Skip to content

Commit e826d1c

Browse files
hktalenthktalent
committed
fix nmap到下一流程未使用域名的bug 2022-10-15
1 parent ab54d02 commit e826d1c

File tree

11 files changed

+75
-130
lines changed

11 files changed

+75
-130
lines changed

‎brute/admin_brute.go

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,11 @@ import (
1111

1212
var SkipAdminBrute bool
1313

14-
var UserReg = regexp.MustCompile(`(?i)<input.*?name=['"]([^'"]*(name|user|uid|login|mail|log|account)[^'"]*).*?>`)
15-
var PswdReg = regexp.MustCompile(`(?i)<input.*?name=['"]([^'"]*(pass|pwd|word|mima|password|mm)[^'"]*).*?>`)
14+
var UserReg = regexp.MustCompile(`(?i)<input.*?(?:name|id)=['"]([^'"]*(?:name|user|uid|login|mail|log|account)[^'"]*).*?>`)
15+
var PswdReg = regexp.MustCompile(`(?i)<input.*?(?:name|id)=['"]([^'"]*(?:pass|pwd|word|mima|password|mm)[^'"]*).*?>`)
1616
var actionReg = regexp.MustCompile(`<form.*?action=['"](.*?)['"]`)
17+
var locationReg = regexp.MustCompile(`location.href=['"](.*?)['"]`)
18+
var r009 = regexp.MustCompile(`url.*?:.*?['"](.*?)['"],`)
1719

1820
/*
1921
loginMailbox
@@ -36,7 +38,7 @@ func getinput(inputurl string) (usernamekey string, passwordkey string, loginurl
3638
} else if u.Path == "" {
3739
loginurl = loginurl + "/login"
3840
}
39-
hreflist := regexp.MustCompile(`location.href=['"](.*?)['"]`).FindStringSubmatch(req.Body)
41+
hreflist := locationReg.FindStringSubmatch(req.Body)
4042
if hreflist != nil {
4143
href, _ := url.Parse(strings.TrimSpace(hreflist[len(hreflist)-1:][0]))
4244
hrefurl := u.ResolveReference(href)
@@ -46,7 +48,7 @@ func getinput(inputurl string) (usernamekey string, passwordkey string, loginurl
4648
}
4749
}
4850
usernamelist := UserReg.FindStringSubmatch(req.Body)
49-
if usernamelist != nil {
51+
if usernamelist != nil && 2 <= len(usernamelist) {
5052
usernamekey = usernamelist[len(usernamelist)-1:][0]
5153
}
5254
passlist := PswdReg.FindStringSubmatch(req.Body)
@@ -59,11 +61,14 @@ func getinput(inputurl string) (usernamekey string, passwordkey string, loginurl
5961
loginurl = u.ResolveReference(action).String()
6062
}
6163
} else {
62-
domainlist2 := regexp.MustCompile(`url.*?:.*?['"](.*?)['"],`).FindStringSubmatch(req.Body)
64+
domainlist2 := r009.FindStringSubmatch(req.Body)
6365
if domainlist2 != nil {
6466
if ajax, err := url.Parse(strings.TrimSpace(domainlist2[len(domainlist2)-1:][0])); err == nil {
6567
loginurl = u.ResolveReference(ajax).String()
6668
}
69+
} else if strings.HasSuffix(inputurl, ".jsp") || strings.HasSuffix(inputurl, ".do") {
70+
u01, _ := url.Parse("/login.do")
71+
loginurl = u.ResolveReference(u01).String()
6772
}
6873
}
6974
}
@@ -74,6 +79,9 @@ var LocationReg = regexp.MustCompile(`(.*?);`)
7479

7580
// 登陆页面密码爆破
7681
func Admin_brute(u string) (username string, password string, loginurl string) {
82+
if util.TestRepeat(u) {
83+
return
84+
}
7785
if SkipAdminBrute {
7886
return "", "", ""
7987
}
@@ -85,7 +93,7 @@ func Admin_brute(u string) (username string, password string, loginurl string) {
8593
testaccount = true
8694
usernames []string
8795
noaccount = []string{"不存在", "用户名错误", "\\u4e0d\\u5b58\\u5728", "\\u7528\\u6237\\u540d\\u9519\\u8bef"}
88-
lockContent = []string{"锁定", "次数超", "超次数", "验证码错误", "请输入验证码", "请输入正确的验证码", "验证码不能为空", "\\u9501\\u5b9a", "\\u6b21\\u6570\\u8d85", "\\u8d85\\u6b21\\u6570", "\\u9a8c\\u8bc1\\u7801\\u9519\\u8bef", "\\u8bf7\\u8f93\\u5165\\u9a8c\\u8bc1\\u7801", "\\u8bf7\\u8f93\\u5165\\u6b63\\u786e\\u7684\\u9a8c\\u8bc1\\u7801", "\\u9a8c\\u8bc1\\u7801\\u4e0d\\u80fd\\u4e3a\\u7a7a"}
96+
lockContent = []string{"认证失败", "账号或密码错误", "锁定", "次数超", "超次数", "验证码错误", "请输入验证码", "请输入正确的验证码", "验证码不能为空", "\\u9501\\u5b9a", "\\u6b21\\u6570\\u8d85", "\\u8d85\\u6b21\\u6570", "\\u9a8c\\u8bc1\\u7801\\u9519\\u8bef", "\\u8bf7\\u8f93\\u5165\\u9a8c\\u8bc1\\u7801", "\\u8bf7\\u8f93\\u5165\\u6b63\\u786e\\u7684\\u9a8c\\u8bc1\\u7801", "\\u9a8c\\u8bc1\\u7801\\u4e0d\\u80fd\\u4e3a\\u7a7a"}
8997
adminfalseContentlen int
9098
testfalseContentlen int
9199
falseis302 = false

‎brute/dicts/filedic.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
1+
/Login.jsp
2+
/login.jsp
13
.*org/login
2-
../../../../../../../../../../../../../../../../../../usr/local/cpanel/logs/login_log
34
../../../../../../../../../../../../../../../../../../usr/local/cpanel/logs/login_log%00
5+
../../../../../../../../../../../../../../../../../../usr/local/cpanel/logs/login_log
46
../../../../../../../../../../../../../../../../../usr/local/cpanel/logs/login_log
57
../../../../../../../../../../../../../../../../../usr/local/cpanel/logs/login_log%00
68
../../../../../../../../../../../../../../../../usr/local/cpanel/logs/login_log
@@ -63,7 +65,6 @@
6365
/CFIDE/componentutils/login.cfm?_cf_containerID=blahblah'
6466
/Citrix/AccessPlatform/auth/clientscripts/login.js
6567
/Login.aspx
66-
/Login.jsp
6768
/Umbraco/Views/common/login.html
6869
/Umbraco/assets/img/login.jpg
6970
/_layouts/login.aspx
@@ -156,7 +157,6 @@
156157
/login.cfm
157158
/login.do
158159
/login.html
159-
/login.jsp
160160
/login.php
161161
/login.php3
162162
/login.php4

‎brute/fuzzfingerprints.go

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,16 @@ func Addfingerprints404(technologies []string, req *util.Response, oPage *util.P
5050
return technologies
5151
}
5252

53-
// 正常页面指纹处理
5453
func Addfingerprintsnormal(payload string, technologies []string, req *util.Response, fuzzPage *util.Page) []string {
54+
a := Addfingerprintsnormal1(payload, []string{}, req, fuzzPage)
55+
if 0 < len(a) {
56+
util.PocCheck_pipe <- &util.PocCheck{Wappalyzertechnologies: &a, URL: req.RequestUrl, FinalURL: req.RequestUrl, Checklog4j: false}
57+
}
58+
return append(technologies, a...)
59+
}
60+
61+
// 正常页面指纹处理
62+
func Addfingerprintsnormal1(payload string, technologies []string, req *util.Response, fuzzPage *util.Page) []string {
5563
// StatusCode 200, 301, 302, 401, 500
5664
switch payload {
5765
case "/manager/html":
@@ -74,9 +82,9 @@ func Addfingerprintsnormal(payload string, technologies []string, req *util.Resp
7482
if util.StrContains(req.Body, "/seeyon/common/") {
7583
technologies = append(technologies, "seeyon")
7684
}
77-
case "/admin", "/admin-console", "/admin.asp", "/admin.aspx", "/admin.do", "/admin.html", "/admin.jsp", "/admin.php", "/admin/", "/admin/admin", "/admin/adminLogin.do", "/admin/checkLogin.do", "/admin/index.do", "/Admin/Login", "/admin/Login.aspx", "/admin/login.do", "/admin/menu", "/Adminer", "/adminer.php", "/administrator", "/adminLogin.do", "/checkLogin.do", "/doc/Page/login.asp", "/login", "/Login.aspx", "/login/login", "/login/Login.jsp", "/manage", "/manage/login.htm", "/management", "/manager", "/manager.aspx", "/manager.do", "/manager.jsp", "/manager.jspx", "/manager.php", "/memadmin/index.php", "/myadmin/login.php", "/Systems/", "/user-login.html", "/wp-login.php":
85+
case "/admin", "/admin-console", "/admin.asp", "/admin.aspx", "/admin.do", "/admin.html", "/admin.jsp", "/admin.php", "/admin/", "/admin/admin", "/admin/adminLogin.do", "/admin/checkLogin.do", "/admin/index.do", "/Admin/Login", "/admin/Login.aspx", "/admin/login.do", "/admin/menu", "/Adminer", "/adminer.php", "/administrator", "/adminLogin.do", "/checkLogin.do", "/doc/Page/login.asp", "/login", "/Login.aspx", "/login/login", "/login/Login.jsp", "/Login.jsp", "/manage", "/manage/login.htm", "/management", "/manager", "/manager.aspx", "/manager.do", "/manager.jsp", "/manager.jspx", "/manager.php", "/memadmin/index.php", "/myadmin/login.php", "/Systems/", "/user-login.html", "/wp-login.php":
7886
if reqlogin, err := util.HttpRequset(req.RequestUrl, "GET", "", true, nil); err == nil {
79-
if util.StrContains(reqlogin.Body, "<input") && (util.StrContains(reqlogin.Body, "pass") || strings.Contains(reqlogin.Body, "Pass") || strings.Contains(reqlogin.Body, "PASS")) {
87+
if util.StrContains(reqlogin.Body, "<input") && (util.StrContains(reqlogin.Body, "pass") || util.StrContains(reqlogin.Body, "type=\"password\"") || strings.Contains(reqlogin.Body, "Pass") || strings.Contains(reqlogin.Body, "PASS")) {
8088
technologies = append(technologies, "AdminLoginPage")
8189
username, password, loginurl := Admin_brute(req.RequestUrl)
8290
if loginurl != "" {

‎config/51pwn_poc/CVE-2022-35914.yaml

Lines changed: 0 additions & 78 deletions
This file was deleted.

‎config/config.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@
105105
"MaxRedirects": 3
106106
},
107107
"enableEsSv": true,
108-
"CheckWeakPassword": false,
108+
"CheckWeakPassword": true,
109109
"esthread": 8,
110110
"hydrathread": 64,
111111
"Fuzzthreads": 16,
@@ -116,5 +116,5 @@
116116
"Path": "./config/poc/",
117117
"Logs": "./logs/errror.log"
118118
},
119-
"enableWebScan": false
119+
"enableWebScan": true
120120
}

‎main.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ import (
88
"log"
99
"net/http"
1010
_ "net/http/pprof"
11-
"os"
1211
"runtime"
1312
"runtime/debug"
1413
)
@@ -26,7 +25,7 @@ func main() {
2625
//os.Args = []string{"", "-host", "http://127.0.0.1", "-v"}
2726
//os.Args = []string{"", "-host", "https://www.sina.com.cn/", "-v", "-o", "xxx.csv"}
2827
//os.Args = []string{"", "-list", "list.txt", "-v"}
29-
os.Args = []string{"", "-list", "./5701580f708064a329d2c2bca41727b4c13a3126.xml", "-v"}
28+
//os.Args = []string{"", "-list", "./5701580f708064a329d2c2bca41727b4c13a3126.xml", "-v"}
3029

3130
runtime.GOMAXPROCS(runtime.NumCPU())
3231
util.DoInit(&config)

‎pkg/httpx/runner/runner.go

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1280,7 +1280,7 @@ retry:
12801280
}
12811281
// 登陆页面检测
12821282
if brute.CheckLoginPage(finalURL, resp) {
1283-
technologies = append(technologies, "loginpage")
1283+
technologies = append(technologies, "登陆页面")
12841284
// 做一次 http
12851285
util.PocCheck_pipe <- &util.PocCheck{
12861286
Wappalyzertechnologies: &[]string{"httpCheckSmuggling"},
@@ -1339,16 +1339,18 @@ retry:
13391339
filefuzzTechnologies = SliceRemoveDuplicates(filefuzzTechnologies)
13401340
// 取差集合
13411341
filefuzzTechnologies = difference(filefuzzTechnologies, technologies)
1342-
poctechnologies2 = pocs_go.POCcheck(filefuzzTechnologies, ul, finalURL, true) //通过敏感文件扫描获取到的指纹进行检测gopoc check
1343-
Vullist = append(Vullist, poctechnologies2...)
1344-
for _, technology := range filefuzzTechnologies {
1345-
pocYmlList2 := pocs_yml.Check(ul, scanopts.CeyeApi, scanopts.CeyeDomain, r.options.HTTPProxy, strings.ToLower(technology)) //通过敏感文件扫描获取到的指纹进行检测ymlpoc check
1346-
Vullist = append(Vullist, pocYmlList2...)
1342+
if 0 < len(filefuzzTechnologies) {
1343+
poctechnologies2 = pocs_go.POCcheck(filefuzzTechnologies, ul, finalURL, true) //通过敏感文件扫描获取到的指纹进行检测gopoc check
1344+
Vullist = append(Vullist, poctechnologies2...)
1345+
for _, technology := range filefuzzTechnologies {
1346+
pocYmlList2 := pocs_yml.Check(ul, scanopts.CeyeApi, scanopts.CeyeDomain, r.options.HTTPProxy, strings.ToLower(technology)) //通过敏感文件扫描获取到的指纹进行检测ymlpoc check
1347+
Vullist = append(Vullist, pocYmlList2...)
1348+
}
1349+
// 输出加入敏感文件扫描 获取到的指纹
1350+
technologies = append(technologies, filefuzzTechnologies...)
1351+
// 指纹去重
1352+
technologies = SliceRemoveDuplicates(technologies)
13471353
}
1348-
// 输出加入敏感文件扫描 获取到的指纹
1349-
technologies = append(technologies, filefuzzTechnologies...)
1350-
// 指纹去重
1351-
technologies = SliceRemoveDuplicates(technologies)
13521354
}
13531355
if len(technologies) > 0 {
13541356
sort.Strings(technologies)

‎pkg/naabu/v2/pkg/runner/targets.go

Lines changed: 24 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,26 @@ func (r *Runner) DoSsl(target string) []string {
121121
return []string{}
122122
}
123123

124+
func (r *Runner) DoDns001(x string, aR []string) []string {
125+
aR = append(aR, r.DoDns2Ips(x)...)
126+
a1 := r.DoSsl(x)
127+
if 1 < len(a1) { // 如果只有1个是没有意义的，说明和x一样
128+
for _, j := range a1 {
129+
if j == x {
130+
continue
131+
}
132+
aR = append(aR, r.DoDns2Ips(j)...)
133+
}
134+
aR = append(aR, a1...)
135+
}
136+
if 1 == len(aR) { // 只有一个就直接用域名了，这样nmap的结果才能用
137+
aR = []string{x}
138+
} else {
139+
aR = append(aR, x)
140+
}
141+
return aR
142+
}
143+
124144
// target域名转多个ip处理
125145
func (r *Runner) DoTargets() (bool, error) {
126146
data, err := ioutil.ReadFile(r.targetsFile)
@@ -134,18 +154,12 @@ func (r *Runner) DoTargets() (bool, error) {
134154
if 3 > len(x) {
135155
continue
136156
}
137-
if govalidator.IsURL(x) {
157+
if govalidator.IsDNSName(x) {
158+
aR = r.DoDns001(x, aR)
159+
} else if govalidator.IsURL(x) {
138160
if x1, err := url.Parse(strings.TrimSpace(x)); nil == err {
139161
if govalidator.IsDNSName(x) {
140-
aR = append(aR, r.DoDns2Ips(x)...)
141-
a1 := r.DoSsl(x)
142-
if 0 < len(a1) {
143-
for _, j := range a1 {
144-
aR = append(aR, r.DoDns2Ips(j)...)
145-
}
146-
aR = append(aR, a1...)
147-
continue
148-
}
162+
aR = r.DoDns001(x, aR)
149163
} else {
150164
if "" == x1.Hostname() {
151165
aR = append(aR, x)
@@ -154,17 +168,6 @@ func (r *Runner) DoTargets() (bool, error) {
154168
}
155169
continue
156170
}
157-
} else {
158-
aR = append(aR, x)
159-
}
160-
} else if govalidator.IsDNSName(x) {
161-
aR = append(aR, r.DoDns2Ips(x)...)
162-
a1 := r.DoSsl(x)
163-
if 0 < len(a1) {
164-
for _, j := range a1 {
165-
aR = append(aR, r.DoDns2Ips(j)...)
166-
}
167-
aR = append(aR, a1...)
168171
}
169172
}
170173
aR = append(aR, x)

‎pocs_go/go_poc_check.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -243,7 +243,7 @@ func POCcheck(wappalyzertechnologies []string, URL string, finalURL string, chec
243243
if seeyon.BackdoorScan(URL) {
244244
technologies = append(technologies, "exp-seeyon|Backdoor")
245245
}
246-
case "loginpage":
246+
case "loginpage", "登陆页面", "AdminLoginPage":
247247
username, password, loginurl := brute.Admin_brute(finalURL)
248248
if loginurl != "" {
249249
technologies = append(technologies, fmt.Sprintf("brute-admin|%s:%s", username, password))

‎projectdiscovery/nuclei_Yaml/nuclei_yaml.go

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -425,12 +425,12 @@ func readConfig(options *types.Options) {
425425

426426
options.UpdateNuclei = false
427427
options.UpdateTemplates = false
428-
// options.TemplatesDirectory = pwd + "/config/nuclei-templates"
429-
options.TemplatesDirectory = pwd + "/config"
428+
options.TemplatesDirectory = pwd + "/config/nuclei-templates"
429+
//options.TemplatesDirectory = pwd + "/config"
430430
// 嵌入式集成私人版本nuclei-templates 共3744个YAML POC
431431
if util.GetValAsBool("enableEmbedYaml") {
432-
// options.Templates = []string{pwd + "/config/nuclei-templates"}
433-
options.Templates = []string{pwd + "/config"}
432+
options.Templates = []string{pwd + "/config/nuclei-templates"}
433+
//options.Templates = []string{pwd + "/config"}
434434
options.NoUpdateTemplates = true
435435
} else {
436436
options.NoUpdateTemplates = false

‎webScan/Functions/HttpClient.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,9 @@ func Client(method string, url string, body io.Reader, Headers map[string]string
2727
}
2828
muxs.Unlock()
2929
client := util.GetClient(url)
30+
if nil == client.Client {
31+
client.Client = client.GetClient(nil)
32+
}
3033

3134
if redirects == "true" {
3235
client.Client.CheckRedirect = nil

0 commit comments

Comments
 (0)