#!/bin/bash #Copyright 2003 William Stearns #Released under the GPL. #ZZZZ Check Me and MyVersion Me='snort-web-php' MyVersion='20031125' #DefaultActions='' [ -r /etc/firebricks/firebricks.conf ] && . /etc/firebricks/firebricks.conf [ -r /etc/firebricks/$Me.conf ] && . /etc/firebricks/$Me.conf [ -r ${FBLibDir:-'/usr/lib/firebricks/'}/firebrickslib ] && . ${FBLibDir:-'/usr/lib/firebricks/'}/firebrickslib if [ -z "$FBLibVer" ]; then echo 'It looks like firebrickslib was not loaded, why? Exiting' >&2 exit 1 fi for OneTask in $Tasks ; do case "$OneTask" in link) $IptablesBin -N $Me >/dev/null 2>&1 #ZZZZ try to restrict the following three to only send down what the chain needs to inspect. $IptablesBin $AppIn INPUT -i \! lo -j $Me $IptablesBin $AppIn FORWARD -j $Me $IptablesBin $AppIn OUTPUT -j $Me ;; unlink) #ZZZZ Make the same changes as above (such as "-p tcp"), but if you cut and paste, note "$AppIn" is now "-D" $IptablesBin -D INPUT -i \! lo -j $Me $IptablesBin -D FORWARD -j $Me $IptablesBin -D OUTPUT -j $Me $IptablesBin -X $Me >/dev/null 2>&1 ;; create) echo "Starting $Me" >&2 FlushOrNewChain $Me LogAs="SID1774" $Ipt -A $Me -p tcp --dport 80 -m string --string '"/bb_smilies.php"' $Tail # '"WEB-PHP bb_smilies.php access"' nocase-ignored url,www.securiteam.com/securitynews/Serious_security_hole_in_PHP-Nuke__bb_smilies_.html classtype:web-application-activity sid:1774 LogAs="SID1736" $Ipt -A $Me -p tcp --dport 80 -m string --string '"/squirrelspell/modules/check_me.mod.php"' --string '"SQSPELL_APP["' $Tail # '"WEB-PHP squirrel mail spell-check arbitrary command attempt"' nocase-ignored nocase-ignored bugtraq,3952 classtype:web-application-attack sid:1736 LogAs="SID1737" $Ipt -A $Me -p tcp --dport 80 -m string --string '"/left_main.php"' --string '"cmdd="' $Tail # '"WEB-PHP squirrel mail theme arbitrary command attempt"' nocase-ignored bugtraq,4385 classtype:web-application-attack sid:1737 LogAs="SID1739" $Ipt -A $Me -p tcp --dport 80 -m string --string '"/dnstools.php"' --string '"user_logged_in=true"' --string '"user_dnstools_administrator=true"' $Tail # '"WEB-PHP DNSTools administrator authentication bypass attempt"' nocase-ignored nocase-ignored nocase-ignored bugtraq,4617 classtype:web-application-attack sid:1739 LogAs="SID1740" $Ipt -A $Me -p tcp --dport 80 -m string --string '"/dnstools.php"' --string '"user_logged_in=true"' $Tail # '"WEB-PHP DNSTools authentication bypass attempt"' nocase-ignored bugtraq,4617 classtype:web-application-attack sid:1740 LogAs="SID1741" $Ipt -A $Me -p tcp --dport 80 -m string --string '"/dnstools.php"' $Tail # '"WEB-PHP DNSTools access"' nocase-ignored bugtraq,4617 classtype:web-application-activity sid:1741 LogAs="SID1742" $Ipt -A $Me -p tcp --dport 80 -m string --string '"/dostuff.php?action=modify_user"' $Tail # '"WEB-PHP Blahz-DNS dostuff.php modify user attempt"' nocase-ignored bugtraq,4618 classtype:web-application-attack sid:1742 LogAs="SID1743" $Ipt -A $Me -p tcp --dport 80 -m string --string '"/dostuff.php"' $Tail # '"WEB-PHP Blahz-DNS dostuff.php access"' nocase-ignored bugtraq,4618 classtype:web-application-activity sid:1743 LogAs="SID1745" $Ipt -A $Me -p tcp --dport 80 -m string --string '"/supp_membre.php"' $Tail # '"WEB-PHP Messagerie supp_membre.php access"' nocase-ignored bugtraq,4635 classtype:web-application-activity sid:1745 LogAs="SID1773" $Ipt -A $Me -p tcp --dport 80 -m string --string '"/php.exe"' $Tail # '"WEB-PHP php.exe access"' nocase-ignored url,www.securitytracker.com/alerts/2002/Jan/1003104.html classtype:web-application-activity sid:1773 LogAs="SID1816" $Ipt -A $Me -p tcp --dport 80 -m string --string '"/directory.php"' $Tail # '"WEB-PHP directory.php access"' bugtraq,4278 cve,CAN-2002-0434 classtype:misc-attack sid:1816 LogAs="SID1834" $Ipt -A $Me -p tcp --dport 80 -m string --string '"/modules.php?"' --string '"name=Wiki"' --string '"&2 DestroyChain $Me ;; renamechain) TempChain="$Me-$RANDOM" echo "Replacing existing rules in $Me with new rules" >&2 $IptablesBin -E $Me $TempChain ;; replacelinks) if [ -z "$TempChain" ]; then echo "No temporary chain to relink in $Me replacelinks, replace operation incomplete." >&2 elif ! $IptablesBin -L $Me -n >/dev/null 2>&1 ; then echo "No $Me chain in $Me, replace operation incomplete." >&2 elif ! $IptablesBin -L $TempChain -n >/dev/null 2>&1 ; then echo "No $TempChain chain in $Me, replace operation incomplete." >&2 elif [ "`$IptablesBin -L INPUT -n --line-numbers | grep $TempChain | wc -l`" -ne 1 ]; then echo "Too few/many references to $TempChain in INPUT in $Me replacelinks, replace operation incomplete." >&2 elif [ "`$IptablesBin -L FORWARD -n --line-numbers | grep $TempChain | wc -l`" -ne 1 ]; then echo "Too few/many references to $TempChain in FORWARD in $Me replacelinks, replace operation incomplete." >&2 elif [ "`$IptablesBin -L OUTPUT -n --line-numbers | grep $TempChain | wc -l`" -ne 1 ]; then echo "Too few/many references to $TempChain in OUTPUT in $Me replacelinks, replace operation incomplete." >&2 else #ZZZZ Place the same criteria you used in link/unlink above in the following three lines. #ZZZZ Criteria should go just in front of "-j $Me" $IptablesBin -R INPUT `$IptablesBin -L INPUT -n --line-numbers | grep $TempChain | awk '{print $1}'` -i \! lo -j $Me $IptablesBin -R FORWARD `$IptablesBin -L FORWARD -n --line-numbers | grep $TempChain | awk '{print $1}'` -j $Me $IptablesBin -R OUTPUT `$IptablesBin -L OUTPUT -n --line-numbers | grep $TempChain | awk '{print $1}'` -j $Me DestroyChain $TempChain unset TempChain fi ;; status) if $IptablesBin -L $Me -n >/dev/null 2>&1 ; then echo "$Me created" >&2 else echo "$Me destroyed" >&2 fi ;; version) echo "$Me $MyVersion, firebrickslib $FBLibVer" >&2 ;; help) DefaultHelp #ZZZZ Please change the text to appropriate help text for this module. You should #ZZZZ cover what the module does, if it's generally safe to use, and under what #ZZZZ conditions it should not be used. Please replace the lines between the two #ZZZZ EOTEXT lines with your own. cat <&2 The $Me module puts in some blocks for fragmented icmp packets (illegal) and address mask and timestamp requests and replies. At best, these are uncommon and are used in network mapping. These rules should be safe to use on any network. EOTEXT ;; *) echo "Unknown action $Action in $Me, no action taken." >&2 ;; esac done