PDA

Archiv verlassen und diese Seite im Standarddesign anzeigen : [S] Syn Deflate Script


Paran0id
30.08.2010, 20:58
Hi Leute, suche folgendes script was irgendwie aus dem netz verschwunden ist, alles was ich noch habe ist folgender Abschnitt:


#!/bin/sh
load_conf()
{
CONF="/usr/local/synd/synd.conf"
if [ -f "$CONF" ] && [ ! "$CONF" == "" ]; then
source $CONF
else
head
echo "\$CONF not found."
exit 1
fi
}

head()
{
echo "Syn-Deflate version 0.1 alpha"
echo "Based on Dos-Deflate - felosi <admin@nix101.com>"
echo
}

showhelp()
{
head
echo 'Usage: synd.sh [OPTIONS] [N]'
echo 'N : number of SYN_RECV connections (default 10)'
echo 'OPTIONS:'
echo '-h | --help: Show this help screen'
echo '-c | --cron: Create cron job to run this script regularly (default 1 mins)'
echo '-k | --kill: Block the offending ip making more than N SYN_RECV connections'
}

unbanip()
{
UNBAN_SCRIPT=`mktemp /tmp/unban.XXXXXXXX`
TMP_FILE=`mktemp /tmp/unban.XXXXXXXX`
UNBAN_IP_LIST=`mktemp /tmp/unban.XXXXXXXX`
echo '#!/bin/sh' > $UNBAN_SCRIPT
echo "sleep $BAN_PERIOD" >> $UNBAN_SCRIPT
if [ $APF_BAN -eq 1 ]; then
while read line; do
echo "$APF -d $line" >> $UNBAN_SCRIPT
echo $line >> $UNBAN_IP_LIST
done < $BANNED_IP_LIST
else
while read line; do
echo "$IPT -D INPUT -s $line -j DROP" >> $UNBAN_SCRIPT
echo $line >> $UNBAN_IP_LIST
done < $BANNED_IP_LIST
fi
echo "grep -v --file=$UNBAN_IP_LIST $IGNORE_IP_LIST > $TMP_FILE" >> $UNBAN_SCRIPT
echo "mv $TMP_FILE $IGNORE_IP_LIST" >> $UNBAN_SCRIPT
echo "rm -f $UNBAN_SCRIPT" >> $UNBAN_SCRIPT
echo "rm -f $UNBAN_IP_LIST" >> $UNBAN_SCRIPT
echo "rm -f $TMP_FILE" >> $UNBAN_SCRIPT
. $UNBAN_SCRIPT &
}

add_to_cron()
{
rm -f $CRON
sleep 1
service crond restart
sleep 1
echo "SHELL=/bin/sh" > $CRON
if [ $FREQ -le 2 ]; then
echo "0-59/$FREQ * * * * root /usr/local/synd/synd.sh >/dev/null 2>&1" >> $CRON
else
let "START_MINUTE = $RANDOM % ($FREQ - 1)"
let "START_MINUTE = $START_MINUTE + 1"
let "END_MINUTE = 60 - $FREQ + $START_MINUTE"
echo "$START_MINUTE-$END_MINUTE/$FREQ * * * * root /usr/local/synd/synd.sh >/dev/null 2>&1" >> $CRON
fi
service crond restart
}


load_conf
while [ $1 ]; do
case $1 in
'-h' | '--help' | '?' )
showhelp
exit
;;
'--cron' | '-c' )
add_to_cron
exit
;;
'--kill' | '-k' )
KILL=1
;;
*[0-9]* )
NO_OF_CONNECTIONS=$1
;;
* )
showhelp
exit
;;
esac
shift
done

TMP_PREFIX='/tmp/synd'
TMP_FILE="mktemp $TMP_PREFIX.XXXXXXXX"
BANNED_IP_MAIL=`$TMP_FILE`
BANNED_IP_LIST=`$TMP_FILE`
echo "Banned the following ip addresses on `date`" > $BANNED_IP_MAIL
echo >> $BANNED_IP_MAIL
BAD_IP_LIST=`$TMP_FILE`
netstat -ntu | grep SYN_RECV | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr > $BAD_IP_LIST
cat $BAD_IP_LIST
if [ $KILL -eq 1 ]; then
IP_BAN_NOW=0
while read line; do
CURR_LINE_CONN=$(echo $line | cut -d" " -f1)
CURR_LINE_IP=$(echo $line | cut -d" " -f2)
if [ $CURR_LINE_CONN -lt $NO_OF_CONNECTIONS ]; then
break
fi
IGNORE_BAN=`grep -c $CURR_LINE_IP $IGNORE_IP_LIST`
if [ $IGNORE_BAN -ge 1 ]; then
continue
fi
IP_BAN_NOW=1
echo "$CURR_LINE_IP with $CURR_LINE_CONN SYN_RECV connections" >> $BANNED_IP_MAIL
echo $CURR_LINE_IP >> $BANNED_IP_LIST
echo $CURR_LINE_IP >> $IGNORE_IP_LIST
if [ $APF_BAN -eq 1 ]; then
$APF -d $CURR_LINE_IP
else
$IPT -I INPUT -s $CURR_LINE_IP -j DROP
fi
done < $BAD_IP_LIST
if [ $IP_BAN_NOW -eq 1 ]; then
dt=`date`
hn=`hostname`
# if [ $EMAIL_TO != "" ]; then
# cat $BANNED_IP_MAIL | mail -s "IP addresses banned on $dt $hn" $EMAIL_TO
# fi
unbanip
fi
fi
rm -f $TM

Ich hoffe ihr könnt mir helfen.

Gruß
CyphaX
30.08.2010, 21:03
DDoS Deflate | DDoS Protection Script for Servers - DigitalZone Board (http://forum.digitalpowered.net/index.php?showtopic=33789&pid=354470&st=0+++entry354470)

Vlt hilft dir das hier auch weiter.
Paran0id
30.08.2010, 21:05
Nein, DDoS Deflate ist der Grundstein von Syn Deflate, jedoch bringt mich dieser leider nicht weiter :-/
mbeezy
30.08.2010, 21:08
If anyone is interested the completely legitimate script they disabled my server for is:

#!/bin/sh
load_conf()
{
CONF="/usr/local/synd/synd.conf"
if [ -f "$CONF" ] && [ ! "$CONF" == "" ]; then
source $CONF
else
head
echo "\$CONF not found."
exit 1
fi
}

head()
{
echo "Syn-Deflate version 0.1 alpha"
echo "Based on Dos-Deflate - felosi <admin@nix101.com>"
echo
}

showhelp()
{
head
echo 'Usage: synd.sh [OPTIONS] [N]'
echo 'N : number of SYN_RECV connections (default 10)'
echo 'OPTIONS:'
echo '-h | --help: Show this help screen'
echo '-c | --cron: Create cron job to run this script regularly (default 1 mins)'
echo '-k | --kill: Block the offending ip making more than N SYN_RECV connections'
}

unbanip()
{
UNBAN_SCRIPT=`mktemp /tmp/unban.XXXXXXXX`
TMP_FILE=`mktemp /tmp/unban.XXXXXXXX`
UNBAN_IP_LIST=`mktemp /tmp/unban.XXXXXXXX`
echo '#!/bin/sh' > $UNBAN_SCRIPT
echo "sleep $BAN_PERIOD" >> $UNBAN_SCRIPT
if [ $APF_BAN -eq 1 ]; then
while read line; do
echo "$APF -d $line" >> $UNBAN_SCRIPT
echo $line >> $UNBAN_IP_LIST
done < $BANNED_IP_LIST
else
while read line; do
echo "$IPT -D INPUT -s $line -j DROP" >> $UNBAN_SCRIPT
echo $line >> $UNBAN_IP_LIST
done < $BANNED_IP_LIST
fi
echo "grep -v --file=$UNBAN_IP_LIST $IGNORE_IP_LIST > $TMP_FILE" >> $UNBAN_SCRIPT
echo "mv $TMP_FILE $IGNORE_IP_LIST" >> $UNBAN_SCRIPT
echo "rm -f $UNBAN_SCRIPT" >> $UNBAN_SCRIPT
echo "rm -f $UNBAN_IP_LIST" >> $UNBAN_SCRIPT
echo "rm -f $TMP_FILE" >> $UNBAN_SCRIPT
. $UNBAN_SCRIPT &
}

add_to_cron()
{
rm -f $CRON
sleep 1
service crond restart
sleep 1
echo "SHELL=/bin/sh" > $CRON
if [ $FREQ -le 2 ]; then
echo "0-59/$FREQ * * * * root /usr/local/synd/synd.sh >/dev/null 2>&1" >> $CRON
else
let "START_MINUTE = $RANDOM % ($FREQ - 1)"
let "START_MINUTE = $START_MINUTE + 1"
let "END_MINUTE = 60 - $FREQ + $START_MINUTE"
echo "$START_MINUTE-$END_MINUTE/$FREQ * * * * root /usr/local/synd/synd.sh >/dev/null 2>&1" >> $CRON
fi
service crond restart
}


load_conf
while [ $1 ]; do
case $1 in
'-h' | '--help' | '?' )
showhelp
exit
;;
'--cron' | '-c' )
add_to_cron
exit
;;
'--kill' | '-k' )
KILL=1
;;
*[0-9]* )
NO_OF_CONNECTIONS=$1
;;
* )
showhelp
exit
;;
esac
shift
done

TMP_PREFIX='/tmp/synd'
TMP_FILE="mktemp $TMP_PREFIX.XXXXXXXX"
BANNED_IP_MAIL=`$TMP_FILE`
BANNED_IP_LIST=`$TMP_FILE`
echo "Banned the following ip addresses on `date`" > $BANNED_IP_MAIL
echo >> $BANNED_IP_MAIL
BAD_IP_LIST=`$TMP_FILE`
netstat -ntu | grep SYN_RECV | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr > $BAD_IP_LIST
cat $BAD_IP_LIST
if [ $KILL -eq 1 ]; then
IP_BAN_NOW=0
while read line; do
CURR_LINE_CONN=$(echo $line | cut -d" " -f1)
CURR_LINE_IP=$(echo $line | cut -d" " -f2)
if [ $CURR_LINE_CONN -lt $NO_OF_CONNECTIONS ]; then
break
fi
IGNORE_BAN=`grep -c $CURR_LINE_IP $IGNORE_IP_LIST`
if [ $IGNORE_BAN -ge 1 ]; then
continue
fi
IP_BAN_NOW=1
echo "$CURR_LINE_IP with $CURR_LINE_CONN SYN_RECV connections" >> $BANNED_IP_MAIL
echo $CURR_LINE_IP >> $BANNED_IP_LIST
echo $CURR_LINE_IP >> $IGNORE_IP_LIST
if [ $APF_BAN -eq 1 ]; then
$APF -d $CURR_LINE_IP
else
$IPT -I INPUT -s $CURR_LINE_IP -j DROP
fi
done < $BAD_IP_LIST
if [ $IP_BAN_NOW -eq 1 ]; then
dt=`date`
hn=`hostname`
# if [ $EMAIL_TO != "" ]; then
# cat $BANNED_IP_MAIL | mail -s "IP addresses banned on $dt $hn" $EMAIL_TO
# fi
unbanip
fi
fi
rm -f $TMP_PREFIX.*
Quelle: OVH / kimsufi are one of the worst providers i've ever delt with - Kimsufi Forum (http://forum.kimsufi.co.uk/showthread.php?t=253)
Paran0id
30.08.2010, 21:09
root:~# ./install.sh
Syn-Deflate version 0.1 alpha
Based on Dos-Deflate - felosi <admin@nix101.com>

$CONF not found.


Die config fehlt leider :-/
mbeezy
30.08.2010, 21:14
cd
mkdir syn
cd syn
wget http://nix101.com/synd-apf/install.sh
chmod 777 install.sh
./install.sh

Da, step by step Anleitung für Jedermann, damit packste das: http://www.anti-hack.net/viewtopic.php?f=9&t=34&drgn=1
Paran0id
30.08.2010, 21:17
Danke, die Anleitung kenne ich bereits, doch die Links sind down, da das Projekt an Blacklotus verkauft wurde
Nonne93
30.08.2010, 21:39
Ich glaube eher du hast keine Ahnung ..Paran0id? Weisst du überhaupt für was das Script ist?
Paran0id
30.08.2010, 21:46
Nein natürlich nicht, ich installiere auf meiner Box 1000 Scripte deren Funktion ich nicht kenne.
Kid Icarus
30.08.2010, 21:55
Dann solltest du vllt. nicht so etwas installieren, wenn du es nicht kennst.
Paran0id
30.08.2010, 22:41
Habe mich mit einem Member in Verbindung gesetzt und er scheint das Script neu zu schreiben... mal abwarten
Florian.Reith
05.10.2010, 21:54
Bittesehr:
http://www.anti-hack.net/viewtopic.php?f=9&t=55

wobei ich euch folgendes ans Herz lege:
http://www.anti-hack.net/viewtopic.php?f=9&t=69

Gruß Florian