|
| 1 | +#coding:utf-8 |
| 2 | +#author:wolf@future-sec |
| 3 | + |
| 4 | +import getopt |
| 5 | +import sys |
| 6 | +import Queue |
| 7 | +import threading |
| 8 | +import socket |
| 9 | +import urllib2 |
| 10 | +import time |
| 11 | +import os |
| 12 | + |
| 13 | +queue = Queue.Queue() |
| 14 | +sys.path.append("plugins") |
| 15 | +mutex = threading.Lock() |
| 16 | +timeout = 10 |
| 17 | +class ThreadNum(threading.Thread): |
| 18 | + def __init__(self,queue): |
| 19 | + threading.Thread.__init__(self) |
| 20 | + self.queue = queue |
| 21 | + def run(self): |
| 22 | + while True: |
| 23 | + queue_task = self.queue.get() |
| 24 | + task_type,task_host,task_port = queue_task.split(":") |
| 25 | + if task_type == 'portscan': |
| 26 | + port_status = scan_port(task_type,task_host,task_port) |
| 27 | + if port_status == True: |
| 28 | + queue.put(":".join(['discern',task_host,task_port])) |
| 29 | + elif task_type == 'discern': |
| 30 | + discern_type = scan_discern(task_type,task_host,task_port) |
| 31 | + if discern_type: |
| 32 | + queue.put(":".join([discern_type,task_host,task_port])) |
| 33 | + else: |
| 34 | + scan_vul(task_type,task_host,task_port) |
| 35 | + self.queue.task_done() |
| 36 | +def scan_port(task_type,host,port): |
| 37 | + try: |
| 38 | + socket.setdefaulttimeout(timeout/2) |
| 39 | + sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) |
| 40 | + sock.connect((str(host),int(port))) |
| 41 | + log(task_type,host,port) |
| 42 | + sock.close() |
| 43 | + return True |
| 44 | + except: |
| 45 | + return False |
| 46 | +def log(scan_type,host,port,info=''): |
| 47 | + mutex.acquire() |
| 48 | + time_str = time.strftime('%X', time.localtime( time.time())) |
| 49 | + if scan_type == 'portscan': |
| 50 | + print "[%s] %s:%d open"%(time_str,host,int(port)) |
| 51 | + elif scan_type == 'discern': |
| 52 | + print "[%s] http://%s:%d is %s"%(time_str,host,int(port),info) |
| 53 | + else: |
| 54 | + if info: |
| 55 | + print "[*%s] %s"%(time_str,info) |
| 56 | + log_file = open('result.log','a') |
| 57 | + log_file.write("[*%s] %s\r\n"%(time_str,info)) |
| 58 | + log_file.close() |
| 59 | + else: |
| 60 | + print "[%s] http://%s:%s call plugin %s"%(time_str,host,port,scan_type) |
| 61 | + mutex.release() |
| 62 | +def read_config(config_type): |
| 63 | + if config_type == 'discern': |
| 64 | + mark_list=[] |
| 65 | + config_file = open('discern_config.ini','r') |
| 66 | + for mark in config_file: |
| 67 | + name,location,key,value = mark.strip().split("|") |
| 68 | + mark_list.append([name,location,key,value]) |
| 69 | + config_file.close() |
| 70 | + return mark_list |
| 71 | + elif config_type == 'plugin': |
| 72 | + plugin_list = {} |
| 73 | + config_file = open('plugin_config.ini','r') |
| 74 | + for plugin in config_file: |
| 75 | + name,plugin_file_list = plugin.strip().split("|") |
| 76 | + plugin_list[name]=[] |
| 77 | + plugin_list[name] = plugin_file_list.split(",") |
| 78 | + config_file.close() |
| 79 | + return plugin_list |
| 80 | + |
| 81 | +def scan_discern(scan_type,host,port): |
| 82 | + mark_list = read_config('discern') |
| 83 | + for mark_info in mark_list: |
| 84 | + if mark_info[1] == 'header': |
| 85 | + try: |
| 86 | + header = urllib2.urlopen("http://%s:%d"%(host,int(port)),timeout=timeout).headers |
| 87 | + except urllib2.HTTPError,e: |
| 88 | + header = e.headers |
| 89 | + except Exception,e: |
| 90 | + return False |
| 91 | + try: |
| 92 | + if mark_info[3].lower() in header[mark_info[2]].lower(): |
| 93 | + log(scan_type,host,port,mark_info[0]) |
| 94 | + return mark_info[0] |
| 95 | + except Exception,e: |
| 96 | + continue |
| 97 | + elif mark_info[1] == 'file': |
| 98 | + try: |
| 99 | + re_html = urllib2.urlopen("http://%s:%d/%s"%(host,int(port),mark_info[2]),timeout=timeout).read() |
| 100 | + except urllib2.HTTPError,e: |
| 101 | + re_html = e.read() |
| 102 | + except Exception,e: |
| 103 | + return False |
| 104 | + if mark_info[3].lower() in re_html.lower(): |
| 105 | + log(scan_type,host,port,mark_info[0]) |
| 106 | + return mark_info[0] |
| 107 | +def scan_vul(scan_type,host,port): |
| 108 | + vul_plugin = read_config("plugin") |
| 109 | + try: |
| 110 | + for plugin_name in vul_plugin[scan_type]: |
| 111 | + req = __import__(plugin_name) |
| 112 | + log(plugin_name,host,port) |
| 113 | + vul_data = req.check(host,port,timeout) |
| 114 | + if vul_data.split("|")[0].upper()=="YES": |
| 115 | + log(scan_type,host,port,vul_data.split("|")[1]) |
| 116 | + except Exception,e: |
| 117 | + pass |
| 118 | +def get_ip_list(ip): |
| 119 | + ip_list = [] |
| 120 | + iptonum = lambda x:sum([256**j*int(i) for j,i in enumerate(x.split('.')[::-1])]) |
| 121 | + numtoip = lambda x: '.'.join([str(x/(256**i)%256) for i in range(3,-1,-1)]) |
| 122 | + if '-' in ip: |
| 123 | + ip_range = ip.split('-') |
| 124 | + ip_start = long(iptonum(ip_range[0])) |
| 125 | + ip_end = long(iptonum(ip_range[1])) |
| 126 | + ip_count = ip_end - ip_start |
| 127 | + if ip_count >= 0 and ip_count <= 65536: |
| 128 | + for ip_num in range(ip_start,ip_end+1): |
| 129 | + ip_list.append(numtoip(ip_num)) |
| 130 | + else: |
| 131 | + print '-h wrong format' |
| 132 | + elif '.ini' in ip: |
| 133 | + ip_config = open(ip,'r') |
| 134 | + for ip in ip_config: |
| 135 | + ip_list.extend(get_ip_list(ip.strip())) |
| 136 | + ip_config.close() |
| 137 | + else: |
| 138 | + ip_split=ip.split('.') |
| 139 | + net = len(ip_split) |
| 140 | + if net == 2: |
| 141 | + for b in range(1,255): |
| 142 | + for c in range(1,255): |
| 143 | + ip = "%s.%s.%d.%d"%(ip_split[0],ip_split[1],b,c) |
| 144 | + ip_list.append(ip) |
| 145 | + elif net == 3: |
| 146 | + for c in range(1,255): |
| 147 | + ip = "%s.%s.%s.%d"%(ip_split[0],ip_split[1],ip_split[2],c) |
| 148 | + ip_list.append(ip) |
| 149 | + elif net ==4: |
| 150 | + ip_list.append(ip) |
| 151 | + else: |
| 152 | + print "-h wrong format" |
| 153 | + return ip_list |
| 154 | +def put_queue(ip_list,port_list): |
| 155 | + for ip in ip_list: |
| 156 | + for port in port_list: |
| 157 | + queue.put(":".join(['portscan',ip,port])) |
| 158 | +if __name__=="__main__": |
| 159 | + msg = ''' |
| 160 | +A vulnerability detection scripts for middleware services author:wolf@future-sec |
| 161 | +Usage: python F-MiddlewareScan.py -h 192.168.1 [-p 7001,8080] [-m 50] [-t 10] |
| 162 | + ''' |
| 163 | + if len(sys.argv) < 2: |
| 164 | + print msg |
| 165 | + try: |
| 166 | + options,args = getopt.getopt(sys.argv[1:],"h:p:m:t:") |
| 167 | + ip = '' |
| 168 | + port = '80,4848,7001,7002,8000,8001,8080,8081,8888,9999,9043,9080' |
| 169 | + m_count = 100 |
| 170 | + for opt,arg in options: |
| 171 | + if opt == '-h': |
| 172 | + ip = arg |
| 173 | + elif opt == '-p': |
| 174 | + port = arg |
| 175 | + elif opt == '-m': |
| 176 | + m_count = int(arg) |
| 177 | + elif opt == '-t': |
| 178 | + timeout = int(arg) |
| 179 | + if ip: |
| 180 | + ip_list = get_ip_list(ip) |
| 181 | + port_list = [] |
| 182 | + if '.ini' in port: |
| 183 | + port_config = open(port,'r') |
| 184 | + for port in port_config: |
| 185 | + port_list.append(port.strip()) |
| 186 | + port_config.close() |
| 187 | + else: |
| 188 | + port_list = port.split(',') |
| 189 | + put_queue(ip_list,port_list) |
| 190 | + for i in range(m_count): |
| 191 | + t = ThreadNum(queue) |
| 192 | + t.setDaemon(True) |
| 193 | + t.start() |
| 194 | + queue.join() |
| 195 | + except Exception,e: |
| 196 | + print msg |
| 197 | + |
0 commit comments