1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
| <?php
error_reporting(1);
/**
* Дефиниция
*/
define("TRIGGER1", "GET /default.ida?NNNNNN" ); /* CodeRed I */
define("TRIGGER2", "GET /default.ida?XXXXXX" ); /* CodeRed II */
define("TRIGGER3", "GET /scripts/root.exe" ); /* Nimda */
// define("TRIGGER4", "" ); /* W32.Klez */
class worms
{
var $accesslog = "C:apachelogsaccess.log";
var $hackers = array();
var $counter = array(
"codered1" => 0,
"codered2" => 0,
"nimda" => 0
);
var $result;
function worms()
{
function get_apache_worms()
{
$fd = fopen($this->accesslog,"r");
while ($x = fgets($fd,1024)) {
list($ip , , ,$time , $GMT, , , $f, , , $referer , ) = explode(" ", $x);
if (ereg("/*.".TRIGGER1.".*/", $x, $parts))
{
$this->result .= "<b><font color=red>ТРЕВОГА!<small>ЧЕРВЕЙСКА</small> атака!</font></b> ip на хакера: <b>$ip</b> - Дата : <b>$time $GMT</b><br>n";
array_push($this->hackers, $x);
$this->counter[codered1]++;
}
if (ereg("/*.".TRIGGER2.".*/", $x, $parts))
{
$this->result .= "<b><font color=red>ТРЕВОГА 2ра СТЕПЕН <small>ЧЕРВЕЙСКА</small> атака!</font></b> ip на хакера: <b>$ip</b> - Дата : <b>$time $GMT</b><br>n";
array_push($this->hackers, $x);
$this->counter[codered2]++;
}
if (ereg("/*.".TRIGGER3.".*/", $x, $parts))
{
$this->result .= "<b><font color=red>Червеят <small>NIMDA</small> беше засечен</font></b> ip на хакера:: <b>$ip</b> - Дата: <b>$time $GMT</b><br>n";
array_push($this->hackers, $x);
$this->counter[nimda]++;
}
}
return $this->report();
}
function report()
{
$this->result .= "nn<br>
<b>Анализатор на атаките: </b><br><br>n
Брой на атаките: ".sizeof($this->hackers)." Атаки<br>n
N° Тревога 1 степен: ".$this->counter[codered1]." Атаки<br>n
N° Тревога 2 степен: ".$this->counter[codered2]." Атаки<br>n
N° Атаки на Нимда: ".$this->counter[nimda]." Атаки<br>n
";
return $this->result;
}
function _get_accesslog()
{
return $this->accesslog;
}
function _get_hackers()
{
return $this->hackers;
}
function _get_counter()
{
return $this->counter;
}
function _set_accesslog($_accesslog)
{
$this->accesslog = $_accesslog;
}
function _set_hackers($_hackers)
{
$this->hackers = $_hackers;
}
function _set_counter($_counter)
{
$this->counter = $_counter;
}
}
?> |
