create-dwy 0.5.0 → 0.6.0

package/templates/claude-global/skills/dwy-pentest/scripts/lib/severity.py

@@ -0,0 +1,96 @@
+"""CVSS 评分映射 + 严重性分级工具。"""
+
+from dataclasses import dataclass
+from enum import Enum
+
+
+class Severity(str, Enum):
+    CRITICAL = "Critical"
+    HIGH = "High"
+    MEDIUM = "Medium"
+    LOW = "Low"
+    INFO = "Info"
+
+
+@dataclass
+class Finding:
+    """统一的漏洞发现记录。"""
+
+    title: str
+    severity: Severity
+    cvss: float
+    cve_id: str = ""
+    description: str = ""
+    evidence: str = ""
+    affected_service: str = ""
+    discovery_tool: str = ""
+    remediation: str = ""
+    references: list[str] | None = None
+
+    def to_dict(self) -> dict:
+        return {
+            "title": self.title,
+            "severity": self.severity.value,
+            "cvss": self.cvss,
+            "cve_id": self.cve_id,
+            "description": self.description,
+            "evidence": self.evidence,
+            "affected_service": self.affected_service,
+            "discovery_tool": self.discovery_tool,
+            "remediation": self.remediation,
+            "references": self.references or [],
+        }
+
+
+def cvss_to_severity(score: float) -> Severity:
+    """CVSS 3.1 评分 → 严重性等级。"""
+    if score >= 9.0:
+        return Severity.CRITICAL
+    if score >= 7.0:
+        return Severity.HIGH
+    if score >= 4.0:
+        return Severity.MEDIUM
+    if score >= 0.1:
+        return Severity.LOW
+    return Severity.INFO
+
+
+def nuclei_severity_to_cvss(severity: str) -> float:
+    """Nuclei 严重性字符串 → 估算 CVSS 分数。"""
+    mapping = {
+        "critical": 9.5,
+        "high": 7.5,
+        "medium": 5.5,
+        "low": 2.5,
+        "info": 0.0,
+    }
+    return mapping.get(severity.lower(), 0.0)
+
+
+def nmap_vuln_to_finding(script_id: str, output: str) -> Finding:
+    """将 nmap NSE 漏洞脚本输出转为 Finding。"""
+    # 常见 NSE 漏洞脚本的严重性映射
+    critical_scripts = {"ssl-heartbleed", "smb-vuln-ms17-010", "http-shellshock"}
+    high_scripts = {"smb-vuln-ms08-067", "ssl-poodle", "http-vuln-cve2017-5638"}
+    medium_scripts = {"ssl-dh-params", "http-csrf", "http-sql-injection"}
+
+    if script_id in critical_scripts:
+        severity = Severity.CRITICAL
+        cvss = 9.5
+    elif script_id in high_scripts:
+        severity = Severity.HIGH
+        cvss = 7.5
+    elif script_id in medium_scripts:
+        severity = Severity.MEDIUM
+        cvss = 5.5
+    else:
+        severity = Severity.MEDIUM
+        cvss = 5.0
+
+    return Finding(
+        title=script_id.replace("-", " ").replace("_", " ").title(),
+        severity=severity,
+        cvss=cvss,
+        description=output[:500],
+        discovery_tool="nmap-nse",
+    )

package/templates/claude-global/skills/dwy-pentest/scripts/lib/validator.py

@@ -0,0 +1,113 @@
+"""目标验证：IP/域名格式校验、私网地址检测。"""
+
+import ipaddress
+import re
+from dataclasses import dataclass
+from urllib.parse import urlparse
+
+
+@dataclass
+class Target:
+    """解析后的目标信息。"""
+
+    raw: str
+    host: str  # 纯 IP 或域名
+    port: int | None = None
+    scheme: str | None = None  # http/https
+    path: str = "/"
+    is_ip: bool = False
+    is_private: bool = False
+
+    @property
+    def base_url(self) -> str:
+        if self.scheme:
+            port_part = f":{self.port}" if self.port and self.port not in (80, 443) else ""
+            return f"{self.scheme}://{self.host}{port_part}"
+        return self.host
+
+    @property
+    def web_url(self) -> str | None:
+        """如果有 scheme 返回完整 URL，否则 None。"""
+        if self.scheme:
+            port_part = f":{self.port}" if self.port and self.port not in (80, 443) else ""
+            return f"{self.scheme}://{self.host}{port_part}{self.path}"
+        return None
+
+
+_DOMAIN_RE = re.compile(
+    r"^(?!-)[A-Za-z0-9-]{1,63}(?<!-)(\.[A-Za-z0-9-]{1,63})*\.[A-Za-z]{2,}$"
+)
+
+
+def parse_target(raw: str) -> Target:
+    """解析用户输入的目标字符串。
+
+    支持格式：
+    - IP: 192.168.1.1, 10.0.0.1
+    - 域名: example.com, sub.example.com
+    - URL: http://example.com, https://example.com:8443/path
+    - IP:端口: 192.168.1.1:8080
+    """
+    raw = raw.strip()
+    scheme = None
+    host = raw
+    port = None
+    path = "/"
+
+    # 尝试解析为 URL
+    if "://" in raw:
+        parsed = urlparse(raw)
+        scheme = parsed.scheme or None
+        host = parsed.hostname or raw
+        port = parsed.port
+        path = parsed.path or "/"
+    elif ":" in raw and not raw.startswith("["):
+        # IP:port 或 host:port
+        parts = raw.rsplit(":", 1)
+        if parts[1].isdigit():
+            host = parts[0]
+            port = int(parts[1])
+
+    # 判断是否为 IP
+    is_ip = False
+    is_private = False
+    try:
+        addr = ipaddress.ip_address(host)
+        is_ip = True
+        is_private = addr.is_private or addr.is_loopback or addr.is_reserved
+    except ValueError:
+        pass
+
+    return Target(
+        raw=raw,
+        host=host,
+        port=port,
+        scheme=scheme,
+        path=path,
+        is_ip=is_ip,
+        is_private=is_private,
+    )
+
+
+def validate_target(raw: str) -> tuple[Target | None, str]:
+    """校验目标合法性。
+
+    Returns:
+        (target, warning) — target=None 表示无效，warning 为警告信息（私网等）。
+    """
+    target = parse_target(raw)
+
+    # 校验 host 格式
+    if not target.is_ip and not _DOMAIN_RE.match(target.host):
+        return None, f"无效的目标地址: '{target.host}'（不是有效的 IP 或域名）"
+
+    # 端口范围
+    if target.port is not None and not (1 <= target.port <= 65535):
+        return None, f"无效的端口号: {target.port}"
+
+    # 私网地址警告
+    warning = ""
+    if target.is_private:
+        warning = f"目标 {target.host} 是私网/本地地址，请确认这是你的测试环境"
+
+    return target, warning

package/templates/claude-global/skills/dwy-pentest/scripts/pentest_auth.py

@@ -0,0 +1,289 @@
+"""阶段 6：认证与凭据测试 — 弱密码检测、默认凭据探测（多服务并发）。
+
+用法:
+    uv run pentest_auth.py --target <host> --output-dir <dir> [--services ssh,ftp,http]
+"""
+
+import argparse
+import asyncio
+import sys
+import time
+from concurrent.futures import ThreadPoolExecutor
+from pathlib import Path
+
+import httpx
+from rich.console import Console
+from rich.table import Table
+
+from lib.config import DEFAULT_CREDENTIALS, MAX_AUTH_ATTEMPTS, WEAK_PASSWORDS
+from lib.executor import AuditLog, run_command, save_json_result
+from lib.validator import validate_target
+
+console = Console()
+
+LOGIN_PATHS = ["/login", "/admin", "/admin/login", "/user/login", "/auth/login", "/wp-login.php"]
+LOGIN_KEYWORDS = ["password", "passwd", "login", "sign in"]
+
+
+def test_ssh(host: str, port: int, audit: AuditLog) -> list[dict]:
+    """SSH 弱密码检测。"""
+    findings = []
+    console.print(f"[bold]SSH 弱密码测试: {host}:{port}[/bold]")
+
+    usernames = ["root", "admin", "ubuntu", "ec2-user"]
+    max_passwords = MAX_AUTH_ATTEMPTS // len(usernames)
+    passwords = WEAK_PASSWORDS[:max_passwords]
+
+    pass_file = Path("/tmp/dwy_pentest_passwords.txt")
+    pass_file.write_text("\n".join(passwords))
+    user_file = Path("/tmp/dwy_pentest_users.txt")
+    user_file.write_text("\n".join(usernames))
+
+    cmd = [
+        "hydra",
+        "-L", str(user_file),
+        "-P", str(pass_file),
+        "-t", "4",
+        "-f",
+        "-o", "-",
+        "-s", str(port),
+        host,
+        "ssh",
+    ]
+
+    result = run_command(cmd, timeout=120, audit=audit)
+
+    pass_file.unlink(missing_ok=True)
+    user_file.unlink(missing_ok=True)
+
+    if result.returncode == -3:
+        console.print("[yellow]hydra 未安装，跳过 SSH 弱密码测试[/yellow]")
+        return findings
+
+    if result.blocked:
+        console.print(f"[red]hydra 被安全策略拦截: {result.block_reason}[/red]")
+        return findings
+
+    for line in result.stdout.split("\n"):
+        if "host:" in line.lower() and ("login:" in line.lower() or "password:" in line.lower()):
+            findings.append({
+                "type": "Weak SSH Credential",
+                "detail": line.strip(),
+                "service": f"ssh:{port}",
+                "severity": "Critical",
+                "cvss": 9.8,
+            })
+            console.print(f"  [red bold][CRITICAL] 发现弱密码！ {line.strip()}[/red bold]")
+
+    if not findings:
+        console.print(f"  [green]SSH 弱密码测试通过（测试了 {len(usernames) * len(passwords)} 组凭据）[/green]")
+
+    return findings
+
+
+def test_ftp(host: str, port: int, audit: AuditLog) -> list[dict]:
+    """FTP 匿名登录 + 弱密码检测（匿名探测与 hydra 弱密码并发）。"""
+    findings = []
+    console.print(f"[bold]FTP 测试: {host}:{port}[/bold]")
+
+    creds = DEFAULT_CREDENTIALS[:10]
+    user_file = Path("/tmp/dwy_pentest_ftp_users.txt")
+    pass_file = Path("/tmp/dwy_pentest_ftp_pass.txt")
+    user_file.write_text("\n".join(set(u for u, _ in creds)))
+    pass_file.write_text("\n".join(set(p for _, p in creds)))
+
+    anon_cmd = ["nmap", "-p", str(port), "--script", "ftp-anon", host]
+    hydra_cmd = [
+        "hydra",
+        "-L", str(user_file),
+        "-P", str(pass_file),
+        "-t", "4",
+        "-f",
+        "-s", str(port),
+        host,
+        "ftp",
+    ]
+
+    # 匿名探测 + hydra 弱密码 并发
+    with ThreadPoolExecutor(max_workers=2) as pool:
+        anon_future = pool.submit(run_command, anon_cmd, 30, audit)
+        hydra_future = pool.submit(run_command, hydra_cmd, 60, audit)
+        anon_result = anon_future.result()
+        hydra_result = hydra_future.result()
+
+    user_file.unlink(missing_ok=True)
+    pass_file.unlink(missing_ok=True)
+
+    if "Anonymous FTP login allowed" in anon_result.stdout:
+        findings.append({
+            "type": "FTP Anonymous Login",
+            "detail": "FTP 服务允许匿名登录",
+            "service": f"ftp:{port}",
+            "severity": "High",
+            "cvss": 7.5,
+        })
+        console.print("  [red][HIGH] FTP 匿名登录已开启！[/red]")
+
+    for line in hydra_result.stdout.split("\n"):
+        if "host:" in line.lower() and "login:" in line.lower():
+            findings.append({
+                "type": "Weak FTP Credential",
+                "detail": line.strip(),
+                "service": f"ftp:{port}",
+                "severity": "Critical",
+                "cvss": 9.8,
+            })
+            console.print(f"  [red bold][CRITICAL] {line.strip()}[/red bold]")
+
+    if not findings:
+        console.print("  [green]FTP 安全测试通过[/green]")
+
+    return findings
+
+
+async def _async_probe_login_path(client: httpx.AsyncClient, url: str, path: str) -> str | None:
+    try:
+        resp = await client.get(f"{url}{path}")
+        if resp.status_code == 200 and any(kw in resp.text.lower() for kw in LOGIN_KEYWORDS):
+            return f"{url}{path}"
+    except Exception:
+        return None
+    return None
+
+
+async def _async_try_credential(
+    client: httpx.AsyncClient, login_url: str, username: str, password: str
+) -> dict | None:
+    try:
+        resp = await client.post(
+            login_url,
+            data={"username": username, "password": password},
+        )
+        if resp.status_code in (302, 303) and "login" not in resp.headers.get("location", "").lower():
+            return {
+                "type": "Default HTTP Credential",
+                "detail": f"登录成功: {username}:{password}",
+                "service": login_url,
+                "severity": "Critical",
+                "cvss": 9.8,
+            }
+    except Exception:
+        return None
+    return None
+
+
+async def _async_test_http_login(url: str) -> tuple[list[dict], int]:
+    findings: list[dict] = []
+    tested = 0
+
+    # 并发探测所有可能的登录页面
+    async with httpx.AsyncClient(timeout=10, verify=False, follow_redirects=True) as client:
+        path_tasks = [_async_probe_login_path(client, url, p) for p in LOGIN_PATHS]
+        path_results = await asyncio.gather(*path_tasks, return_exceptions=True)
+
+    found_login = next((r for r in path_results if isinstance(r, str)), None)
+    if not found_login:
+        return findings, tested
+
+    console.print(f"  发现登录页面: {found_login}")
+
+    # 并发尝试默认凭据（受 MAX_AUTH_ATTEMPTS 限制）
+    creds_to_try = DEFAULT_CREDENTIALS[: min(10, MAX_AUTH_ATTEMPTS)]
+    tested = len(creds_to_try)
+
+    async with httpx.AsyncClient(timeout=10, verify=False, follow_redirects=False) as client:
+        cred_tasks = [_async_try_credential(client, found_login, u, p) for u, p in creds_to_try]
+        cred_results = await asyncio.gather(*cred_tasks, return_exceptions=True)
+
+    for r in cred_results:
+        if isinstance(r, dict):
+            console.print(f"  [red bold][CRITICAL] 默认凭据有效: {r['detail']}[/red bold]")
+            findings.append(r)
+            break
+
+    return findings, tested
+
+
+def test_http_login(url: str, audit: AuditLog) -> list[dict]:
+    """HTTP 登录表单默认凭据检测（路径探测 + 凭据尝试并发）。"""
+    console.print(f"[bold]HTTP 登录测试: {url}[/bold]")
+    findings, tested = asyncio.run(_async_test_http_login(url))
+
+    if not findings and tested == 0:
+        console.print("  [green]未发现标准登录页面[/green]")
+    elif not findings:
+        console.print(f"  [green]HTTP 默认凭据测试通过（测试了 {tested} 组）[/green]")
+
+    return findings
+
+
+def main():
+    parser = argparse.ArgumentParser(description="渗透测试 - 认证测试（多服务并发）")
+    parser.add_argument("--target", required=True, help="目标 IP/域名/URL")
+    parser.add_argument("--output-dir", required=True, help="输出目录")
+    parser.add_argument("--services", default="ssh,http", help="测试服务列表，逗号分隔（ssh,ftp,http）")
+    parser.add_argument("--ssh-port", type=int, default=22, help="SSH 端口")
+    parser.add_argument("--ftp-port", type=int, default=21, help="FTP 端口")
+    args = parser.parse_args()
+
+    target, warning = validate_target(args.target)
+    if target is None:
+        console.print(f"[red]{warning}[/red]")
+        sys.exit(1)
+    if warning:
+        console.print(f"[yellow]{warning}[/yellow]")
+
+    output_dir = Path(args.output_dir)
+    output_dir.mkdir(parents=True, exist_ok=True)
+    audit = AuditLog(output_dir / "audit.log")
+
+    services = [s.strip() for s in args.services.split(",")]
+
+    # 多服务并发测试
+    console.print(f"[bold cyan]并发测试服务: {', '.join(services)}[/bold cyan]")
+    tasks: dict = {}
+    with ThreadPoolExecutor(max_workers=len(services) or 1) as pool:
+        if "ssh" in services:
+            tasks["ssh"] = pool.submit(test_ssh, target.host, args.ssh_port, audit)
+        if "ftp" in services:
+            tasks["ftp"] = pool.submit(test_ftp, target.host, args.ftp_port, audit)
+        if "http" in services:
+            url = target.web_url or f"http://{target.host}"
+            tasks["http"] = pool.submit(test_http_login, url, audit)
+
+        all_findings: list[dict] = []
+        for name, fut in tasks.items():
+            try:
+                all_findings.extend(fut.result())
+            except Exception as e:
+                console.print(f"[red]{name} 测试异常: {e}[/red]")
+
+    result = {
+        "target": target.host,
+        "timestamp": time.strftime("%Y-%m-%d %H:%M:%S"),
+        "services_tested": services,
+        "max_attempts_per_service": MAX_AUTH_ATTEMPTS,
+        "findings": all_findings,
+        "total": len(all_findings),
+    }
+
+    output_file = output_dir / "auth_test.json"
+    save_json_result(result, output_file)
+    console.print(f"\n[green]结果已保存: {output_file}[/green]")
+
+    if all_findings:
+        table = Table(title="认证测试发现")
+        table.add_column("类型")
+        table.add_column("严重性")
+        table.add_column("详情")
+        for f in all_findings:
+            table.add_row(f["type"], f["severity"], f["detail"][:60])
+        console.print(table)
+
+        console.print(f"\n[red bold]!! 发现 {len(all_findings)} 个凭据安全问题 !![/red bold]")
+    else:
+        console.print(f"\n[green]所有认证测试通过[/green]")
+
+
+if __name__ == "__main__":
+    main()