-
Notifications
You must be signed in to change notification settings - Fork 133
/
winrmScan.go
40 lines (38 loc) · 1.11 KB
/
winrmScan.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
package plugin
import (
"encoding/base64"
"fmt"
"github.com/M09ic/go-ntlmssp"
"github.com/chainreactors/gogo/v2/pkg"
"github.com/chainreactors/logs"
"github.com/chainreactors/utils/iutils"
"net/http"
"strings"
)
func winrmScan(result *pkg.Result) {
result.Port = "5985"
uri := fmt.Sprintf("http://%s/wsman", result.GetTarget())
logs.Log.Debugf("winrm scan %s", uri)
conn := pkg.HttpConn(RunOpt.Delay)
req, _ := http.NewRequest("POST", uri, nil)
req.Header.Add("Content-Type", "application/soap+xml;charset=UTF-8")
req.Header.Add("User-Agent", "Microsoft WinRM Client")
req.Header.Add("Authorization", "Negotiate TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==")
resp, err := conn.Do(req)
if err != nil {
return
}
defer resp.Body.Close()
result.Open = true
ntlminfo := resp.Header.Get("Www-Authenticate")
if ntlminfo == "" || !strings.HasPrefix(ntlminfo, "Negotiate ") {
return
}
tinfo, err := base64.StdEncoding.DecodeString(ntlminfo[10:])
if err != nil {
return
}
result.Status = "winrm"
result.Protocol = "winrm"
result.AddNTLMInfo(iutils.ToStringMap(ntlmssp.NTLMInfo(tinfo)), "winrm")
}