/* begin comment/readme section
HTMLSpinnr's Code Red/Code Red II Defense Script v 1.0 (initial Release) -
Written by HTMLSpinnr - codered@htmlspinnr.org
Download this file from http://www.htmlspinnr.org/codered.phps
THIS FILE IS PROVIDED AS-IS AND WITHOUT ANY WARRANTIES ON EFFECTIVENESS, SECURITY, OR FUNCTIONALITY.
Requirements:
Apache 1.x or later (tested on 1.3.20)
PHP 4.x or later (tested on 4.0.6)
Linux 2.4 kernel with iptables support enabled (tested on 2.4.7)
iptables (tested with v1.2.1a)
root (or sudo) access to the machine.
This script is freely distributable.
Readme section:
This script is a quick and dirty PHP+Shell script solution I came up with to block IP's of machines that issue Code
Red worm requests to my web server. This script to take "default.ida" Code Red worm requests and turn around and block the
IP with IPTABLES. Of course, you need to name the script default.ida and tell your http server to handle IDA files with PHP.
I understand that by the time you're blocking the IP, they've already issued the request, however this should prevent the user
from coming back a second time. The script can be modified to block the entire class C/B/A address temporarily if desired
(though I wouldn't recommend anything beyond the class B at this point). You can also configure it to do other things (such
as logging, etc.) in addition to, or instead of just blocking the IP.
Follow the steps below:
First, create a secure location on your machine where web users cannot have access. I chose
/usr/local/secure
Then copy your iptables binary to this location. I chose to rename it so I knew what it was doing. I chose iptables.suid.
Next make sure root owns the iptables.suid file, and run chmod 4555 to set the suid bit, make the binary executable,
and make the file read only by everyone. This allows PHP to call the script as a non-root user. Note this isn't neccesarily
safe (I make absolutely no warranties that it is), however putting it out of the way of your web directory helps minimize
any risks.
Then, place the following lines into a text file. The script refers to it as blockhost.sh. Modify the code below if you
chose an alternate name.. Make sure this too is located in your secure location. Make sure the script is marked executable
but read only by all users. Note, you can use whichever block method you prefer and whichever interfiace. For me, I prefer
icmp-host-unreachable responses and need blocking on my external port, eth0. $ac_option is the IP address passed by the PHP
script.
--- start shell script ---
#!/bin/bash
for ac_option
do
/usr/local/secure/iptables.suid -A INPUT -i eth0 -s $ac_option -j REJECT --reject-with icmp-host-unreachable
done
--- stop shell script ---
Next, put this PHP script into your document root for the main site, or in the document root for your first
virtual host for name based hosting. Each IP based host will require this file and configuration paramaters below.
Either symlink this script to default.ida or rename it to default.ida
Finally, edit your apache conf and place the following file either within your virtual host, or in the main portion of
your conf file:
AddHandler application/x-httpd-php ida
This could also be accomplished within a local .htaccess to be "less intrusive to your config", if allowed by your
configuration.
Finally, restart apache if you modified your configuration, and test by accessing your site via http://. Then
check your iptables w/ iptables -L (as root). If successful, your test hostname should be listed. You may not want to try
this if you're configuring remotely and you have no other means to access your box.
Questions/comments/suggestions: e-mail codered@htmlspinnr.org
end comment/readme section */
// begin actual script
?>
HTMLSpinnr's PHP Code Red Defense Script
echo "Blocking IP
";
// you can get funny and make the above response anything you'd like, i.e. compromising system, etc.
// I prefer a simple Blocking IP - you can comment the above line out all together to keep it less obvious.
$ip = getenv("REMOTE_ADDR");
$commandString = "/usr/local/secure/blockhost.sh " . $ip;
// modify above string to reflect the name of your script - note the space before the quote IS important.
$result = exec($commandString);
?>