feat: 增加SNMP扫描 增加UDP端口扫描

Common/Config.go

@@ -51,6 +51,7 @@ var (
 	ScanMode    string // 原Scantype
 	ThreadNum   int    // 原Threads
 	UseSynScan  bool
+	UseUdpScan  bool
 	Timeout     int64 = 3
 	LiveTop     int
 	DisablePing bool // 原NoPing

Common/Flag.go

@@ -72,6 +72,7 @@ func Flag(Info *HostInfo) {
 		"  漏洞类: ms17010, smbghost, smb2\n"+
 		"  其他: findnet, wmiexec, localinfo")
 	flag.BoolVar(&UseSynScan, "sS", false, "使用SYN扫描替代TCP全连接扫描(需要root/管理员权限)")
+	flag.BoolVar(&UseUdpScan, "sU", false, "使用UDP扫描(部分端口自动使用UDP协议)")
 	flag.IntVar(&ThreadNum, "t", 600, "设置扫描线程数")
 	flag.Int64Var(&Timeout, "time", 3, "设置连接超时时间(单位:秒)")
 	flag.IntVar(&LiveTop, "top", 10, "仅显示指定数量的存活主机")

Common/ParseScanMode.go

@@ -21,7 +21,7 @@ var pluginGroups = map[string][]string{
 		"web", "fcgi", // web类
 		"mysql", "mssql", "redis", "mongodb", "postgres", // 数据库类
 		"oracle", "memcached", "elasticsearch", "rabbitmq", "kafka", "activemq", // 数据库类
-		"ftp", "ssh", "telnet", "smb", "rdp", "vnc", "netbios", "ldap", "smtp", "imap", "pop3", // 服务类
+		"ftp", "ssh", "telnet", "smb", "rdp", "vnc", "netbios", "ldap", "smtp", "imap", "pop3", "snmp", // 服务类
 		"ms17010", "smbghost", "smb2", // 漏洞类
 		"findnet", // 其他
 	},
@@ -36,7 +36,7 @@ var pluginGroups = map[string][]string{
 		"web", "fcgi",
 	},
 	ModeService: {
-		"ftp", "ssh", "telnet", "smb", "rdp", "vnc", "netbios", "ldap", "smtp", "imap", "pop3",
+		"ftp", "ssh", "telnet", "smb", "rdp", "vnc", "netbios", "ldap", "smtp", "imap", "pop3", "snmp",
 	},
 	ModeVul: {
 		"ms17010", "smbghost", "smb2",

Common/Ports.go

@@ -5,11 +5,11 @@ import (
 	"strings"
 )
 
-var ServicePorts = "21,22,23,25,110,135,139,143,389,445,465,587,636,993,995,1433,1521,2222,3306,3389,5432,5672,5671,6379,8161,9000,9092,9093,9200,11211,15672,15671,27017,61616,61613"
+var ServicePorts = "21,22,23,25,110,135,139,143,161,162,389,445,465,587,636,993,995,1433,1521,2222,3306,3389,5432,5672,5671,6379,8161,9000,9092,9093,9200,11211,15672,15671,27017,61616,61613"
 var DbPorts = "1433,1521,3306,5432,5672,6379,9093,9200,11211,27017,61616"
 var WebPorts = "80,81,82,83,84,85,86,87,88,89,90,91,92,98,99,443,800,801,808,880,888,889,1000,1010,1080,1081,1082,1099,1118,1888,2008,2020,2100,2375,2379,3000,3008,3128,3505,5555,6080,6648,6868,7000,7001,7002,7003,7004,7005,7007,7008,7070,7071,7074,7078,7080,7088,7200,7680,7687,7688,7777,7890,8000,8001,8002,8003,8004,8006,8008,8009,8010,8011,8012,8016,8018,8020,8028,8030,8038,8042,8044,8046,8048,8053,8060,8069,8070,8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8091,8092,8093,8094,8095,8096,8097,8098,8099,8100,8101,8108,8118,8161,8172,8180,8181,8200,8222,8244,8258,8280,8288,8300,8360,8443,8448,8484,8800,8834,8838,8848,8858,8868,8879,8880,8881,8888,8899,8983,8989,9000,9001,9002,9008,9010,9043,9060,9080,9081,9082,9083,9084,9085,9086,9087,9088,9089,9090,9091,9092,9093,9094,9095,9096,9097,9098,9099,9100,9200,9443,9448,9800,9981,9986,9988,9998,9999,10000,10001,10002,10004,10008,10010,10250,12018,12443,14000,15672,15671,16080,18000,18001,18002,18004,18008,18080,18082,18088,18090,18098,19001,20000,20720,21000,21501,21502,28018,20880"
 var AllPorts = "1-65535"
-var MainPorts = "21,22,23,80,81,110,135,143,139,389,443,445,993,995,1433,1521,3306,5432,5672,6379,7001,8000,8080,8089,9000,9200,9092,11211,15672,27017,61616"
+var MainPorts = "21,22,23,80,81,110,135,139,143,161,389,443,445,993,995,1433,1521,3306,5432,5672,6379,7001,8000,8080,8089,9000,9200,9092,11211,15672,27017,61616"
 
 func ParsePortsFromString(portsStr string) []int {
 	var ports []int

Core/PortScan.go

@@ -84,14 +84,19 @@ func PortScan(hostslist []string, ports string, timeout int64) []string {
 }
 
 func PortConnect(addr Addr, respondingHosts chan<- string, timeout int64, wg *sync.WaitGroup) {
-	defer wg.Done() // 保留 defer wg.Done()
+	defer wg.Done()
 
 	var isOpen bool
 	var err error
 
-	if Common.UseSynScan {
+	if Common.UseUdpScan {
+		// UDP扫描
+		isOpen, err = UDPScan(addr.ip, addr.port, timeout)
+	} else if Common.UseSynScan {
+		// SYN扫描
 		isOpen, err = SynScan(addr.ip, addr.port, timeout)
 	} else {
+		// 标准TCP扫描
 		conn, err := Common.WrapperTcpWithTimeout("tcp4",
 			fmt.Sprintf("%s:%v", addr.ip, addr.port),
 			time.Duration(timeout)*time.Second)
@@ -107,7 +112,11 @@ func PortConnect(addr Addr, respondingHosts chan<- string, timeout int64, wg *sy
 
 	// 记录开放端口
 	address := fmt.Sprintf("%s:%d", addr.ip, addr.port)
-	result := fmt.Sprintf("[+] 端口开放 %s", address)
+	protocol := "TCP"
+	if Common.UseUdpScan {
+		protocol = "UDP"
+	}
+	result := fmt.Sprintf("[+] %s端口开放 %s", protocol, address)
 	Common.LogSuccess(result)
 
 	respondingHosts <- address
@@ -306,6 +315,47 @@ func calculateTCPChecksum(tcpHeader []byte, srcIP, dstIP net.IP) uint16 {
 	return ^uint16(sum)
 }
 
+func UDPScan(ip string, port int, timeout int64) (bool, error) {
+	// 创建UDP套接字
+	sendConn, err := net.ListenPacket("udp4", "0.0.0.0:0")
+	if err != nil {
+		return false, fmt.Errorf("创建UDP套接字失败: %v", err)
+	}
+	defer sendConn.Close()
+
+	// 设置目标地址
+	dstAddr := &net.UDPAddr{
+		IP:   net.ParseIP(ip),
+		Port: port,
+	}
+
+	// 发送空包
+	_, err = sendConn.WriteTo([]byte{0x00}, dstAddr)
+	if err != nil {
+		return false, fmt.Errorf("发送UDP包失败: %v", err)
+	}
+
+	// 设置读取超时
+	sendConn.SetReadDeadline(time.Now().Add(time.Duration(timeout) * time.Second))
+
+	// 尝试读取响应
+	buffer := make([]byte, 65507) // UDP最大包大小
+	n, _, err := sendConn.ReadFrom(buffer)
+
+	// 如果收到ICMP不可达，说明端口关闭
+	if err != nil {
+		if netErr, ok := err.(net.Error); ok && netErr.Timeout() {
+			// 超时可能意味着端口开放但没有响应
+			return true, nil
+		}
+		// 其他错误说明端口可能关闭
+		return false, nil
+	}
+
+	// 收到响应说明端口开放
+	return n > 0, nil
+}
+
 // 获取系统对应的接口名
 func getInterfaceName() string {
 	switch runtime.GOOS {

Core/Registry.go

@@ -109,6 +109,12 @@ func init() {
 		ScanFunc: Plugins.POP3Scan,
 	})
 
+	Common.RegisterPlugin("snmp", Common.ScanPlugin{
+		Name:     "SNMP",
+		Ports:    []int{161, 162}, // SNMP默认端口
+		ScanFunc: Plugins.SNMPScan,
+	})
+
 	Common.RegisterPlugin("rdp", Common.ScanPlugin{
 		Name:     "RDP",
 		Ports:    []int{3389},

Plugins/SNMP.go

@@ -0,0 +1,90 @@
+package Plugins
+
+import (
+	"fmt"
+	"github.com/gosnmp/gosnmp"
+	"github.com/shadow1ng/fscan/Common"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// SNMPScan 执行SNMP服务扫描
+// SNMPScan 执行SNMP服务扫描
+func SNMPScan(info *Common.HostInfo) (tmperr error) {
+	if Common.DisableBrute {
+		return
+	}
+
+	starttime := time.Now().Unix()
+	portNum, _ := strconv.Atoi(info.Ports) // 添加端口转换
+
+	// 首先尝试默认community strings
+	defaultCommunities := []string{"public", "private", "cisco", "community"}
+
+	for _, community := range defaultCommunities {
+		flag, err := SNMPConnect(info, community, portNum) // 传入转换后的端口
+		if flag && err == nil {
+			return err
+		}
+
+		if Common.CheckErrs(err) {
+			return err
+		}
+
+		errlog := fmt.Sprintf("[-] SNMP服务 %v:%v 尝试失败 community: %v 错误: %v",
+			info.Host, info.Ports, community, err)
+		Common.LogError(errlog)
+		tmperr = err
+
+		// 修正超时计算
+		timeout := time.Duration(Common.Timeout) * time.Second
+		if time.Now().Unix()-starttime > int64(timeout.Seconds())*int64(len(defaultCommunities)) {
+			return err
+		}
+	}
+
+	return tmperr
+}
+
+// SNMPConnect 尝试SNMP连接
+func SNMPConnect(info *Common.HostInfo, community string, portNum int) (bool, error) {
+	host := info.Host
+	timeout := time.Duration(Common.Timeout) * time.Second
+
+	snmp := &gosnmp.GoSNMP{
+		Target:    host,
+		Port:      uint16(portNum),
+		Community: community,
+		Version:   gosnmp.Version2c,
+		Timeout:   timeout,
+		Retries:   1,
+	}
+
+	err := snmp.Connect()
+	if err != nil {
+		return false, err
+	}
+	defer snmp.Conn.Close()
+
+	oids := []string{"1.3.6.1.2.1.1.1.0"}
+	result, err := snmp.Get(oids)
+	if err != nil {
+		return false, err
+	}
+
+	if len(result.Variables) > 0 {
+		success := fmt.Sprintf("[+] SNMP服务 %v:%v community: %v",
+			host, portNum, community) // 使用portNum替换port
+
+		if result.Variables[0].Type != gosnmp.NoSuchObject {
+			sysDesc := strings.TrimSpace(string(result.Variables[0].Value.([]byte)))
+			success += fmt.Sprintf(" System: %v", sysDesc)
+		}
+
+		Common.LogSuccess(success)
+		return true, nil
+	}
+
+	return false, fmt.Errorf("认证失败")
+}

go.mod

@@ -46,6 +46,7 @@ require (
 	github.com/golang-sql/sqlexp v0.1.0 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/uuid v1.6.0 // indirect
+	github.com/gosnmp/gosnmp v1.38.0 // indirect
 	github.com/hashicorp/errwrap v1.0.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect

go.sum

@@ -129,6 +129,8 @@ github.com/gopherjs/gopherjs v0.0.0-20210621113107-84c6004145de/go.mod h1:MtKwTf
 github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
 github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
 github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/gosnmp/gosnmp v1.38.0 h1:I5ZOMR8kb0DXAFg/88ACurnuwGwYkXWq3eLpJPHMEYc=
+github.com/gosnmp/gosnmp v1.38.0/go.mod h1:FE+PEZvKrFz9afP9ii1W3cprXuVZ17ypCcyyfYuu5LY=
 github.com/goxjs/gl v0.0.0-20210104184919-e3fafc6f8f2a/go.mod h1:dy/f2gjY09hwVfIyATps4G2ai7/hLwLkc5TrPqONuXY=
 github.com/goxjs/glfw v0.0.0-20191126052801-d2efb5f20838/go.mod h1:oS8P8gVOT4ywTcjV6wZlOU4GuVFQ8F5328KY3MJ79CY=
 github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=