k8gege/ladongo

Ladon for Kali 全平台开源内网渗透扫描器,Windows/Linux/Mac/路由器内网渗透，使用它可轻松一键批量探测C段、B段、A段存活主机、高危漏洞检测MS17010、SmbGhost，远程执行SSH/Winrm，密码爆破SMB/SSH/FTP/Mysql/Mssql/Oracle/Winrm/HttpBasic/Redis，端口扫描服务识别PortScan指纹识别/HttpBanner/HttpTitle/TcpBanner/Weblogic/Oxid多网卡主机，端口扫描服务识别PortScan。

Ladon Scanner For Golang

Wiki

http://k8gege.org/Ladon/LadonGo.html

Introduction

LadonGo is an open source intranet penetration scanner framework, which can be used to easily detect segment C, B, A live hosts, fingerprint identification, port scanning, password explosion, remote execution, high-risk vulnerability detection, etc. Version 4.0 includes 37 functions, high risk vulnerability detection MS17010, SmbGhost, remote execution of SshCmd, WinrmCmd, PhpShell, JspShell, GoWebShell, L, 12 protocol password explosion Smb/Ssh/Ftp/Mysql/Mssql/Oracle/Sqlplus/Winrm/HttpBasic/Edits/MongoDB/RouterOS, survival detection/information collection/fingerprint identification NbtInfo, OnlinePC, Ping, Icmp, SnmpScan, HttpBanner, HttpTitle, TcpBanner, WeblogicScan, O xidScan, Port scan / service probe portscan, forward to Socks5 proxy< br>

LadonGO 5.2 Pentest Scanner framework 全平台Go开源内网渗透扫描器框架,Windows/Linux/Mac内网渗透，使用它可轻松一键批量探测C段、B段、A段存活主机、高危漏洞检测MS17010、SmbGhost，远程执行SSH/Winrm，密码爆破SMB/SSH/FTP/Mysql/Mssql/Oracle/Winrm/HttpBasic/Redis，端口扫描服务识别PortScan指纹识别/HttpBanner/HttpTitle/TcpBanner/Weblogic/Oxid多网卡主机，端口扫描服务识别PortScan。

Development environment

OS: Kali 2019 X64

IDE: Mousepad

Go: 1.13 Linux

Function module

Detection

.	.
OnlinePC	(Using ICMP/SNMP/Ping detect Online hosts)
PingScan	(Using system ping to detect Online hosts)
IcmpScan	(Using ICMP Protocol to detect Online hosts)
SnmpScan	(Using Snmp Protocol to detect Online hosts)
HttpBanner	(Using HTTP Protocol Scan Web Banner)
HttpTitle	(Using HTTP protocol Scan Web titles)
T3Scan	(Using T3 Protocol Scan Weblogic hosts)
PortScan	(Scan hosts open ports using TCP protocol)
TcpBanner	(Scan hosts open ports using TCP protocol)
OxidScan	(Using dcom Protocol enumeration network interfaces)
NbtInfo	(Scan hosts open ports using NBT protocol)

VulDetection

.	.
MS17010	(Using SMB Protocol to detect MS17010 hosts)
SmbGhost	(Using SMB Protocol to detect SmbGhost hosts)
CVE-2021-21972	(Check VMware vCenter 6.5 6.7 7.0 Rce Vul)
CVE-2021-26855	(Check CVE-2021-26855 Microsoft Exchange SSRF)

BruteForce

.	.
SmbScan	(Using SMB Protocol to Brute-For 445 Port)
SshScan	(Using SSH Protocol to Brute-For 22 Port)
FtpScan	(Using FTP Protocol to Brute-For 21 Port)
401Scan	(Using HTTP BasicAuth to Brute-For web Port)
MysqlScan	(Using Mysql Protocol to Brute-For 3306 Port)
MssqlScan	(Using Mssql Protocol to Brute-For 1433 Port)
OracleScan	(Using Oracle Protocol to Brute-For 1521 Port)
MongodbScan	(Using Mongodb Protocol to Brute-For 27017 Port)
WinrmScan	(Using Winrm Protocol to Brute-For 5985 Port)
SqlplusScan	(Using Oracle Sqlplus Brute-For 1521 Port)
RedisScan	(Using Redis Protocol to Brute-For 6379 Port)

RemoteExec

.	.
SshCmd	(SSH Remote command execution Default 22 Port)
WinrmCmd	(Winrm Remote command execution Default 5985 Port)
PhpShell	(Php WebShell command execution Default 80 Port)
GoWebShell	(Go WebShell Default http://IP:888/web)
WinJspShell	(JSP Shell Remote command execution Default 80 Port)
LnxJspShell	(JSP Shell Remote command execution Default 80 Port)
LnxRevShell	(Bash Reverse Shell)

Exploit

.	.
PhpStudyDoor	(PhpStudy 2016 & 2018 BackDoor Exploit)
CVE-2018-14847	(Export RouterOS Password 6.29 to 6.42)

Socks5

.	.
Socks5	(Socks5 forward proxy server)

Build

go get github.com/k8gege/LadonGo
go build Ladon.go

Make

make windows
make linux
make mac

Install

Linux/Mac

make install

Windows

go run install.go

Usage

help

Ladon FuncList
Ladon Detection
Ladon VulDetection
adon BruteFor
Ladon RemoteExec
Ladon Exploit
Ladon Example

Usage

Ladon IP/pcname/CIDR/URL/txt moudle

Ladon 192.168.1.8 MS17010
Ladon 192.168.1.8/24 MS17010
Ladon 192.168.1/c MS17010
Ladon 192.168/b MS17010
Ladon 192/a MS17010

Ladon 192.168.1-192.168.5 MS17010
Ladon http://192.168.1.8:8080 BasicAuthScan
Ladon ip.txt MS17010
Ladon url.txt HttpBanner

Examples

Forward Socks5 proxy server

Ladon Socks5 192.168.1.8 1080

Information collection and vulnerability detection

Ping scan segment C live hosts (with any permission) < br >

Ladon 192.168.1.8/24 PingScan

ICMP scanning section C survival host (administrator authority)

Ladon 192.168.1.8/24 IcmpScan

SNMP scanning of surviving hosts and devices in Segment C

Ladon 192.168.1.8/24 SnmpScan

SMB scans C-segment eternal blue ms17010 vulnerable hosts < br >

Ladon 192.168.1.8/24 MS17010

SMB scans C-segment eternal black smbghost vulnerability host < br >

Ladon 192.168.1.8/24 SmbGhost

T3 scans the hosts with open WebLogic in Segment C

Ladon 192.168.1.8/24 T3Scan

HTTP scanning C-segment open Web site Banner

Ladon 192.168.1.8/24 BannerScan

HTTP scanning section C open Web site title

Ladon 192.168.1.8/24 HttpTitle

TCP scans the open port service information of section C. < br >

Ladon 192.168.1.8/24 TcpBanner

TCP scans common open ports of segment C hosts

Ladon 192.168.1.8/24 PortScan

Password explosion, weak password

Scan weak password of windows machine on port 445 of section C. < br >

Ladon 192.168.1.8/24 SmbScan

Scan the SSH weak password of the 22 port Linux machine in section C

Ladon 192.168.1.8/24 SshScan

Scan the weak password of FTP server on port 21 of section C. < br >

Ladon 192.168.1.8/24 FtpScan

Scan the weak password of MySQL server on port 3306 in section C

Ladon 192.168.1.8/24 MysqlScan

Scan weak password of Oracle server on port 1521 in segment C

Ladon 192.168.1.8/24 OracleScan

Scan the weak password of MongoDB server on port 27017 in section C

Ladon 192.168.1.8/24 MongodbScan

Scan weak password of Oracle server on port 1521 of section C. < br >

Ladon 192.168.1.8/24 SqlplusScan

Scan section C 5985 port Winrm server weak password

Ladon 192.168.1.8/24 WinrmScan

Scan the empty password of redis server on port 6379 of section C. < br >

Ladon 192.168.1.8/24 RedisScan

Scan C-segment 8728 port Routeros router < br >

Ladon 192.168.1.8/24 RouterOSScan

Remote command execution

Ladon SshCmd host port user pass cmd
Ladon WinrmCmd host port user pass cmd
Ladon PhpShell url pass cmd
Ladon PhpStudyDoor url cmd

SshCmd & WinrmCmd

PhpShell & PhpStudyDoor

SCAN IP/24 (192.168.1/c)

.	.	.
ICMP	3ms	1/20s
WebTitle	10ms	1/6s
T3Scan	15ms	1/4s
EthScan	2ms	1/30s

Scan B(192.168/b)

.	.	.
EthScan	23Min	1 Port
T3Scan	1h	4 Port
WebTitle	40Min	1 Port
MS17010	12Min	1 Port
Snmp	20Min	1 Port

PS: the scanning speed is actually similar to the speed of Ladon. Net version, but there is no special record, because the speed of go version is recorded by the way during the rewrite test

Cross platform / whole platform / whole system

Support old and new operating systems, especially old Linux systems. Many online tools can't be used at all or various errors are reported

TestOn

ID	OS
0	WinXP
1	Win 2003
2	Win 7
3	Win 8.1
4	Win 10
5	Win 2008 R2
6	Win 2012 R2
7	Win 2019
8	Kali 1.0.2
9	Kali 2018
10	Kali 2019
11	SUSE 10
12	CentOS 5.8
13	CentOS 6.3
14	CentOS 6.8
15	Fedora 5
16	RedHat 5.7
17	BT5-R3
18	MacOS 10.15
19	Ubuntu 8
20	Ubuntu 18

MacOS x64 10.15

Linux

Windows

Download

LadonGo (ALL OS)

https://github.com/k8gege/LadonGo/releases
http://k8gege.org/Download/LadonGo.rar

Ladon (Windows & Cobalt Strike)

History: https://github.com/k8gege/Ladon/releases
911 Ver：http://k8gege.org/Download

Stargazers over time

ladongo's Issues

mac无法正常使用m1

是m1架构的 darwin arm64

进行域提权时候出现报错

要怎么解决他

无socks5仓库

go get github.com/k8gege/LadonGo无sockss仓库

无法输出到文件

使用 > 输出到文件 把 文件名识别成了Moudle。

为何使用GO?

为何使用GO

现有Ladon版本无法兼容一些系统，代理又丢包非常蛋疼。虽然Python版也是跨平台，但是编译体积大，二是有些依赖包（依赖底层库）在某些系统安装非常麻烦甚至装不上，有些编译后不能执行等原因。所以这几天重新学了下GO，现学现卖使用Golang重写Ladon框架，先加一些功能看看效果，GO和PY差不多很简单，框架弄好后，使用开源库一下就可以添加好几个功能模块，然后再测14个操作系统下程序的兼容性，无论性能、体积、兼容性都远甩Python几条街，最主要是编译的程序可在一些旧操作系统上执行，Python可能受限于py版本、相关依赖包或GCC、GLID、SSL等库版本影响，Go可以很好解决这些问题。

缺点： 很多API库没有人封装或者根本不能用，想要实现Ladon的所有功能或者说一半的功能，两三个月都搞不定，如Ladon的OsScan模块用到的协议就已比这个LadonGo 1.0现在的11个功能还要多。如果用Python的话就非常快了，各种依赖库、各种现有POC，写好扫描框架，稍微改一下集成起来就是功能非常多的扫描器，但是目标PY版本低、操作系统老，本地编译再丢过去都不定能运行，本地都未必能编译，所以选用GO。

go get报错

go: github.com/k8gege/LadonGo imports
github.com/k8gege/LadonGo/mysql imports
github.com/Go-SQL-Driver/MySQL: github.com/Go-SQL-Driver/[email protected]: parsing go.mod:
module declares its path as: github.com/go-sql-driver/mysql
but was required as: github.com/Go-SQL-Driver/MySQL

PhpStudyDoor runtime error

sshcmd存在bug

最新版本的ladonGo，sshcmd模块存在bug，会直接退出。

macos报错

go/pkg/mod/github.com/k8gege/[email protected]/install.go:25:6: main redeclared in this block
previous declaration at go/pkg/mod/github.com/k8gege/[email protected]/Ladon.go:184:6

第一次接触go语言，装一个晚上，我疯了啊

保存结果是哪个模块呀？我在help没找到

win10编译4.5版本得到的ladon.exe的版本信息还是4.2是这样吗？

win10编译4.5版本得到的ladon.exe的版本信息还是4.2是这样吗？

Mac/OSX M1(arm64) Release

Hello,
This tool does not work in the release published for m1 arm64. Can you release a release for arm64?

端口扫描成功率很低

对单个目标进行扫描时，只能检测到一个端口开放（实际大约开放13个）

go编译报错

../../../go/pkg/mod/github.com/k8gege/[email protected]/install.go:25:6: main redeclared in this block
previous declaration at ../../../go/pkg/mod/github.com/k8gege/[email protected]/Ladon.go:184:6

这个该怎么解决？我按照网上的方式，新建了一个文件夹Ladon，将Ladon.go放入其中，可以编译成功，但是无法使用。请问有官方的解决方法么？

socks5可以设置密码吗？

没密码不是谁都能用？

请求更新

大佬后续可还有更新ladongo的计划？

go get 报错

github.com/k8gege/LadonGo

../go/pkg/mod/github.com/k8gege/[email protected]/install.go:25:6: main redeclared in this block
previous declaration at ../go/pkg/mod/github.com/k8gege/[email protected]/Ladon.go:184:6
操作系统:ubuntu 20

What is the password for Ladon & Drupal Rar

Please Can You give me the password for Ladon 7 & Drupal 7.31 SQL injection vulnerability modify the administrator user name and password_1017[K8] rar file. Thanks

LadonGo支持全平台，Ladon不支持多架构，但是摄像头弱口令检测模块LadonGo没有啊

希望能给LadonGo加上DvrScan模块