North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: [isp-linux] RE: Massive port 80 hits

  • From: Bill Larson
  • Date: Tue Sep 18 16:05:28 2001


# IISBLOCK - Infected IIS server blocking utility.
# by Bill Larson <[email protected]> of Compu-Net Enterprises.
# This header must be kept intact if you
# wish to redistribute the script.

my $check = 0;
my $line = "";
my $weblog = "/etc/www/logs/access_log";
my $infection = "/root/infected";
my $removelist = "/root/fwclean";

# create the removelist file so that you can chmod it later and
# automatically clear the firewall.. chmod 700 iisblock

open (HTFILE3, ">$removelist");
print HTFILE3 "#!/bin/sh\n";

#open the web server log file specified above and start processing

open (HTFILE, "$weblog");
until (eof (HTFILE))
  $line  =<HTFILE>;
  chop ($line);

#Pattern match on IIS Attempts then strip down to the hostname/ip addresss

  if ($line =~ /.*\/winnt\/system32\/.*/) {
    $line =~ s/\ -.*//gi;

# This host is infected so lets do something about it.

sub infected {
  $check = 0;

# begin a check to ensure that we only take action once.

  open (HTFILE2, "$infection");
  until (eof (HTFILE2)){
    $dupe  =<HTFILE2>;
    chop ($dupe);
    if ($line =~ /$dupe/){
      $check = 1;
    else {

# If this is a unique host continue

  if ($check eq "0") {

# time to add to the list of infected hosts

    open (HTFILE2, ">>$infection");
    print HTFILE2 "$line\n";

# add using the specified add command 
# firewall software will print an error on invalid hostnames.
# Zap them one at a time maunally

    system ("/sbin/ipchains -I input -s $line -j DENY -l");

# write firewall removal line to the remove list file
# modify this line for your specific firewall software

    open (HTFILE3, ">>$removelist");
    print HTFILE3 "/sbin/ipchains -D input -s $line -j DENY -l\n";

# That's all folks!