fscan內網資產掃描並輸出報告

JentZhang發表於2024-06-28
內網

fscan內網資產掃描並輸出報告

fscan介紹

一款內網綜合掃描工具，方便一鍵自動化、全方位漏掃掃描。
支援主機存活探測、埠掃描、常見服務的爆破、ms17010、redis批次寫公鑰、計劃任務反彈shell、讀取win網路卡資訊、web指紋識別、web漏洞掃描、netbios探測、域控識別等功能。

fscan開源，github上游詳細的說明，詳見：https://github.com/shadow1ng/fscan

使用說明（Linux）

  • 指定單個IP
./fscan -h 192.168.160.1
  • 指定網段
./fscan -h 192.168.75.0/24
  • 將掃描結果儲存到指定檔案（預設儲存到：result.txt）
./fscan -h 192.168.75.0/24 -o 192-168-75-0-24.txt
  • 掃描結果樣例
   ___                              _    
  / _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <    
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.4
start infoscan
192.168.160.1:8089 open
192.168.160.1:9000 open
192.168.160.1:22 open
192.168.160.1:80 open
192.168.160.1:8008 open
192.168.160.1:3306 open
192.168.160.1:9001 open
192.168.160.1:8012 open
192.168.160.1:8443 open
192.168.160.1:8083 open
[*] alive ports len is: 10
start vulscan
[*] WebTitle http://192.168.160.1      code:307 len:61     title:None 跳轉url: http://192.168.22.68:9001
[*] WebTitle http://192.168.160.1:9000 code:307 len:61     title:None 跳轉url: http://192.168.160.1:9001
[*] WebTitle http://192.168.22.68:9001 code:200 len:1310   title:MinIO Console
[*] WebTitle http://192.168.160.1:9001 code:200 len:1310   title:MinIO Console
[*] WebTitle http://192.168.160.1:8089 code:403 len:555    title:403 Forbidden
[*] WebTitle http://192.168.160.1:8012 code:302 len:0      title:None 跳轉url: http://192.168.160.1:8012/index
[*] WebTitle http://192.168.160.1:8012/index code:200 len:12409  title:kkFileView演示首頁
[*] WebTitle http://192.168.160.1:9001 code:200 len:1310   title:MinIO Console
[*] WebTitle https://192.168.160.1:8083 code:502 len:559    title:502 Bad Gateway
[*] WebTitle https://192.168.160.1:8443 code:404 len:232    title:404 Not Found
[*] WebTitle http://192.168.160.1:8008 code:404 len:232    title:404 Not Found
[+] SSH 192.168.12.20:22:root root
[+] SSH 192.168.12.19:22:root root
[+] SSH 192.168.12.18:22:root root
[+] PocScan https://192.168.69.58:8443 poc-yaml-springboot-cve-2021-21234 spring3
[+] PocScan https://192.168.69.61:8443 poc-yaml-springboot-cve-2021-21234 spring3
[+] PocScan http://192.168.69.58:18000 poc-yaml-springboot-cve-2021-21234 spring3

輸出報告

可以看出來，fscan掃出來的內容包含很多描述性的INFO級別日誌，如何提取出主要資訊並輸出報告。

可以結合Python + Pandas的形式利用正規表示式提取出主要資訊再透過Pandas匯出Excel。

  • 首先要有Python3.5+的Python環境
  • 安裝pandas
pip install pandas
  • 程式碼部分
#!/usr/bin/env python
# -*- coding:utf-8 -*-
# @Time：2024/6/27 14:35
# @Software：PyCharm
__author__ = "JentZhang"

import re

import pandas


def extract_info(text):

    # 匹配SSH型別的文字
    pattern = re.compile(r'\[\+\] (.+) (http://|https://)?([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})(:(\d+))?.*')

    match = pattern.search(text)

    if match:
        return {
            '型別': match.group(1),
            'IP': match.group(3),
            '埠': match.group(5)
        }

    return None


def extract_lines(filepath, start_msg='[+]'):
    """
    抽取掃描結果中的指定行
    :param filepath:
    :param start_msg:
    :return:
    """
    matching_lines = []
    with open(filepath, 'r', encoding='utf-8') as file:
        for line in file:
            if line.startswith(start_msg):
                matching_lines.append(line.strip())
    return matching_lines


def export_to_excel(data, filename):
    """
    匯出資料到excel
    :param data:
    :param filename:
    :return:
    """
    df = pandas.DataFrame(data)
    df.to_excel(f"{filename}資產測繪.xlsx", index=False)


def analysis_data(file_data):
    """
    分析掃描的檔案資料
    :param file_data:
    :return:
    """
    res = []
    for i in file_data:
        # print(f"before: {i}")
        info = extract_info(i)
        if info:
            info["掃描結果"] = i
            res.append(info)
            # print(f"after: {info}")
    return res


if __name__ == '__main__':
    # files = ["10_139_0_0_23.txt", "10_139_162_0_23.txt", "10_139_176_0_21.txt"]
    files = ["172_16_0_0_16.txt"]
    for file in files:  # 迴圈便利掃描的結果檔案，分析出結果並匯出Excel
        d = extract_lines(file)
        export_to_excel(analysis_data(d), file.split(".")[0])
  • 報告樣式

image

相關文章