簡介

本文介紹了開源產(chǎn)品RoundCube webmail郵件系統(tǒng)的版本探測思路，并用go語言實(shí)現(xiàn)工具化、自動化探測。

正文

0x01 探測思路研究

探測系統(tǒng)版本，最理想的方法就是系統(tǒng)主頁html代碼中有特定的字符串，比如特定版本對應(yīng)的hash在主頁的html代碼中等等。

對于rcube mail，我們先查看它的主頁html代碼

稍作分析，發(fā)現(xiàn)上面html正文中，?s后面的字符串可能符合要求

?s=1716107237

這里有個驗(yàn)證的小技巧，可以用?1716107237?作為fofa的語句搜索（body="1716107237"），看是否有足夠多的資產(chǎn)的html代碼中都有這串字符串，如果結(jié)果足夠多，那很可能就可以依次判斷。不過也只是可能，具體是否可以以此為依據(jù)還得從代碼中看?1716107237?是如何生成的

比如下圖，資產(chǎn)足夠多，起碼能排除是隨機(jī)生成的可能

0x02 探測思路判斷

由于rcube mail是個開源軟件。我們即可直接從源代碼中分析??s=?后的值是如何得到的

全局搜索??s=?后，很快定位到下面的函數(shù)

\rcmail_output_html::file_mod

參考代碼可知，?s=1716107237?-> filemtime()函數(shù)（如下圖） -> 這串?dāng)?shù)字即是文件的最后修改時(shí)間。

理論上靜態(tài)文件可能修改較少無法作為判斷的依據(jù)，因?yàn)樾薷目赡茌^少

實(shí)際測試發(fā)現(xiàn)rcube mail每個版本的文件最后修改時(shí)間都不同?？赡苁鞘褂昧薐enkins這種構(gòu)建工具，每次重新生成代碼導(dǎo)致每個發(fā)布版本的文件都會新建，導(dǎo)致即使文件內(nèi)容不變動，文件的最后修改時(shí)間還是會變。

我們即可依據(jù)此作為判斷

0x03 實(shí)現(xiàn)細(xì)節(jié)

依據(jù)上面的思路，我們要實(shí)現(xiàn)版本檢測，大致步驟如下

1. 下載全部版本的rcubemail
2. 計(jì)算 jquery.min.js 或其他靜態(tài)資源文件的最后修改時(shí)間
3. 建立rcube mail版本和文件最后修改時(shí)間的映射
4. go語言實(shí)現(xiàn)發(fā)送請求從目標(biāo)html代碼中取得??s=?后的字符串，以此判斷

實(shí)現(xiàn)過程中下載全部版本的rcubemail較為麻煩，截至文章發(fā)布日最新版本是 v1.6.9，大致估略版本不少于70個，

肯定不能手動下載。

解決辦法：

這里用了github的REST api，從下面api地址獲取rcubemail的全部版本

https://api.github.com/repos/roundcube/roundcubemail/releases

解析api返回的json數(shù)據(jù)，提取對應(yīng)版本壓縮包地址然后下載即可，關(guān)鍵代碼如下

// github releases API URLurl := "https://api.github.com/repos/roundcube/roundcubemail/releases"if SocksProxy != "" {CustomhttpClient = httputils.NewHttpClient(httputils.WithSocks5Proxy(SocksProxy),)} else {CustomhttpClient = httputils.NewHttpClient()}JsonResp, err := httputils.HttpWithSocks(url, CustomhttpClient)if err != nil {fmt.Println("Error making request:", err)return}defer JsonResp.Body.Close()body, err := io.ReadAll(JsonResp.Body)if err != nil {fmt.Println("Error reading response body:", err)return}var releases []struct {Assets []Asset `json:"assets"`}if err := json.Unmarshal(body, &releases); err != nil {fmt.Println("Error parsing JSON:", err)return}gologger.Info().Msgf("Matching download URLs:")var wg sync.WaitGroupfor _, release := range releases {for _, asset := range release.Assets {if !strings.Contains(asset.BrowserDownloadURL, "asc") && !strings.Contains(asset.BrowserDownloadURL, "framework") {wg.Add(1)go func(urlDownload, filename string) {defer wg.Done()fmt.Printf("Downloading %s...\n", filename)if err := downloadFile(filename, urlDownload); err != nil {fmt.Printf("Error downloading %s: %v\n", filename, err)} else {fmt.Printf("Downloaded %s successfully.\n", filename)}}(asset.BrowserDownloadURL, asset.BrowserDownloadURL[strings.LastIndex(asset.BrowserDownloadURL, "/")+1:])}}}wg.Wait()

然后從下載的源代碼壓縮包中導(dǎo)出每個版本的jquery.min.js文件，文件名帶上rcube mail版本方便下一步使用。

關(guān)鍵代碼如下

dir := "D:\\SEC_Note\\rcube_versions"files, err := os.ReadDir(dir)if err != nil {fmt.Println(err)return}for _, file := range files {if file.IsDir() {continue//fmt.Println("Folder: ", file.Name())} else {absPath, err := filepath.Abs(filepath.Join(dir, file.Name()))if err != nil {fmt.Println(err)continue}fmt.Println("File: ", absPath)mainDo(absPath)}}

最后用php計(jì)算文件的最后修改時(shí)間

<?php
$directory = '.';
$files = scandir($directory);foreach ($files as $file) {if ($file != "." && $file != "..") {$filePath = $directory . DIRECTORY_SEPARATOR . $file;if (is_file($filePath)) {$fileMTime = filemtime($filePath);echo $file . ' + ' . $fileMTime . PHP_EOL;}}
}?>

建立映射，即可得到如下版本映射。然后用go實(shí)現(xiàn)請求目標(biāo)獲得html代碼，匹配??s={{num}}?即可

// Define version mapversionMap := map[string]string{"1636751527": "roundcubemail-1.3.17-complete.tar.gz","1636751547": "roundcubemail-1.3.17.tar.gz","1612812581": "roundcubemail-1.4.11-complete.tar.gz","1612812601": "roundcubemail-1.4.11.tar.gz","1636753154": "roundcubemail-1.4.12-complete.tar.gz","1636753175": "roundcubemail-1.4.12.tar.gz","1640818035": "roundcubemail-1.4.13-complete.tar.gz","1640818057": "roundcubemail-1.4.13.tar.gz","1694896977": "roundcubemail-1.4.14-complete.tar.gz","1694897047": "roundcubemail-1.4.14.tar.gz","1697461030": "roundcubemail-1.4.15-complete.tar.gz","1697461064": "roundcubemail-1.4.15.tar.gz","1614281846": "roundcubemail-1.5-beta-complete.tar.gz","1614281870": "roundcubemail-1.5-beta.tar.gz","1625341161": "roundcubemail-1.5-rc-complete.tar.gz","1625341187": "roundcubemail-1.5-rc.tar.gz","1634503084": "roundcubemail-1.5.0-complete.tar.gz","1634503112": "roundcubemail-1.5.0.tar.gz","1637615532": "roundcubemail-1.5.1-complete.tar.gz","1637615555": "roundcubemail-1.5.1.tar.gz","1640816963": "roundcubemail-1.5.2-complete.tar.gz","1640817081": "roundcubemail-1.5.2.tar.gz","1656275218": "roundcubemail-1.5.3-complete.tar.gz","1656275241": "roundcubemail-1.5.3.tar.gz","1695024809": "roundcubemail-1.5.4-complete.tar.gz","1695024837": "roundcubemail-1.5.4.tar.gz","1697451371": "roundcubemail-1.5.5-complete.tar.gz","1697451403": "roundcubemail-1.5.5.tar.gz","1699175465": "roundcubemail-1.5.6-complete.tar.gz","1699175495": "roundcubemail-1.5.6.tar.gz","1716112649": "roundcubemail-1.5.7-complete.tar.gz","1716112666": "roundcubemail-1.5.7.tar.gz","1722763434": "roundcubemail-1.5.8-complete.tar.gz","1722763449": "roundcubemail-1.5.8.tar.gz","1725175135": "roundcubemail-1.5.9-complete.tar.gz","1725175151": "roundcubemail-1.5.9.tar.gz","1646598729": "roundcubemail-1.6-beta-complete.tar.gz","1646598754": "roundcubemail-1.6-beta.tar.gz","1655027980": "roundcubemail-1.6-rc-complete.tar.gz","1655025289": "roundcubemail-1.6-rc.tar.gz","1658607434": "roundcubemail-1.6.0-complete.tar.gz","1658607455": "roundcubemail-1.6.0.tar.gz","1674504194": "roundcubemail-1.6.1-complete.tar.gz","1674504217": "roundcubemail-1.6.1.tar.gz","1688210976": "roundcubemail-1.6.2-complete.tar.gz","1688211001": "roundcubemail-1.6.2.tar.gz","1694765308": "roundcubemail-1.6.3-complete.tar.gz","1694765330": "roundcubemail-1.6.3.tar.gz","1697448186": "roundcubemail-1.6.4-complete.tar.gz","1697448209": "roundcubemail-1.6.4.tar.gz","1699174738": "roundcubemail-1.6.5-complete.tar.gz","1699174760": "roundcubemail-1.6.5.tar.gz","1705745704": "roundcubemail-1.6.6-complete.tar.gz","1705745675": "roundcubemail-1.6.6.tar.gz","1716107237": "roundcubemail-1.6.7-complete.tar.gz","1716107254": "roundcubemail-1.6.7.tar.gz","1722764714": "roundcubemail-1.6.8-complete.tar.gz","1722764729": "roundcubemail-1.6.8.tar.gz","1725175896": "roundcubemail-1.6.9-complete.tar.gz","1725175911": "roundcubemail-1.6.9.tar.gz",}

然后就是工具實(shí)現(xiàn)過程

0x04 工具實(shí)現(xiàn)和開源代碼

工具最終的效果，相關(guān)代碼隨后開源在我的github地址

https://github.com/P001water

P1rcubemail.exe getver -u http://192.168.110.142/roundcubemail-1.6.7/

小結(jié)

本文實(shí)現(xiàn)了rcube webmail的版本探測的go語言工具化，但是后續(xù)還有優(yōu)化的空間，比如

后來發(fā)現(xiàn)從github api接口拿到的并不是全部版本，只是到v1.3.17，后面還可以加上前面的版本

rcube mail系統(tǒng)訪問很多情況需要掛代理，需要加上代理訪問

后續(xù)隨著使用需求更新