Usman0220/CVE-2026-33017-Langflow-RCE

## ━━━ 功能 ━━━

### 核心引擎 - **Goroutine Pool** — 可配置并发（50-5000 个 worker） - **Banner Grabbing** — 读取连接时的服务响应 - **Smart Probing** — 针对不同端口的协议感知探测 - **Service Fingerprinting** — 识别 15+ 种服务 - **Real-time Stats** — 实时进度计数器 - **File Output** — 支持 pipeline 的输出格式

### Nuclei Pipeline - **Direct Integration** — 输出直接提供给 Nuclei 的 `-l` 标志 - **Multi-port Scan** — 自动化的逐个端口 pipeline - **Template Matching** — 针对不同服务的 Nuclei 模板 - **Severity Filtering** — critical / high / medium / low - **Batch Processing** — 每次运行处理 1万-10万 个目标 - **Findings Export** — 结构化的输出文件

## ━━━ 快速开始 ━━━ ``` # 1. Clone the beast git clone https://github.com/Usman0220/port-scanner.git && cd port-scanner # 2. Build go build -o port-scanner main.go # 3. Unleash — 使用 500 个 worker 扫描 5678 端口，1 万个 IP ./port-scanner -port 5678 -w 500 -n 10000 # 4. 完整 pipeline — 扫描 → 过滤 → nuclei ./port-scanner -port 80 -w 1000 -n 50000 -o http-open.txt awk -F'[|]' '{print $1}' http-open.txt | sed 's/\[OPEN\] //' | cut -d: -f1 | sort -u > http-targets.txt nuclei -l http-targets.txt -tags http -severity critical,high -o findings.txt ``` ## ━━━ 架构 ━━━ ``` ╔═══════════════════════════════════╗ ║ PORT SCANNER ENGINE ║ ╚═══════════════════════════════════╝ │ ┌───────────────┼───────────────┐ ▼ ▼ ▼ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ IP Generator│ │ Goroutine │ │ Result │ │ │ │ Pool │ │ Collector │ │ Random IPs │ │ │ │ │ │ Skip Private│ │ N workers │ │ Channel │ │ 1-223.x.x.x│ │ Concurrent │ │ Buffered │ └──────┬───────┘ └──────┬───────┘ └──────┬───────┘ │ │ │ ▼ ▼ ▼ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ TCP Connect │ │ Probe Send │ │ Banner Read │ │ │ │ │ │ │ │ Dial timeout│ │ Protocol │ │ Service │ │ 2s default │ │ aware │ │ fingerprint │ └──────────────┘ └──────────────┘ └──────────────┘ │ ╔═══════════════╧═══════════════╗ ║ OUTPUT: results.txt ║ ╚═══════════════╤═══════════════╝ │ ┌───────────────┼───────────────┐ ▼ ▼ ▼ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ awk / grep │ │ sort -u │ │ nuclei -l │ │ Extract IPs │ │ Deduplicate │ │ Vuln Scan │ └──────────────┘ └──────────────┘ └──────────────┘ │ ╔═══════════════╧═══════════════╗ ║ FINDINGS: nuclei-*.txt ║ ╚═══════════════════════════════╝ ``` ## ━━━ NUCLEI 集成 ━━━ ### 基础 Pipeline ``` # ┌─────────────────────────────────────────────────────────────┐ # │ 步骤 1：扫描 — 查找存活服务 │ # │ 步骤 2：提取 — 从结果中提取 IP │ # │ 步骤 3：审计 — Nuclei 漏洞扫描 │ # └─────────────────────────────────────────────────────────────┘ # 扫描 ./port-scanner -port 21 -w 1000 -n 50000 -o ftp-open.txt # 提取 awk -F'[|]' '{print $1}' ftp-open.txt | sed 's/\[OPEN\] //' | cut -d: -f1 | sort -u > ftp-targets.txt # 审计 nuclei -l ftp-targets.txt -tags ftp -severity critical,high -o ftp-findings.txt ``` ### 多端口自动化 Pipeline ``` #!/bin/bash # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ # 完整 RECON PIPELINE — 扫描 → 提取 → Nuclei → 报告 # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ PORTS=(21 22 23 25 80 110 143 443 3306 5432 6379 8080 8443 9090 27017 5678) WORKERS=1000 IPS=30000 SEVERITY="critical,high,medium" TEMPLATES="$HOME/.local/nuclei-templates" echo "╔══════════════════════════════════════════════════════════╗" echo "║ FULL RECON PIPELINE STARTED ║" echo "╚══════════════════════════════════════════════════════════╝" for port in "${PORTS[@]}"; do echo "" echo "┌──────────────────────────────────────────────────────┐" echo "│ [*] SCANNING PORT $port" echo "│ Workers: $WORKERS | Targets: $IPS" echo "└──────────────────────────────────────────────────────┘" # Scan ./port-scanner -port $port -w $WORKERS -n $IPS -o "scan-port${port}.txt" # Extract targets awk -F'[|]' '{print $1}' "scan-port${port}.txt" | \ sed 's/\[OPEN\] //' | cut -d: -f1 | sort -u > "targets-port${port}.txt" count=$(wc -l < "targets-port${port}.txt") echo "[+] Found $count live hosts on port $port" # Nuclei audit if [ "$count" -gt 0 ]; then echo "[*] Running Nuclei templates for port $port..." nuclei -l "targets-port${port}.txt" \ -p-port $port \ -t "$TEMPLATES" \ -severity $SEVERITY \ -o "nuclei-port${port}.txt" \ -silent -stats vulns=$(wc -l < "nuclei-port${port}.txt" 2>/dev/null || echo "0") echo "[!] $vulns vulnerabilities found on port $port" fi done # 合并所有发现 echo "" echo "┌──────────────────────────────────────────────────────┐" echo "│ [*] MERGING ALL FINDINGS" echo "└──────────────────────────────────────────────────────┘" cat nuclei-port*.txt 2>/dev/null | sort -u > all-findings.txt total=$(wc -l < "all-findings.txt" 2>/dev/null || echo "0") echo "" echo "╔══════════════════════════════════════════════════════════╗" echo "║ PIPELINE COMPLETE ║" echo "║ Total vulnerabilities: $total" echo "║ Report: all-findings.txt" echo "╚══════════════════════════════════════════════════════════╝" ``` ### 按服务划分的 Nuclei 命令 ``` # ┌─────────────────────────────────────────────────────────────┐ # │ 特定服务 NUCLEI 扫描 │ # └─────────────────────────────────────────────────────────────┘ # FTP — 匿名登录，brute force，已知 CVE nuclei -l targets.txt -tags ftp -severity critical,high # SSH — 弱加密算法，user enumeration，CVE nuclei -l targets.txt -tags ssh -severity critical,high,medium # HTTP — 完整 web 审计（XSS、SQLi、LFI、RCE、misconfig） nuclei -l targets.txt -tags http -severity critical,high,medium,low # MySQL — 弱认证，CVE，misconfig nuclei -l targets.txt -tags mysql -severity critical,high # Redis — 未经授权的访问，module loading nuclei -l targets.txt -tags redis -severity critical,high # MongoDB — 无认证，CVE nuclei -l targets.txt -tags mongodb -severity critical,high # PostgreSQL — 弱认证，CVE nuclei -l targets.txt -tags postgresql -severity critical,high # n8n — God Mode exploit，CVE-2025-68613 nuclei -l targets.txt -tags n8n -severity critical # Jenkins — 脚本控制台，CVE nuclei -l targets.txt -tags jenkins -severity critical,high # Grafana — path traversal，CVE nuclei -l targets.txt -tags grafana -severity critical,high # 全面审计 — 所有内容 nuclei -l targets.txt -t ~/.local/nuclei-templates/ -severity critical,high,medium,low ``` ## ━━━ 扫描模式 ━━━ ### 单端口扫描 ``` ./port-scanner -port 443 -w 500 -n 10000 -o results.txt ``` ### 高速扫描 ``` ./port-scanner -port 80 -w 2000 -n 100000 -o results.txt ``` ### 快速侦察 ``` ./port-scanner -port 5678 -w 100 -n 5000 -timeout 1s ``` ### 深度扫描（速度慢但彻底） ``` ./port-scanner -port 22 -w 200 -n 50000 -timeout 5s -o deep-scan.txt ``` ## ━━━ 真实输出示例 ━━━ ``` ┌──────────────────────────────────────────────────────────────────────┐ │ [*] 15234/30000 scanned | 847 open | 847 verified │ │ │ │ [OPEN] 103.21.244.12:80 | HTTP/Apache | HTTP/1.1 200 OK │ │ [OPEN] 198.51.100.45:22 | SSH | SSH-2.0-OpenSSH_8.9p1 │ │ [OPEN] 203.0.113.88:3306 | MySQL | 5.7.42-0ubuntu0.18.04.1 │ │ [OPEN] 192.0.2.15:6379 | Redis | Redis server version 7.0.11 │ │ [OPEN] 198.51.100.200:5678 | n8n | n8n v1.19.0 │ │ [OPEN] 203.0.113.55:27017 | MongoDB | MongoDB 6.0.4 │ │ [OPEN] 103.21.244.90:8080 | HTTP/Nginx | HTTP/1.1 200 OK │ │ [OPEN] 198.51.100.120:5432 | PostgreSQL | PostgreSQL 15.3 │ │ │ │ [+] Done. Scanned: 30000 | Open: 847 | Verified: 847 │ └──────────────────────────────────────────────────────────────────────┘ ``` ## ━━━ 标志 ━━━ | 标志 | 默认值 | 描述 | |------|---------|-------------| | `-port` | `5678` | 要扫描的目标端口 | | `-w` | `500` | Goroutine worker 数量（越多 = 越快） | | `-timeout` | `2s` | TCP 连接超时 | | `-n` | `10000` | 要扫描的随机 IP 数量 | | `-o` | `""` | 输出文件路径 | ## ━━━ 支持的服务 ━━━

端口	服务	探测	指纹
21	FTP	Banner	ProFTPD, vsftpd, Pure-FTPd
22	SSH	Banner	OpenSSH, Dropbear
23	Telnet	Banner	通用 telnetd
25, 587	SMTP	EHLO test	Postfix, Exim, Sendmail
80, 8080, 8443, 443, 5678, 3000, 8000, 8888, 9090	HTTP	GET /	Nginx, Apache, IIS, Cloudflare, n8n, Grafana, Jenkins, Kibana
110	POP3	Banner	Dovecot, Courier
143	IMAP	Banner	Dovecot, Courier
3306	MySQL	Handshake	MySQL 5.x, 8.x
5432	PostgreSQL	Startup	PostgreSQL 12-16
6379	Redis	INFO	Redis 6.x, 7.x
27017	MongoDB	Hello	MongoDB 5.x, 6.x, 7.x

## ━━━ 性能 ━━━

指标	数值
扫描速度（500 个 worker）	~2,500 IPs/秒
扫描速度（2000 个 worker）	~10,000 IPs/秒
内存使用	基础 ~50MB + worker pool
连接超时	可配置（默认 2s）
最大并发连接数	无限制（受 worker 标志限制）

## ━━━ 环境要求 ━━━ ``` # Go go version # >= 1.20 # Nuclei（可选 — 用于漏洞扫描） go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest # 更新 Nuclei templates nuclei -update-templates ``` ## ━━━ 免责声明 ━━━ ``` ┌──────────────────────────────────────────────────────────────────────┐ │ │ │ ⚠️ WARNING │ │ │ │ This tool is for AUTHORIZED security testing and research only. │ │ │ │ Scanning networks without explicit permission is ILLEGAL. │ │ Use this tool responsibly and only on systems you own or have │ │ written authorization to test. │ │ │ │ The author is not responsible for any misuse or damage caused │ │ by this tool. │ │ │ └──────────────────────────────────────────────────────────────────────┘ ```

标签：Go语言工具, Langflow, PoC, RCE, 安全, 应用安全, 日志审计, 暴力破解, 超时处理