Skip to content

Commit b71be62

Browse files
hktalenthktalent
committed
up 2022-11-15
1 parent f80c7a6 commit b71be62

File tree

38 files changed

+840
-59
lines changed

38 files changed

+840
-59
lines changed

‎.DistributedId

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
862934f8-06a3-99a1-a162-a2cdef4dae97

‎brute/fuzzAI.go

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,19 @@ package brute
22

33
import (
44
_ "embed"
5-
"encoding/json"
65
"github.com/antlabs/strsim"
76
"github.com/hktalent/ProScan4all/lib/util"
87
"github.com/hktalent/ProScan4all/pkg"
98
"github.com/hktalent/ProScan4all/pkg/fingerprint"
9+
jsoniter "github.com/json-iterator/go"
1010
"gorm.io/gorm"
1111
"net/url"
1212
"regexp"
1313
"strings"
1414
)
1515

16+
var json = jsoniter.ConfigCompatibleWithStandardLibrary
17+
1618
// 异常页面数据库
1719
type ErrPage struct {
1820
gorm.Model

‎brute/fuzzfingerprints.go

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
package brute
22

33
import (
4-
"encoding/json"
54
"fmt"
65
"github.com/hktalent/ProScan4all/lib/util"
76
"strings"

‎config/51pwn/iiop.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
id: httpIiop_51pwn
2+
info:
3+
name: Arbitrary File Read on Skype For Business Server
4+
author:
5+
- 51pwn
6+
description: |-
7+
Arbitrary File Read on Skype For Business Server
8+
requests:
9+
- raw:
10+
- |
11+
POST /TunnelSendServlet?wl-login=true HTTP/1.1
12+
Host: {{Hostname}}
13+
14+
{{hex_decode('47494f50010200030000001700000002000000000000000b4e616d6553657276696365')}}
15+
matchers:
16+
- type: status
17+
status:
18+
- 200
19+
- type: word
20+
condition: and
21+
part: body
22+
words:
23+
- '[extensions]'
24+
matchers-condition: and
25+
redirects: false
26+

‎config/config.json

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,10 +109,12 @@
109109
"CheckWeakPassword": true,
110110
"jaelesThread": 8,
111111
"esthread": 8,
112+
"LimitTask": 4,
112113
"hydrathread": 64,
113114
"Fuzzthreads": 16,
114115
"enableFingerTitleHeaderMd5Hex": false,
115116
"Cookie": "",
117+
"DtServer":"https://127.0.0.1:8081/api/v1.0/syncResult/task/%d",
116118
"esUrl": "https://127.0.0.1:8081/%s_index/_doc/%s",
117119
"Exploit":{
118120
"Path": "./config/poc/",

‎engine/dispather.go

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -10,44 +10,44 @@ import (
1010
// 扫描任务分发
1111
// 为不同类型扫描构造参数，进行事件分发
1212
func Dispather(task *models.Target4Chan) {
13-
x1 := G_Engine.GetCaseScanFunc()
13+
x1 := GEngine.GetCaseScanFunc()
1414
x1.Range(func(k1, value any) bool {
1515
if k, ok := k1.(int64); ok {
1616
if lib.HasScanType(task.ScanType, k) {
1717
x1 := &models.EventData{EventType: k, Task: task}
1818
switch k {
1919
case ScanType_SSLInfo: // 01- SSL信息分析，并对域名信息进行收集、进入下一步流程
20-
G_Engine.EventData <- x1
20+
GEngine.EventData <- x1
2121
case ScanType_SubDomain: // 02- 子域名爆破，新域名回归 到: 1 <-- -> 2，做去重处理
22-
G_Engine.EventData <- x1
22+
GEngine.EventData <- x1
2323
case ScanType_MergeIps: // 03- 默认自动合并ip，记录ip与域名的关联关系，再发送payload时考虑：相同ip不同域名，相同payload分别发送 合并相同目标 若干域名的ip，避免扫描时重复
24-
G_Engine.EventData <- x1
24+
GEngine.EventData <- x1
2525
case ScanType_Pswd4hydra: // 04- 密码破解，隐含包含了: 端口扫描(05-masscan + 06-nmap)
26-
G_Engine.EventData <- x1
26+
GEngine.EventData <- x1
2727
case ScanType_Masscan: // 05- 合并后的ip 进行快速端口扫描; // 06、精准 端口指纹，排除masscan已经识别的几种指纹
2828
x1.EventData = []interface{}{[]interface{}{portScan.TargetStr(task.ScanWeb)}}
29-
G_Engine.EventData <- x1
29+
GEngine.EventData <- x1
3030
case ScanType_Nmap: // 05- 合并后的ip 进行快速端口扫描; // 06、精准 端口指纹，排除masscan已经识别的几种指纹
3131
x1.EventData = []interface{}{x1.Target2Ip(), []string{"0-65535"}}
32-
G_Engine.EventData <- x1
32+
GEngine.EventData <- x1
3333
case ScanType_IpInfo: // 07- 获取ip info
34-
G_Engine.EventData <- x1
34+
GEngine.EventData <- x1
3535
case ScanType_GoPoc: // 08- go-poc 检测, 隐含包含了: 端口扫描(05-masscan + 06-nmap)
36-
G_Engine.EventData <- x1
36+
GEngine.EventData <- x1
3737
case ScanType_PortsWeb: // 09- web端口识别，Naabu,识别 https，识别存活的web端口，再进入下一流程
38-
G_Engine.EventData <- x1
38+
GEngine.EventData <- x1
3939
case ScanType_WebFingerprints: // 10- web指纹，识别蜜罐，并标识
40-
G_Engine.EventData <- x1
40+
GEngine.EventData <- x1
4141
case ScanType_WebDetectWaf: // 11- detect WAF
42-
G_Engine.EventData <- x1
42+
GEngine.EventData <- x1
4343
case ScanType_WebScrapy: // 12- 爬虫分析，form表单识别，字段名识别，form action提取；
44-
G_Engine.EventData <- x1
44+
GEngine.EventData <- x1
4545
case ScanType_WebInfo: // 13- server、x-powerby、x***，url、ip、其他敏感信息（姓名、电话、地址、身份证）
46-
G_Engine.EventData <- x1
46+
GEngine.EventData <- x1
4747
case ScanType_WebVulsScan: // 14-nuclei
48-
G_Engine.EventData <- x1
48+
GEngine.EventData <- x1
4949
case ScanType_WebDirScan: // 14-dir爆破,Gobuster
50-
G_Engine.EventData <- x1
50+
GEngine.EventData <- x1
5151
default:
5252

5353
}

‎engine/engineImp.go

Lines changed: 174 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,49 @@
11
package engine
22

33
import (
4+
"bytes"
45
"context"
6+
"fmt"
57
"github.com/hktalent/51pwnPlatform/lib"
68
"github.com/hktalent/51pwnPlatform/pkg/models"
79
"github.com/hktalent/ProScan4all/lib/util"
810
"github.com/hktalent/ProScan4all/pocs_go"
911
"github.com/hktalent/jaeles/cmd"
12+
jsoniter "github.com/json-iterator/go"
1013
"github.com/panjf2000/ants/v2"
14+
"github.com/ulule/deepcopier"
15+
"io/ioutil"
1116
"log"
17+
"net"
18+
"net/url"
1219
"os"
1320
"os/signal"
21+
"strconv"
22+
"strings"
1423
"sync"
24+
"time"
1525
)
1626

27+
var json = jsoniter.ConfigCompatibleWithStandardLibrary
28+
1729
// 引擎对象，全局单实例
1830
type Engine struct {
1931
Context *context.Context // 上下文
2032
Wg *sync.WaitGroup // Wg
2133
Pool int // 线程池
2234
PoolFunc *ants.PoolWithFunc // 线程调用
2335
EventData chan *models.EventData // 数据队列
36+
NodeId string `json:"node_id"` // 分布式引擎节点的id，除非系统更换，docker重制，否则始终一致
37+
LimitTask int `json:"limit_task"` // 当前节点任务并发数的限制
38+
SyTask int `json:"sy_task"` // 剩余task
39+
DtServer string `json:"dt_server"` // 获取任务、提交任务状态的server
2440
caseScanFunc sync.Map
2541
}
2642

27-
var G_Engine *Engine
43+
var GEngine *Engine
44+
45+
// 获取分布式任务
46+
// /api/v1.0/syncResult/task/
2847

2948
// 创建引擎
3049
// 默认每个 goroutine 占用 8KB 内存
@@ -34,7 +53,17 @@ func NewEngine(c *context.Context, pool int) *Engine {
3453
if nil != util.G_Engine {
3554
return util.G_Engine.(*Engine)
3655
}
37-
x1 := &Engine{Context: c, Wg: &sync.WaitGroup{}, Pool: pool, EventData: make(chan *models.EventData, pool)}
56+
57+
x1 := &Engine{
58+
Context: c,
59+
Wg: &sync.WaitGroup{},
60+
Pool: pool,
61+
DtServer: util.GetVal("DtServer"),
62+
EventData: make(chan *models.EventData, pool),
63+
LimitTask: util.GetValAsInt("LimitTask", 4),
64+
}
65+
x1.SyTask = x1.LimitTask // 初始化剩余任务等于最大任务数
66+
x1.initNodeId()
3867
p, err := ants.NewPoolWithFunc(pool, func(i interface{}) {
3968
defer x1.Wg.Done()
4069
x1.DoEvent(i.(*models.EventData))
@@ -44,13 +73,115 @@ func NewEngine(c *context.Context, pool int) *Engine {
4473
}
4574
x1.PoolFunc = p
4675
util.G_Engine = x1
47-
G_Engine = x1
76+
GEngine = x1
4877
util.EngineFuncFactory = x1.EngineFuncFactory
4978
util.SendEvent = x1.SendEvent
5079
log.Println("Engine init ok")
5180
return x1
5281
}
5382

83+
func (e *Engine) initNodeId() {
84+
dirname, err := os.Getwd()
85+
szP := dirname + "/.DistributedId"
86+
if nil == err {
87+
if util.FileExists(szP) {
88+
data, err := ioutil.ReadFile(szP)
89+
if nil == err {
90+
e.NodeId = strings.TrimSpace(string(data))
91+
}
92+
}
93+
}
94+
if "" == e.NodeId {
95+
e.NodeId = util.GenUuid()
96+
ioutil.WriteFile(szP, []byte(e.NodeId), os.ModePerm)
97+
}
98+
}
99+
100+
// "https://dt.51pwn.com/api/v1.0/syncResult/task/%d"
101+
// curl -v -XPOST -d '{"Num":22,"task_ids":"","node_id":"xx","task_num":443}' https://127.0.0.1:8081/api/v1.0/syncResult/task/33
102+
// 结果反馈 /api/v1.0/syncResult/task/%d
103+
// 获取、确认分布式任务，Distributed Tasks
104+
func (e *Engine) GetTask(okTaskIds string) {
105+
if resp, err := util.DoPost(fmt.Sprintf(e.DtServer, e.LimitTask), map[string]string{
106+
"Content-Type": "application/json",
107+
}, strings.NewReader(`{"Num":`+strconv.Itoa(e.SyTask)+`,"task_ids":"`+okTaskIds+`","node_id":"`+e.NodeId+`","task_num":`+strconv.Itoa(e.LimitTask)+`}`)); nil == err && nil != resp {
108+
defer resp.Body.Close()
109+
var n1 = models.EventData{}
110+
if data, err := ioutil.ReadAll(resp.Body); nil == err {
111+
if err := json.Unmarshal(data, &n1); nil == err {
112+
e.SendEvent(&n1, n1.EventType)
113+
}
114+
}
115+
}
116+
}
117+
118+
// 获取公共ip
119+
func (r *Engine) GetPublicIP() ([]string, error) {
120+
ifas, err := net.Interfaces()
121+
if err != nil {
122+
return nil, err
123+
}
124+
var as []string
125+
126+
for _, ifa := range ifas {
127+
a := ifa.HardwareAddr.String()
128+
// have mac
129+
if a != "" {
130+
addrs, err := ifa.Addrs()
131+
// get Ip error
132+
if nil != err {
133+
continue
134+
}
135+
for _, addr := range addrs {
136+
switch v := addr.(type) {
137+
case *net.IPNet:
138+
if v.IP.IsPrivate() {
139+
continue
140+
}
141+
as = append(as, v.IP.String())
142+
case *net.IPAddr:
143+
if v.IP.IsPrivate() {
144+
continue
145+
}
146+
as = append(as, v.IP.String())
147+
}
148+
}
149+
}
150+
}
151+
return as, nil
152+
}
153+
func (e *Engine) generateTaskId(s string) string {
154+
return util.GetSha1(s)
155+
}
156+
157+
// 发送任务
158+
// 只发送非私有网络的任务
159+
func (e *Engine) SendTask(s string) {
160+
szUrl := fmt.Sprintf(e.DtServer, e.LimitTask)
161+
if oU, err := url.Parse(szUrl); nil == err {
162+
szUrl = strings.Join([]string{oU.Scheme, "://", oU.Host, "/api/v1.0/alipay_task"}, "")
163+
szSendData := ""
164+
sW := util.Base64Encode(s)
165+
szTaskId := e.generateTaskId(s)
166+
szSendData = "task_id=" + szTaskId + "&" + "scan_web=" + sW
167+
base64Str := util.GetSig(szSendData, prvKey)
168+
m1 := map[string]string{"task_id": szTaskId, "op": "0", "data_sign": base64Str}
169+
data, _ := json.Marshal(&m1)
170+
171+
if resp, err := util.DoPost(fmt.Sprintf(e.DtServer, e.LimitTask), map[string]string{
172+
"Content-Type": "application/json",
173+
}, bytes.NewReader(data)); nil == err && nil != resp {
174+
defer resp.Body.Close()
175+
var n1 = models.EventData{}
176+
if data, err := ioutil.ReadAll(resp.Body); nil == err {
177+
if err := json.Unmarshal(data, &n1); nil == err {
178+
e.SendEvent(&n1, n1.EventType)
179+
}
180+
}
181+
}
182+
}
183+
}
184+
54185
func (e *Engine) EngineFuncFactory(nT int64, fnCbk interface{}) {
55186
e.RegCaseScanFunc(nT, fnCbk)
56187
}
@@ -83,7 +214,7 @@ func (e *Engine) DoCase(ed *models.EventData) util.EngineFuncType {
83214
func (e *Engine) SendEvent(evt *models.EventData, argsTypes ...int64) {
84215
for _, i := range argsTypes {
85216
var n1 = models.EventData{}
86-
util.DeepCopy(evt, &n1)
217+
deepcopier.Copy(evt).To(n1)
87218
n1.EventType = i
88219
e.EventData <- &n1
89220
}
@@ -114,6 +245,9 @@ func (x1 *Engine) Running() {
114245
signal.Notify(c, os.Interrupt)
115246
//nMax := 120 // 等xxx秒都没有消息进入就退出
116247
//nCnt := 0
248+
// 每10秒获取一次任务
249+
c1Task := time.NewTicker(5 * time.Second)
250+
c2Task := time.NewTicker(15 * time.Second)
117251
for {
118252
select {
119253
case <-util.Ctx_global.Done():
@@ -146,8 +280,11 @@ func (x1 *Engine) Running() {
146280
})
147281
}(x1)
148282
}
149-
default:
283+
case <-c1Task.C:
284+
x1.GetTask("")
285+
case <-c2Task.C:
150286
util.DoDelayClear(x1.Wg) // panic: sync: WaitGroup misuse: Add called concurrently with Wait
287+
default:
151288
//util.DoSleep()
152289
}
153290
}
@@ -168,3 +305,35 @@ func init() {
168305
})
169306
})
170307
}
308+
309+
// 发送方 的签名key
310+
var prvKey = []byte(`-----BEGIN RSA PRIVATE KEY-----
311+
Proc-Type: 4,ENCRYPTED
312+
DEK-Info: DES-EDE3-CBC,0B3A74436D1F0AAE
313+
314+
hzXeizI3DX5udIFmtfBpIEbQYz4ConOmdD/Vel2ppj6EG8PLI3oirlH7eRKxsCtU
315+
khRVyYhUhb9II1jKF0tu7glnZabHnTGFAeo5nEXjTl/dp5Of6eJIaNcWlc7nXTft
316+
koodNonRFZtGe7cHI5+WM4AvjWEXztuyPKCa0Zepz7k77IdxxQ+gzIonbni0OGeh
317+
ze2kkBZMgCnS2LNqhk5zAhb0ATCTMLfd1FbsJXieXQAyCZQBER6J8hXvvZP2oZyq
318+
izou+5BsT9/W/4crq0glYSc2SMSWUFj5sSSPgVj7dV8KiRueD1ybm13B0N5XKEoY
319+
YK+IfdVBu6NspMfW8b+mp4JoAChA360d12Zyrg4J9gtOvoR4eOhtm4c0D0GPsubS
320+
XjK8Jvp41QtLRz9trNshrXI8/3z5bc26zHBLbQ6lRJSA9Q5Guc70/8FHxPOik+SZ
321+
57gMsG0OuxvUfoIif5dwwtYh5dWYktE+Ii/FnFH/X3wROiq+D4ZWI0dKNED7fFry
322+
RYmLJK+Bn7BjbzC+ZWwmKgMpmZyKF1/AB7031rB77z5Zq4Ksk+F5UEGLA4287CRT
323+
6vYY7eKpkRnZ2QHI5fdQ+fZ/A40n3NO1letf2MXB6Fxcz1P2DMYGJVVHfNSurj32
324+
F2fUckcHe9Kvy5FCXwui7aXZUkhbREAnAiKFHeRwlyjYUwxeo9QZUHt06hUKaY4c
325+
HJOLBzpjErtRfYLtGLADzaKAPe+fV+FqBWquoOG3/3aoz9oiiyxIj2a9D9ORLsy+
326+
e3QgdgiAluQ2QMqdNeYO7POWXjasaqZ8XVanSCHn3Tw5GdEq6naWz4cGxaJiXHV1
327+
PTiH2g/KEgu+L6b2xnwvEmpOKD33DEkB5xlnqUUFzAksbpL8l/sk9LPRjbjHl2Nu
328+
yL9myaJgpbPhw12Ika97VJp6ooH7Qy2WRGJ67FXGBkXXpTcItQzqqs6ZIFdwadq6
329+
Z1jNv+Wiq/o8IuVZys0a/LJlYYKrnHvKVl6LQrmcd+SWUgwbbKUBytsMDPB6OwHB
330+
Qrf3flcVIYvgqS+R1745JeFK/kxI1vtYlyNlveiAi9yRtDVnw+0DWrY03kWNsGfg
331+
9swsfO+/nHUxf81hC2g/Carrkdz7BLrsMKZnHlNVVFTNsHeELpmlGIO4VxOJzjel
332+
nuz4sITlXjBPsZernQuIbJ7GYqDv8Zb/dsW47BqIcl0PQ5FLOjJYBcIjpOnU1tLn
333+
e6pShBS4KWK/YegJdo+SxDvqLl66fdn58s1TlaZfgQic6P/mSzHgBYImb7rIlrUk
334+
aEWbEs4rAi0i8cwlg313ASK35E5enKM0C9uPaqnmFUQlT8X9SD+ELB7qHGRaXjcr
335+
rd1HBuFu2bxJm6Tcfmy4bf+6QYW5czg1mJpGjvM9zCVHDtBxVj71XvVM6MLIruYn
336+
zvNHq6ia8y1XUfkCxE5pzb0ap0LSS2XIEZxdRUCapGLAg4GNiA3Zkq4aDt8s7rGJ
337+
fARzsx7PrOF3TgCxF97GZhRU6chMK8YAChRfwqsg0Mpw2plqiYa9v99KrRwPdzJo
338+
7J8M8tAQhZB8YzG0U4Dsvb6odc8OYAFJTPpFvNjyQGgcjWudp6vo0YbK54z/z5s4
339+
-----END RSA PRIVATE KEY-----`)

0 commit comments

Comments
 (0)