}

	// 已知需要重试的错误列表
	errs := []string{
		"closed by the remote host", "too many connections",
		"EOF", "A connection attempt failed",
		"established connection failed", "connection attempt failed",
		"Unable to read", "is not allowed to connect to this",
		"no pg_hba.conf entry",
		"No connection could be made",
		"invalid packet size",
		"bad connection",
	}

	// 检查错误是否匹配
	errLower := strings.ToLower(err.Error())
	for _, key := range errs {
		if strings.Contains(errLower, strings.ToLower(key)) {
			time.Sleep(3 * time.Second)
			return err
		}
	}

	return nil
}

if retryErr := Common.CheckErrs(err); retryErr != nil {
	if retryCount == maxRetries-1 {
		return err
	}
	continue
}

if retryErr := Common.CheckErrs(err); retryErr != nil {
	if retryCount == maxRetries-1 {
		continue
	}
	continue // 继续重试
}