dddd/gopocs/smb.go

package gopocs

import (
	"context"
	"dddd/ddout"
	"dddd/structs"
	_ "embed"
	"fmt"
	"github.com/hirochachacha/go-smb2"
	"github.com/projectdiscovery/gologger"
	"net"
	"time"
)

//go:embed dict/smb.txt
var smbUserPasswdDict string

func SmbScan(info *structs.HostInfo) (tmperr error) {
	if structs.GlobalConfig.NoServiceBruteForce {
		return
	}
	starttime := time.Now().Unix()
	gologger.AuditTimeLogger("[Go] [SMB-Brute] start try %s:%v", info.Host, info.Ports)
	defer gologger.AuditTimeLogger("[Go] [SMB-Brute] SmbScan return %s:%v", info.Host, info.Ports)

	userPasswdList := sortUserPassword(info, smbUserPasswdDict, []string{})

	for _, userPass := range userPasswdList {
		gologger.AuditTimeLogger("[Go] [SMB-Brute] start try %s %v %v", info.Host, userPass.UserName, userPass.Password)
		flag, err := doWithTimeOut(info, userPass.UserName, userPass.Password)
		if flag == true && err == nil {
			return err
		} else {
			tmperr = err
			if CheckErrs(err) {
				return err
			}
			if time.Now().Unix()-starttime > (int64(len(userPasswdList)) * 6) {
				return err
			}
		}
	}

	return tmperr
}

func SmblConn(info *structs.HostInfo, user string, pass string) (flag bool, err error) {
	flag = false

	conn, err := net.Dial("tcp", info.Host+":"+info.Ports)
	if err != nil {
		return false, err
	}
	defer conn.Close()

	d := &smb2.Dialer{
		Initiator: &smb2.NTLMInitiator{
			User:     user,
			Password: pass,
		},
	}

	s, err := d.Dial(conn)
	if err != nil {
		return false, err
	}
	defer s.Logoff()
	flag = true

	showShare := ""
	names, err := s.ListSharenames()
	if err == nil {
		for _, name := range names {
			showShare += name + "\n"
		}
	}

	var result string
	result = fmt.Sprintf("SMB://%v:%v:%v %v", info.Host, info.Ports, user, pass)
	// gologger.Silent().Msg(result)
	showData := fmt.Sprintf("Host: %v:%v\nUsername: %v\nPassword: %v\n", info.Host, info.Ports, user, pass)

	ddout.FormatOutput(ddout.OutputMessage{
		Type:     "GoPoc",
		IP:       "",
		IPs:      nil,
		Port:     "",
		Protocol: "",
		Web:      ddout.WebInfo{},
		Finger:   nil,
		Domain:   "",
		GoPoc: ddout.GoPocsResultType{PocName: "SMB-Login",
			Security:    "CRITICAL",
			Target:      info.Host + ":" + info.Ports,
			InfoLeft:    showData,
			InfoRight:   showShare,
			Description: "SMB弱口令",
			ShowMsg:     result},
		AdditionalMsg: "",
	})

	GoPocWriteResult(structs.GoPocsResultType{
		PocName:     "SMB-Login",
		Security:    "CRITICAL",
		Target:      info.Host + ":" + info.Ports,
		InfoLeft:    showData,
		InfoRight:   showShare,
		Description: "SMB弱口令",
	})

	return true, nil
}

type resType struct {
	err  error
	flag bool
}

func doWithTimeOut(info *structs.HostInfo, user string, pass string) (flag bool, err error) {
	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(7)*time.Second)
	defer cancel()

	c := make(chan resType, 1)

	go func() {

		flag, err = SmblConn(info, user, pass)
		c <- resType{
			err:  err,
			flag: flag,
		}
	}()
	select {
	case <-ctx.Done():
		res := <-c
		return false, res.err
	case res := <-c:
		return res.flag, res.err
	}
}